Your AI query did not change. The Postgres plan did.

A safe MCP query can become expensive without changing its SQL.

Data grows. Statistics drift. An index disappears. A type cast changes selectivity. PostgreSQL is upgraded.

The same tool call that used an index yesterday may scan and sort a large table tomorrow.

Treat plan behavior as a versioned production contract:

• keep normalized query shapes and parameter classes
• capture structured JSON plans with schema, Postgres, statistics, and index versions
• fingerprint meaningful behavior such as scan type, join strategy, pruning, estimated rows, cost, and temp work
• define workflow-specific budgets
• test tenant, date-range, null, and cardinality skew
• gate migrations, index changes, upgrades, and configuration changes
• canary approved operations after deployment

EXPLAIN is a gate, not an oracle. Planner estimates can be wrong, so keep database-enforced timeouts, pool limits, approved views, bounded inputs, cancellation, and overload behavior authoritative at runtime.

If an operation has no recognized envelope or crosses its budget, narrow it, defer it, or require review. Do not silently raise the limit until the test passes.

Full guide: MCP server for Postgres: enforce a query-plan regression budget