prest

pRESTd

pREST (PostgreSQL REST) is a production-ready API that delivers instant REST and Model Context Protocol (MCP) APIs on top of your existing or new Postgres database—CRUD, custom SQL routes, auth, ACL, and a read-only MCP endpoint—without hand-writing a backend.

PostgreSQL version 9.5 or higher

Contributor License Agreement —

Documentation

Full documentation lives at docs.prestd.com.

Topic	Link
Get pREST (Docker, Homebrew, Go)	Get pREST
Configuration	Configuring pREST
API reference	API Reference
MCP over HTTP	MCP over HTTP
Multi-database	Multi-database
Databases & roadmap	Databases · Roadmap
AI clients (Cursor, Claude, …)	AI and MCP

Quick start

Install and run options (Docker, Homebrew, or Go) are documented in Get pREST. Point pREST at Postgres (PREST_PG_URL or pg.* / DATABASE_URL), then call:

GET /{database}/{schema}/{table}

See Configuring pREST for auth, ACL, custom queries, and MCP.

Passing values to query scripts

Values a _QUERIES script template interpolates become part of the SQL text, so pREST screens them: anything carrying quotes, --, ::, or — for multi-word values — a SQL keyword is refused, and a refused value that is interpolated fails the request with 400.

Bind free-form values instead, and the screen does not apply at all. A bound value travels to Postgres out of band, where it can never be parsed as SQL:

-- interpolated: screened, and rejected for values like 'compra do mes'
SELECT * FROM articles WHERE slug = '{{.slug}}'

-- bound: the caller's value arrives verbatim, whatever it contains
SELECT * FROM articles WHERE slug = {{sqlVal "slug"}}

Helper	Use for	Renders
{{sqlVal "key"}}	a single value	$1
{{sqlList "key"}}	a repeated query parameter (?tag=a&tag=b)	($1,$2)
{{ident "key"}}	a table/column name, which cannot be bound	"public"."users"

sqlVal and sqlList also reach headers as {{sqlVal "header.X-Application"}}. Credential headers (Authorization, Cookie, …) are always withheld.

Prefer binding for anything user-supplied — search phrases especially, since a phrase containing a common word such as do, as or or is exactly what the interpolation screen refuses.

1-Click Deploy

Heroku

Deploy to Heroku and get a realtime RESTful API backed by Heroku Postgres:

More: Deploy in Heroku.

Contributing

Contributions are welcome. See the Development Guide and Contributing to pREST. Please sign the CLA.

Questions? GitHub Discussions or Discord.

Testing

Run unit tests locally:

make test-unit

Run integration suites inside Docker (no local Postgres required):

# Postgres (full stack: default, auth, multicluster, queries) — also: make test-integration
make test-integration-postgres

# TimescaleDB (Timescale-specific E2E only)
make test-integration-timescaledb

Or with Docker Compose:

docker compose -f integration/postgres/docker-compose.yml up -d --wait \
  postgres postgres-b db-init prestd prestd-multicluster prestd-auth prestd-queries
docker compose -f integration/postgres/docker-compose.yml run --rm --no-deps tests
docker compose -f integration/postgres/docker-compose.yml down -v --remove-orphans

Postgres compose runs ./integration/suites/... and ./integration/postgres/.... TimescaleDB compose runs ./integration/timescaledb/... only (see .github/workflows/test-integration-timescaledb.yml). Network tests require PREST_TEST_URL (and flavor-specific URLs for the Postgres job); outside Compose those tests skip when the URLs are unset.

Example: Docker Build

Build the Docker image locally for development (compiles from source):

docker build -t prest/prest:latest .

For release builds, GoReleaser uses the same Dockerfile / Dockerfile.noplugins with a pre-built prestd binary. Local source builds can pass version metadata via build arguments:

docker build \
  --build-arg VERSION=v1.0.0 \
  --build-arg COMMIT=hash \
  --build-arg DATE=2026-02-11 \
  -t prest/prest:latest .