Claude Code can propose the Postgres migration. It should not execute it.

Claude Code can inspect application code, trace a failing query, and propose a PostgreSQL migration in one session.

That does not mean the same session should execute the migration.

A safer Claude Code + MCP + Postgres boundary:

1. use a dedicated read-only investigation identity
2. expose schema, plan, lock, sample, and migration-status tools
3. keep mutation tools out of that server
4. bind every call to an explicit environment
5. return a structured migration plan with preconditions and a digest
6. validate the plan against current schema and runtime state
7. approve the exact digest, target, scope, window, and impact
8. execute through a controlled runner with a short-lived identity
9. revalidate before execution
10. return a durable receipt and preserve recovery checkpoints

The key distinction is simple:

• Claude Code can investigate.
• Claude Code can propose.
• A reviewer can approve.
• A constrained runner can execute.

Combining those authorities makes a smooth demo.

Separating them makes a production boundary.

Full guide: Claude Code MCP Postgres: separate investigation from migration authority