An MCP server for Postgres can be read-only and still hurt production.
Exploratory joins, wide aggregates, synchronized schedules, and concurrent retries consume the same connections, CPU, memory, I/O, and replica capacity as the application.
Read-only describes mutation authority.
It does not describe workload safety.
Treat AI database traffic as a separate workload class:
The pool is an admission controller, not just a connection reuse optimization.
And a replica is not free capacity. Lag, long snapshots, replay conflicts, and I/O still need an operational budget.
The safe overload response is visible and bounded. It is not silently widening the pool, switching to the primary, or retrying until the user gets an answer.
Full guide: MCP server for Postgres: isolate AI workloads from OLTP traffic