How do AI agents use Neon through Open Connector?

Your user connects Neon once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Neon tools to your agent over MCP or a typed API, with credentials injected server-side on each call.

Is this a Neon MCP server?

Yes. Open Connector can serve Neon as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Neon actions with credentials injected server-side.

Where do Neon credentials live?

In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Neon integration

Neon integration for AI agents.

Neon integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Neon tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.

View source on GitHub All integrations →

What your agents can do

Real Neon actions, managed and audited.

Your user connects Neon once; your agent can then the backend for apps and agents. Build with Lakebase Postgres, Auth, Functions, Storage, and an AI Gateway: instant, branchable, serverless — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.

1
Your user grants Neon access once (OAuth) — the token lands in the vault.
2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
3
Every routed call appends a hash-chained audit record — nothing leaves your infra.

Tools & triggers

Supported Neon tools.

168 tools are generated from the published Neon catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.

Showing 168 tools. All published catalog entries are included in this page's server-rendered HTML.

Accept a project transfer request: Accepts a transfer request for the specified project, transferring it to the specified organization or user. If org_id is not passed, the project will be transferred to the current user or organization account.; Project
Add an OAuth provider: Adds an OAuth provider configuration to the specified branch's Neon Auth integration. After adding, users can authenticate using the configured provider.; Auth
Add domain to redirect_uri whitelist: Adds a domain to the redirect URI whitelist for the specified branch. Only domains in this list are permitted as redirect targets after authentication.; Auth
Add trusted redirect URI domain: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/domains` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
Add an OAuth provider: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/oauth_providers` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
Add JWKS URL: Adds a JWKS URL to the specified project for verifying JWTs used as the authentication mechanism. The URL must be a valid HTTPS URL that returns a JSON Web Key Set. The `provider_name` field allows you to specify which authentication provider you're using (e.g., Clerk, Auth0, AWS Cognito). The `branch_id` scopes the JWKS URL to specific branches; if not specified, it applies to all branches. The `role_names` scopes the URL to specific roles; if not specified, default roles are used (`authenticator`, `authenticated`, `anonymous`). The `jwt_audience` specifies which `aud` values are accepted in JWTs.; Project
Assign or update VPC endpoint: Assigns a VPC endpoint to a Neon organization or updates its existing assignment.; Organizations
Set VPC endpoint restriction: Sets or updates a VPC endpoint restriction for a Neon project. When a VPC endpoint restriction is set, the project only accepts connections from the specified VPC. A VPC endpoint can be set as a restriction only after it is assigned to the parent organization of the Neon project.; Project
Retrieve number of branches: Retrieves the total number of branches in the specified project. Supports an optional `search` parameter to count branches matching a name filter.; Branch
Create API key: Creates an API key. The `key_name` is a user-specified name for the key. Returns an `id` and `key`; the `key` is a randomly generated, 64-bit token required to access the Neon API. Store the key securely — it is only returned once. API keys can also be managed in the Neon Console. See [Manage API keys](https://neon.com/docs/manage/api-keys/).; API Key
Create new auth user: Creates a new user in the Neon Auth user directory for the specified branch. The user is created in the `neon_auth.users_sync` table and can immediately authenticate using the branch's configured auth providers.; Auth
Issue a scoped credential on the branch: Issues a new scoped service credential anchored to the specified branch. The response carries `api_token` and `s3_secret_access_key` exactly once — they are not stored server-side. **Note**: This endpoint is currently in Beta.; Credentials
Enable Neon Auth for the branch: Enables Neon Auth for the specified branch by connecting it to an authentication provider. Creating the integration provisions the `neon_auth` schema in the branch database, which stores user identity data synchronized from the provider.; Auth
Create Neon Auth integration: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth` instead. Removal scheduled for March 1, 2026. Use this endpoint if the frontend integration flow can't be used.; Auth (legacy)
Create new auth user: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/users` instead. Removal scheduled for March 1, 2026. The user will be created in your neon_auth.users_sync table and automatically propagated to your auth project, whether Neon-managed or provider-owned.; Auth (legacy)
Create Auth Provider SDK keys: Generates SDK or API Keys for the auth provider. These might be called different things depending on the auth provider you're using, but are generally used for setting up the frontend and backend SDKs.; Auth (legacy)
Create organization API key: Creates an API key for the specified organization. The `key_name` is a user-specified name for the key. Returns an `id` and `key`; the `key` is a randomly generated, 64-bit token required to access the Neon API. Store the key securely — it is only returned once. API keys can also be managed in the Neon Console. See [Manage API keys](https://neon.com/docs/manage/api-keys/).; Organizations
Create organization invitations: Creates invitations for a specific organization. If the invited user has an existing account, they automatically join as a member. If they don't yet have an account, they are invited to create one, after which they become a member. Each invited user receives an email notification.; Organizations
Create project: Creates a Neon project within an organization. If using a personal API key, include the `org_id` parameter to specify which organization to create the project in. If using an org API key, `org_id` is automatically inferred from the key. Plan limits define how many projects you can create. For more information, see [Manage projects](https://neon.com/docs/manage/projects/). You can specify a region and Postgres version in the request body. Neon supports Postgres 14 through 18, with 19 rolling out to enabled regions. For supported regions and `region_id` values, see [Regions](https://neon.com/docs/introduction/regions/).; Project
Create branch: Creates a branch in the specified project. No request body is required, but you can specify one to create a compute endpoint or select a non-default parent branch. By default, the branch is created from the project's default branch with no compute endpoint, and the branch name is auto-generated. To access the branch, add a `read_write` endpoint. Each branch supports one read-write endpoint and multiple read-only endpoints. For related information, see [Manage branches](https://neon.com/docs/manage/branches/).; Branch
Create anonymized branch: Creates a new branch with anonymized data using PostgreSQL Anonymizer for static masking. This allows developers to work with masked production data. Optionally, provide `masking_rules` to set initial masking rules for the branch and `start_anonymization` to automatically start anonymization after creation. This combines functionality of updating masking rules and starting anonymization into the branch creation request. **Note**: This endpoint is currently in Beta.; Branch
Create a bucket on the branch: Creates a new branchable object storage bucket on the specified branch. Buckets are managed by the Neon Platform branchable object storage service. **Note**: This endpoint is currently in Beta.; Buckets
Create Neon Data API: Creates a new instance of Neon Data API in the specified branch. The Data API exposes a REST interface over the branch database. The `database_name` path parameter determines which database the API serves.; DataAPI
Create database: Creates a database in the specified branch. A branch can have multiple databases. For related information, see [Manage databases](https://neon.com/docs/manage/databases/).; Branch
Deploy code to a function: Creates a deployment for the function. Supply any subset of zip, environment, and runtime; omitted fields inherit the function's latest version. At least one field must be supplied. The first deployment of a function must include zip. The newest deployment becomes active. **Note**: This endpoint is currently in Beta.; Functions
Create role: Creates a Postgres role in the specified branch. For related information, see [Manage roles](https://neon.com/docs/manage/roles/). Connections established to the active compute endpoint will be dropped. If the compute endpoint is idle, the endpoint becomes active for a short period of time and is suspended afterward.; Branch
Create compute endpoint: Creates a compute endpoint for the specified branch. A compute endpoint is a Neon compute instance. There is a maximum of one read-write compute endpoint per branch. If the specified branch already has a read-write compute endpoint, the operation fails. A branch can have multiple read-only compute endpoints. For more information about compute endpoints, see [Manage computes](https://neon.com/docs/manage/endpoints/).; Endpoint
Create a project transfer request: Creates a transfer request for the specified project. The request expires after a set period. To accept the request, the recipient calls `PUT /projects/{project_id}/transfer_requests/{request_id}` or uses the Neon Console claim link. The optional `ru` parameter redirects the recipient after acceptance.; Project
Create snapshot: Creates a snapshot from the specified branch. This operation may initiate an asynchronous process.; Snapshot
Delete OAuth provider: Deletes an OAuth provider from the specified project.; Auth
Delete domain from redirect_uri whitelist: Removes a domain from the redirect URI whitelist for the specified branch. After removal, the domain can no longer be used as a redirect target after authentication.; Auth
Delete auth user: Deletes the specified user from the Neon Auth user directory for the specified branch. Removes the user record from `neon_auth.users_sync`. This action cannot be undone.; Auth
Delete trusted redirect URI domain: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/domains` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
Delete integration with auth provider: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
Delete OAuth provider: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/oauth_providers/{oauth_provider_id}` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
Delete auth user: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/users/{auth_user_id}` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
Remove organization spending limit: Removes the configured monthly spending limit for the specified organization. Idempotent — removing an already-unset limit still succeeds. Available to organization admins on Launch and Scale plans only.; Organizations
Delete VPC endpoint: Deletes the VPC endpoint from the specified Neon organization. If you delete a VPC endpoint from a Neon organization, that VPC endpoint cannot be added back to the Neon organization.; Organizations
Delete project: Deletes the specified project and all its endpoints, branches, databases, and users. Deleted projects can be recovered within 7 days using `POST /projects/{project_id}/recover`. To list recoverable projects, use `GET /projects?recoverable=true`.; Project
Delete branch: Deletes the specified branch from a project and places all compute endpoints into an idle state, breaking existing client connections. The deletion completes after all operations finish. You cannot delete a project's root or default branch, or a branch that has a child branch. A project must have at least one branch. By default, deleted branches can be recovered within a 7-day grace period. Use the `hard_delete` parameter to permanently delete the branch immediately. For related information, see [Manage branches](https://neon.com/docs/manage/branches/).; Branch
Delete a bucket on the branch: Deletes the named bucket from the specified branch. **Note**: This endpoint is currently in Beta.; Buckets
Delete an object in a bucket: Deletes the named object from the bucket on the specified branch. Served by the user's session (no customer S3 credentials required). **Note**: This endpoint is currently in Beta.; Buckets
Delete every object under a key prefix (folder) in a bucket: Soft-deletes every object on the specified branch whose key starts with `prefix`, in a single call. Intended to back a "delete folder" action in an object browser: a `prefix` of `app/avatars/` removes every object beneath that folder. Served by the user's session (no customer S3 credentials required). `prefix` must be non-empty, end with `/`, be at most 1024 bytes, and contain no control characters - a partial-segment prefix cannot accidentally delete sibling keys. Returns the number of objects soft-deleted (`deleted`), which may be 0 when no live object matched the prefix on this branch. Only objects physically present on this branch are tombstoned; objects inherited from an ancestor branch via copy-on-write (not materialized on this branch) are out of scope. **Note**: This endpoint is currently in Beta.; Buckets
Delete Neon Data API: Deletes the Neon Data API for the specified branch. Existing connections using the Data API endpoint will fail after deletion.; DataAPI
Delete database: Deletes the specified database from the branch. For related information, see [Manage databases](https://neon.com/docs/manage/databases/).; Branch
Delete a function on the branch: Deletes the function identified by its slug. **Note**: This endpoint is currently in Beta.; Functions
Delete role: Deletes the specified Postgres role from the branch. For related information, see [Manage roles](https://neon.com/docs/manage/roles/).; Branch
Delete compute endpoint: Deletes the specified compute endpoint. A compute endpoint is a Neon compute instance. Deleting a compute endpoint drops existing network connections to the compute endpoint. The deletion is completed when the last operation in the chain finishes successfully. An `endpoint_id` has an `ep-` prefix. For information about compute endpoints, see [Manage computes](https://neon.com/docs/manage/endpoints/).; Endpoint
Delete JWKS URL: Removes the specified JWKS URL from the project. JWTs signed by keys from the removed URL can no longer authenticate to the project's endpoints.; Project
Delete VPC endpoint restriction: Removes the specified VPC endpoint restriction from a Neon project.; Project
Delete snapshot: Deletes the specified snapshot.; Snapshot
Disable Neon Auth for the branch: Disables the Neon Auth integration for the specified branch, removing the connection to the authentication provider. If `delete_data` is `true`, also deletes the `neon_auth` schema and all associated tables from the branch database. The integration can be re-enabled by calling `POST /projects/{project_id}/branches/{branch_id}/auth`.; Auth
Finalize branch restore from snapshot: Finalize the restore operation for a branch created from a snapshot. This operation updates the branch so it functions as the original branch it replaced. This includes: - Reassigning any computes from the original branch to the restored branch (this will restart the computes) - Renaming the restored branch to the original branch's name - Renaming the original branch so it no longer uses the original name This operation only applies to branches created using the `restoreSnapshot` endpoint with `finalize_restore: false`.; Branch
List supported regions: Lists supported Neon regions. **Note:** Not all regions are available to all organizations. Pass the `org_id` parameter to get an accurate list of regions available to your organization.; Region
Retrieve anonymized branch status: Retrieves the current status of an anonymized branch, including its state and progress information. This endpoint allows you to monitor the anonymization process from initialization through completion. Only anonymized branches will have status information available. **Note**: This endpoint is currently in Beta.; Branch
Retrieve request authentication details: Returns authentication details for the credentials used in the request, including the credential type (API key, Bearer token, or OAuth session) and the associated identity.; Users
List available shared preload libraries: Returns the shared preload libraries available for the specified project's Postgres version. Shared preload libraries are Postgres extensions that require the `shared_preload_libraries` setting and a compute restart to activate. Use this list to determine which libraries can be enabled in the project's `settings.preload_libraries` configuration.; Project
Retrieve connection URI: Retrieves a connection URI for the specified database. The URI uses the standard PostgreSQL connection string format. Set `pooled=true` to include the `-pooler` suffix for a connection pooler URI.; Project
Retrieve branch consumption metrics: Returns consumption metrics for each branch across one or more projects listed in `project_ids` (1 to 100 projects). Available for accounts on paid usage-based Launch, Scale, Agent, and Enterprise plans. History starts when the account first ingests branch-level consumption data. The `metrics` query parameter is required. Only these six values are supported on this endpoint: `compute_unit_seconds`, `root_branch_bytes_month`, `child_branch_bytes_month`, `instant_restore_bytes_month`, `public_network_transfer_bytes`, `private_network_transfer_bytes`. This endpoint does not support `extra_branches_month` or `snapshot_storage_bytes_month`. Use `GET /consumption_history/v2/projects` for those. Consumption metrics within each branch are returned in ascending time order (oldest first). This request does not wake project computes.; Consumption
Retrieve project consumption metrics (legacy plans): Retrieves consumption metrics for Scale, Business, and Enterprise plan projects. History begins at the time of upgrade. Results are ordered by time in ascending order (oldest to newest). Issuing a call to this API does not wake a project's compute endpoint.; Consumption
Retrieve project consumption metrics: Returns consumption metrics for up to `limit` projects per page. If `project_ids` is omitted, projects in the organization are included across pages (use `cursor`). If `project_ids` is provided, the response is limited to those projects (up to 100). Available for accounts on Launch, Scale, Agent, Business, and Enterprise plans. History starts when the account upgrades to an eligible plan. The `metrics` query parameter is required. Supported values: `compute_unit_seconds`, `root_branch_bytes_month`, `child_branch_bytes_month`, `instant_restore_bytes_month`, `public_network_transfer_bytes`, `private_network_transfer_bytes`, `extra_branches_month`, `snapshot_storage_bytes_month`. Consumption metrics within each project are returned in ascending time order (oldest first). This request does not wake project computes.; Consumption
Retrieve current user details: Retrieves information about the currently authenticated Neon user, including account identifiers, plan details, and linked auth accounts.; Users
List organizations for the current user: Retrieves the organizations that the currently authenticated user belongs to. When called with an organization- or project-scoped API key (which is not tied to a user), this returns the single organization that owns the key.; UsersOrganizations
Retrieve masking rules: Retrieves the masking rules for the specified anonymized branch. Masking rules define how sensitive data should be anonymized using PostgreSQL Anonymizer. **Note**: This endpoint is currently in Beta.; Branch
Retrieve Neon Auth details for the branch: Retrieves the Neon Auth integration details for the specified branch, including the auth provider type and integration status.; Auth
Retrieve localhost allow setting: Retrieves the localhost allow setting for the specified branch's Neon Auth integration. When enabled, authentication flows work from `localhost` without adding it to the redirect URI whitelist.; Auth
Retrieve email and password configuration: Retrieves the email and password authentication configuration for the specified branch's Neon Auth integration, including whether it is enabled and the email verification method.; Auth
Retrieve email provider configuration: Retrieves the email provider configuration for the specified branch's Neon Auth integration, including the provider type and server settings.; Auth
Retrieve email server configuration: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/email_provider` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
Retrieve phone number plugin configuration: Returns the phone number plugin configuration for Neon Auth. The phone number plugin enables phone-based OTP authentication.; Auth
Retrieve Neon Auth plugin configurations: Returns all plugin configurations for Neon Auth in a single response. This endpoint aggregates organization, email provider, email and password, OAuth providers, and localhost settings.; Auth
Retrieve Neon Auth webhook configuration: Returns the webhook configuration for the specified branch's Neon Auth integration, including the endpoint URL and the events that trigger it.; Auth
Retrieve organization details: Retrieves details for the specified organization, including its name, plan, and configuration.; Organizations
List organization invitations: Retrieves pending and accepted invitations for the specified organization.; Organizations
Retrieve organization member details: Retrieves information about the specified organization member.; Organizations
List organization members: Retrieves a paginated list of members for the specified organization.; Organizations
Retrieve organization spending limit: Returns the configured monthly spending limit for the specified organization. `spending_limit_cents: null` indicates that no limit is currently set. Available to organization members with read access on Launch and Scale plans only.; Organizations
Retrieve VPC endpoint details: Retrieves the current state and configuration details of a specified VPC endpoint.; Organizations
Retrieve project details: Retrieves information about the specified project. Returned details include the project settings, compute configuration, history retention, owner information, and current usage metrics.; Project
Get advisor issues: Analyzes the database for security and performance issues. Returns a list of issues categorized by severity (ERROR, WARN, INFO). Requires read access to the project and Data API enabled.; Project
Retrieve branch details: Retrieves information about the specified branch. A `branch_id` value has a `br-` prefix. Each Neon project is initially created with a root and default branch named `main`. A project can contain one or more branches. A parent branch is identified by a `parent_id` value, which is the `id` of the parent branch. For related information, see [Manage branches](https://neon.com/docs/manage/branches/).; Branch
Get branch AI Gateway endpoint: Returns the AI Gateway endpoint host for the specified branch, used to render code-snippet base URLs. A 200 response means the branch is registered and this region serves the AI gateway. A 404 response includes a `reason` field indicating why the gateway is unavailable. **Note**: This endpoint is currently in Beta.; AI Gateway
Download an object's bytes: Streams the raw bytes of the named object from the bucket on the specified branch, including objects inherited from ancestor branches. Served by the user's session (no customer S3 credentials required). The body is returned as `application/octet-stream` so a browser treats it as a download; the `Content-Length` and `ETag` response headers echo the stored object metadata. BINARY-STREAM EXCEPTION TO THE BUILD-GENERATED-TYPES RULE (#7029): the successful 200 body is the raw object stream, proxied verbatim from the platform object storage admin endpoint. It is modeled as an `application/octet-stream` binary body (not a JSON response schema) and is streamed without buffering the whole object in memory. Error responses still use the generated `GeneralError` shape. **Note**: This endpoint is currently in Beta.; Buckets
Retrieve Neon Data API configuration: Retrieves the Neon Data API configuration for the specified branch, including endpoint URL, enabled state, and database settings.; DataAPI
Retrieve database details: Retrieves information about the specified database. For related information, see [Manage databases](https://neon.com/docs/manage/databases/).; Branch
Get function details: Returns the function identified by its slug. **Note**: This endpoint is currently in Beta.; Functions
Retrieve role details: Retrieves details about the specified role. In Neon, the terms "role" and "user" are synonymous. For related information, see [Manage roles](https://neon.com/docs/manage/roles/).; Branch
Retrieve role password: Retrieves the password for the specified Postgres role, if possible. For related information, see [Manage roles](https://neon.com/docs/manage/roles/).; Branch
Retrieve database schema: Retrieves the database schema. Specify `lsn` or `timestamp` (not both) to read at a point in time; omit both to read from the database's head.; Branch
Compare database schema: Compares the schema from the specified database with another branch's schema.; Branch
Get branch object storage state: Returns whether branchable object storage is usable for the specified branch. A 200 response means the branch is registered in the object storage service and the S3 data plane will accept requests for it. A 404 response includes a `reason` field indicating why object storage is unavailable. **Note**: This endpoint is currently in Beta.; Storage
Retrieve compute endpoint details: Retrieves information about the specified compute endpoint. A compute endpoint is a Neon compute instance. An `endpoint_id` has an `ep-` prefix. For information about compute endpoints, see [Manage computes](https://neon.com/docs/manage/endpoints/).; Endpoint
List JWKS URLs: Returns the JWKS URLs available for verifying JWTs used as the authentication mechanism for the specified project.; Project
Retrieve operation details: Retrieves details for the specified operation. An operation is an action performed on a Neon project resource.; Operation
Retrieve backup schedule: Returns the backup schedule for the specified branch, including the configured snapshot frequencies.; Snapshot
Grant project access: Grants project access to the account associated with the specified email address.; Project
List API keys: Retrieves the API keys for your Neon account. The response does not include API key tokens. A token is only provided when creating an API key. API keys can also be managed in the Neon Console. For more information, see [Manage API keys](https://neon.com/docs/manage/api-keys/).; API Key
List OAuth providers for the branch: Lists the OAuth providers configured for the specified branch's Neon Auth integration.; Auth
List domains in redirect_uri whitelist: Lists the trusted domains in the redirect URI whitelist for the specified branch. Only domains in this list are permitted as redirect targets after authentication.; Auth
List credentials on the branch: Returns metadata for customer-issued credentials on the branch. Secrets are never included. **Note**: This endpoint is currently in Beta.; Credentials
List active integrations with auth providers: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
List OAuth providers: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/oauth_providers` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
List trusted redirect URI domains: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/domains` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
List organization API keys: Retrieves the API keys for the specified organization. The response does not include API key tokens. A token is only provided when creating an API key. API keys can also be managed in the Neon Console. For more information, see [Manage API keys](https://neon.com/docs/manage/api-keys/).; Organizations
List VPC endpoints: Retrieves the list of VPC endpoints for the specified Neon organization.; Organizations
List VPC endpoints across all regions: Retrieves the list of VPC endpoints for the specified Neon organization across all regions.; Organizations
List objects in a bucket: Lists objects visible in the named bucket on the specified branch, including those inherited from ancestor branches. Listing is served by the user's session (no customer S3 credentials required). When `delimiter` is supplied (typically `/`), keys are collapsed into common prefixes (`folders`) so callers can render a folder-style browser; keys that do not contain the delimiter after `prefix` are returned as `objects`. **Note**: This endpoint is currently in Beta.; Buckets
List buckets on the branch: Lists branchable object storage buckets visible on the specified branch, including those inherited from ancestor branches. **Note**: This endpoint is currently in Beta.; Buckets
List databases: Retrieves a list of databases for the specified branch. A branch can have multiple databases. For related information, see [Manage databases](https://neon.com/docs/manage/databases/).; Branch
List branch endpoints: Retrieves a list of compute endpoints for the specified branch. Neon permits only one read-write compute endpoint per branch. A branch can have multiple read-only compute endpoints.; Branch
List functions on the branch: Lists functions on the specified branch. **Note**: This endpoint is currently in Beta.; Functions
List branch log field values: Lists the distinct values observed for a low-cardinality log field in the requested time range. Call the log fields endpoint first to learn which `field_name` values this branch supports; a field that branch has never emitted is rejected with `unknown_field`. Give the window either as `since` or as an explicit `start_time`; supplying both is rejected. If neither is given, the previous six hours are used. The maximum supported time range is seven days. **Note**: This endpoint is currently in Private Beta.; Logs
List branch log fields: Lists the low-cardinality log fields observed on this branch whose distinct values can be discovered with the log field-values endpoint. The set is computed per branch and grows as new fields are observed, so treat it as data rather than a fixed list: discover a field here, then pass it as `field_name` to the field-values endpoint. **Note**: This endpoint is currently in Private Beta.; Logs
List roles: Retrieves a list of Postgres roles from the specified branch. For related information, see [Manage roles](https://neon.com/docs/manage/roles/).; Branch
List branches: Retrieves a list of branches for the specified project. Each Neon project has a root branch named `main`. A `branch_id` value has a `br-` prefix. A project may contain child branches that were branched from `main` or from another branch. A parent branch is identified by the `parent_id` value, which is the `id` of the parent branch. For related information, see [Manage branches](https://neon.com/docs/manage/branches/).; Branch
List compute endpoints: Retrieves a list of compute endpoints for the specified project. A compute endpoint is a Neon compute instance. For information about compute endpoints, see [Manage computes](https://neon.com/docs/manage/endpoints/).; Endpoint
List org members and their project roles: Lists organization members and their per-project roles for an org-owned project. Returns 404 when the project is not org-owned, per-project role management is disabled, or the caller has no access. Callers with VIEWER or EDITOR see members with effective project access. Callers with ADMIN also see unassigned org members.; Project
List operations: Retrieves a list of operations for the specified Neon project. The number of operations returned can be large. To paginate the response, issue an initial request with a `limit` value. Then, add the `cursor` value that was returned in the response to the next request. Operations older than 6 months may be deleted from our systems. If you need more history than that, you should store your own history.; Operation
List project access: Retrieves details about users who have access to the project, including the permission `id`, the granted-to email address, and the date project access was granted.; Project
List VPC endpoint restrictions: Lists VPC endpoint restrictions for the specified Neon project.; Project
List projects: Retrieves a list of projects for the specified organization. If using a personal API key, include the `org_id` parameter to specify which organization to work with. If using an org API key, `org_id` is automatically inferred from the key. For more information, see [Manage organizations using the Neon API](https://neon.com/docs/manage/orgs-api) and [Manage projects](https://neon.com/docs/manage/projects/).; Project
List shared projects: Retrieves a list of projects shared with your Neon account. For more information, see [Manage projects](https://neon.com/docs/manage/projects/).; Project
List project snapshots: Lists the snapshots for the specified project. Each snapshot represents a point-in-time backup of the project data.; Snapshot
Presign an upload or download for an object in a bucket: Returns a presigned URL that transfers bytes directly to or from the object's bucket on the specified branch, without the caller ever handling S3 credentials. The `operation` field selects the direction: - `upload` returns a presigned `PUT` URL (the caller `PUT`s the file bytes straight to `url` with the returned `headers`). Authorized with project write access. - `download` returns a presigned `GET` URL (the caller `GET`s the bytes straight from `url`). Authorized with project read access. The platform mints a short-lived credential and builds the SigV4-signed URL against the branch's S3 data-plane host, returning it together with the HTTP method, any headers the caller must echo, and the URL's expiry. Served by the user's session (no customer S3 credentials required). **Note**: This endpoint is currently in Beta.; Buckets
Query branch logs: Returns logs emitted by services running on the specified branch, ordered by timestamp according to `sort_order`. All supplied filters are combined with `AND`: a record is returned only when it matches every filter. `minimum_severity` and `severity_text` are independent filters, so setting both requires a record to clear the severity floor *and* match the exact severity text. Supply `logql` instead of the structured filters to run a raw LogQL expression. Combining it with any structured filter is rejected rather than silently ignored; `limit`, `sort_order`, and the time window still apply, because those bound the query rather than form part of the expression. Give the window either as `since` — a duration ending at `end_time`, or at the current time when `end_time` is omitted — or as an explicit `start_time`. Supplying both is rejected. A single response holds at most 1,000 records. When `is_truncated` is `true`, pass the returned `next_cursor` back as `cursor` to fetch the next page, repeating the time range and every filter unchanged. If no time range is supplied, the query covers the previous hour. The maximum supported time range is seven days. `end_time` is exclusive. **Note**: This endpoint is currently in Private Beta.; Logs
Recover a deleted project: Recovers a deleted project within the 7-day deletion recovery period. Restores branches, endpoints, settings, and connection strings. Some integrations require manual reconfiguration after recovery. To list recoverable projects, use `GET /projects?recoverable=true`.; Project
Remove organization member: Removes the specified member from the organization. Only organization admins can perform this action. The last admin in an organization cannot be removed.; Organizations
Remove an org member's role on a project: Idempotently removes the explicit project grant. The member's organization-role default project permission still applies. Self-DELETE requires `confirm_self_lockout=true` when effective manage access would be lost.; Project
Reset role password: Resets the password for the specified Postgres role. Returns a new password and operations. The new password is ready to use when the last operation finishes. The old password remains valid until last operation finishes. Connections to the compute endpoint are dropped. If idle, the compute endpoint becomes active for a short period of time. For related information, see [Manage roles](https://neon.com/docs/manage/roles/).; Branch
Restart compute endpoint: Restarts the specified compute endpoint by immediately suspending it and then starting it again. An `endpoint_id` has an `ep-` prefix. For information about compute endpoints, see [Manage computes](https://neon.com/docs/manage/endpoints/).; Endpoint
Restore branch to a historical state: Restores a branch to an earlier state in its own or another branch's history by specifying an LSN or timestamp. Creates a new branch from the historical state.; Branch
Restore snapshot: Restores the specified snapshot to a new branch, and optionally finalizes the restore operation to replace the original branch.; Snapshot
Revoke API key: Revokes the specified API key. An API key that is no longer needed can be revoked. This action cannot be reversed. API keys can also be managed in the Neon Console. See [Manage API keys](https://neon.com/docs/manage/api-keys/).; API Key
Revoke a credential: Soft-deletes the credential. Idempotent. **Note**: This endpoint is currently in Beta.; Credentials
Revoke organization API key: Revokes the specified organization API key. An API key that is no longer needed can be revoked. This action cannot be reversed. API keys can also be managed in the Neon Console. See [Manage API keys](https://neon.com/docs/manage/api-keys/).; Organizations
Revoke project access: Revokes project access from the user associated with the specified permission `id`. You can retrieve a user's permission `id` by listing project access.; Project
Send test email: Sends a test email using the configured email server settings to verify SMTP connectivity and credentials. The request body must include the SMTP server settings (`host`, `port`, `username`, `password`, `sender_email`, `sender_name`) and the `recipient_email` address.; Auth
Set branch as default: Sets the specified branch as the project's default branch. The default designation is automatically removed from the previous default branch. For more information, see [Manage branches](https://neon.com/docs/manage/branches/).; Branch
Set organization spending limit: Sets the monthly spending limit for the specified organization. To remove a previously configured limit, send a DELETE request to this endpoint. When a limit is configured, email notifications are sent at 80% and 100% of the limit. Computes are not suspended when the limit is reached. Available to organization admins on Launch and Scale plans only.; Organizations
Set an org member's role on a project: Idempotently sets or updates the explicit project grant of the specified org member. Self-demotion requires `confirm_self_demotion=true`.; Project
Update backup schedule: Updates the backup schedule for the specified branch. The schedule defines how often automatic snapshots are created (for example, `daily` or `weekly`). Requires a paid plan.; Snapshot
Start anonymization: Starts the anonymization process for an anonymized branch that is in the initialized, error, or anonymized state. This will apply all defined masking rules to anonymize sensitive data in the branch databases. The branch must be an anonymized branch to start anonymization. **Note**: This endpoint is currently in Beta.; Branch
Start compute endpoint: Starts a compute endpoint. The compute endpoint is ready to use after the last operation in the chain finishes successfully. An `endpoint_id` has an `ep-` prefix. For information about compute endpoints, see [Manage computes](https://neon.com/docs/manage/endpoints/).; Endpoint
Suspend compute endpoint: Suspends the specified compute endpoint. An `endpoint_id` has an `ep-` prefix. For information about compute endpoints, see [Manage computes](https://neon.com/docs/manage/endpoints/).; Endpoint
Transfer Neon-managed auth project to your own account: Transfers ownership of your Neon-managed auth project to your own auth provider account.; Auth (legacy)
Transfer projects between organizations: Transfers selected projects, identified by their IDs, from your organization to another specified organization.; Organizations
Transfer projects from personal account to organization: Deprecated. Personal accounts have been migrated to organizations, so this operation no longer applies. Removal scheduled for July 1, 2026.; Users
Update OAuth provider: Updates an OAuth provider for the specified project.; Auth
Update masking rules: Updates the masking rules for the specified anonymized branch. Masking rules define how sensitive data should be anonymized using PostgreSQL Anonymizer. **Note**: This endpoint is currently in Beta.; Branch
Update localhost allow setting: Updates the localhost allow setting for the specified branch's Neon Auth integration. When enabled, authentication flows work from `localhost` without adding it to the redirect URI whitelist.; Auth
Update auth configuration: Updates the auth configuration for the branch. Currently supports updating the application name used in auth emails.; Auth
Update email and password configuration: Updates the email and password authentication configuration for the specified branch's Neon Auth integration. Only the fields provided in the request body are updated.; Auth
Update email provider configuration: Updates the email provider configuration for the specified branch's Neon Auth integration. The email provider handles transactional messages such as verification emails and password reset links.; Auth
Update email server configuration: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/email_provider` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
Update magic link plugin configuration: Updates the magic link plugin configuration for Neon Auth. The magic link plugin enables passwordless authentication via email magic links.; Auth
Update OAuth provider: Deprecated. Use `/projects/{project_id}/branches/{branch_id}/auth/oauth_providers/{oauth_provider_id}` instead. Removal scheduled for March 1, 2026.; Auth (legacy)
Update organization plugin configuration: Updates the organization plugin configuration for Neon Auth. The organization plugin enables multi-tenant organization support.; Auth
Update phone number plugin configuration: Updates the phone number plugin configuration for Neon Auth. Only the fields provided in the request body are updated; omitted fields retain their current values. The phone number plugin enables phone-based OTP authentication. OTP codes are delivered via the `send.otp` webhook event with `delivery_preference: "sms"`. A webhook must be configured with the `send.otp` event enabled for SMS delivery to work.; Auth
Update auth user role: Updates the role of a user in the Neon Auth user directory for the specified branch. The role controls the user's level of access within the Neon Auth integration.; Auth
Update Neon Auth webhook configuration: Updates the webhook configuration for the specified branch's Neon Auth integration. Webhooks notify an external endpoint when auth events occur, such as user creation or sign-in.; Auth
Update role for organization member: Updates the role of an existing member in the specified organization. The requested role must be valid for the organization. Only organization admins can call this endpoint.; Organizations
Update project: Updates the specified project. Configurable properties include the project name, default compute settings, history retention period, and IP allowlist.; Project
Update branch: Updates the specified branch. For more information, see [Manage branches](https://neon.com/docs/manage/branches/).; Branch
Update Neon Data API: Updates the Neon Data API configuration for the specified branch. You can optionally provide settings to update the Data API configuration. The schema cache is always refreshed as part of this operation.; DataAPI
Update database: Updates the specified database in the branch. For related information, see [Manage databases](https://neon.com/docs/manage/databases/).; Branch
Update a function: Updates the function's mutable metadata — currently only the display `name`. A string sets the display name; `null` clears it, after which the function's `name` falls back to its slug. Leading and trailing whitespace is trimmed; a whitespace-only name is rejected. Acts only on a function owned by the branch: a slug that is only inherited from an ancestor branch returns 404 — rename it on the branch that owns it. Like every other change on a branch, a rename is isolated per branch: a branch forked before the rename keeps the name it had at fork time. **Note**: This endpoint is currently in Beta.; Functions
Update compute endpoint: Updates the specified compute endpoint. An `endpoint_id` has an `ep-` prefix. A `branch_id` has a `br-` prefix. For more information about compute endpoints, see [Manage computes](https://neon.com/docs/manage/endpoints/). If the returned list of operations is not empty, the compute endpoint is not ready to use. The client must wait for the last operation to finish before using the compute endpoint. If the compute endpoint was idle before the update, it becomes active for a short period of time, and the control plane suspends it again after the update.; Endpoint
Update snapshot: Updates the specified snapshot.; Snapshot

FAQ

Neon integration, answered

How do AI agents use Neon through Open Connector?: Your user connects Neon once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Neon tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
Is this a Neon MCP server?: Yes. Open Connector can serve Neon as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Neon actions with credentials injected server-side.
Where do Neon credentials live?: In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Give your agents Neon — keep the keys.

Open source, self-hostable, with Neon credentials that never leave your infrastructure. Run it from source today.

View source on GitHub How the MCP gateway works →