Neon is a serverless Postgres platform with projects, branches, and database access controls. Use OAuth for user-delegated MCP access or an API key restricted to a non-production project and branch.
This guide prepares Neon for an MCP client. The Neon agent template is separate from Neon project and database access setup.
Choose a connection method
Choose OAuth when the MCP connection should follow a developer's Neon permissions. Choose an API key for a named unattended integration and keep it limited to a non-production project. Neon's API-key documentation covers key creation, scoping, and revocation.
Recommended: OAuth
Use OAuth when the MCP implementation supports it and the server should follow a developer's Neon permissions. Create a Neon test project and test branch with non-production data, register the MCP client's exact callback, and authorize a developer whose project access is limited to that boundary. Verify that a production project is unavailable before attaching the connection to an agent.
Alternative: Dedicated API key
Use an API key for unattended automation. Create it in the Neon console for a dedicated integration identity, restrict the identity to the intended non-production project and branch, and record the key's owner and rotation date in secret storage. Do not grant production organization ownership. List or query the known test branch, then verify a production project is unavailable.
Neon's API key documentation is the reference for current credential management.
Verify Neon MCP
Use this checklist to confirm the MCP server is connected with the intended access.
- Connect the MCP client using the newly created authorization.
- Confirm that Neon MCP tools are discovered.
- Read one known test resource that the authorized identity is allowed to access.
- Attempt to read a resource outside the approved Neon boundary; it should be unavailable or denied.
- Confirm that no write capability beyond the reviewed setup is available.
Troubleshooting
Missing branches normally reflect project membership or branch permissions. A database credential and a Neon control-plane API key are different credentials; use the type required by the MCP server.
Next steps
Deploy the Neon agent template to create a governed agent in Dome that can work with the approved database project and branch, with the template's included model, tools, and rules.
