> ## Documentation Index
> Fetch the complete documentation index at: https://docs.querybear.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PostgreSQL + Windsurf

> How to set up a secure PostgreSQL MCP server for Windsurf using QueryBear. Add as a custom MCP server in Windsurf settings. Step-by-step with read-only role and example queries.

This guide walks through connecting **PostgreSQL** to **[Windsurf](https://codeium.com/windsurf)** (Codeium's AI-first code editor) using QueryBear's managed MCP server. End result: Windsurf's Cascade agent can query your Postgres database while it codes.

## What you'll need

* A QueryBear account ([sign up free](https://querybear.com/signup))
* A PostgreSQL database (any version 12+)
* Windsurf installed

## Step 1: Create a read-only PostgreSQL role

```sql theme={null}
CREATE ROLE querybear LOGIN PASSWORD 'choose-a-strong-one';
GRANT CONNECT ON DATABASE your_db TO querybear;
GRANT USAGE ON SCHEMA public TO querybear;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO querybear;
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT ON TABLES TO querybear;
```

## Step 2: Add the connection to QueryBear

In the [QueryBear dashboard](https://querybear.com/dashboard) → **Connections** → **New connection** → **PostgreSQL**, with the credentials from Step 1.

## Step 3: Add QueryBear to Windsurf

<Steps>
  <Step title="Open Windsurf Settings">
    **Settings** → **MCP Servers** → **Add custom server**.
  </Step>

  <Step title="Paste the config">
    ```json theme={null}
    {
      "mcpServers": {
        "querybear": {
          "serverUrl": "https://mcp.querybear.com/mcp"
        }
      }
    }
    ```

    Note: Windsurf uses `serverUrl`, not `url`.
  </Step>

  <Step title="Save and authorize">
    The first time Cascade uses QueryBear, an OAuth browser tab opens. Approve.
  </Step>
</Steps>

## Step 4: Verify

In Cascade:

> *"What QueryBear tools do you have? List my connections."*

You should see `list_connections`, `get_schema`, `run_query`, and your Postgres connection.

## Try it

> *"I'm refactoring the subscription cancellation flow. Pull the schema for `subscriptions`, `subscription_events`, and `users`. Then count cancellations in the last 30 days by reason."*

Cascade calls `get_schema` for each table, writes a join + group-by query, and runs it through QueryBear.

## Postgres + Windsurf gotchas

* **`serverUrl` not `url`.** This is the #1 reason Windsurf doesn't see the MCP server. Cursor uses `url`; Windsurf uses `serverUrl`.
* **Cascade multi-steps.** It often calls `get_schema` → `run_query` → `get_schema` → `run_query`. This is normal and produces better answers.
* **Ask for the plan first.** For risky reads, *"outline the queries you'd run first"* gives you a preview before Cascade executes.
* **OAuth is per-install.** If you use Windsurf on multiple machines, authorize each.

## Related

* [PostgreSQL MCP server](/databases/postgres) — Postgres-specific deep dive
* [Windsurf client](/clients/windsurf) — Windsurf overview
* [Security model](/features/security) — what the gateway protects against