Home › Databases & Data › Lagaam

Lagaam

Stops an agent's Trino or Pinot query before it runs if it costs too much or reads outside its grant

Python Local

★ 1 stars Last pushed 2026-10-09 License: Apache-2.0

View repository → Website →

Connect

Review any command before running it. Package names and URLs come from the server's own registry entry.

Package (pypi 0.2.5)

uvx lagaam

Or add to your MCP client config:

{
  "mcpServers": {
    "lagaam": {
      "command": "uvx",
      "args": [
        "lagaam"
      ],
      "env": {
        "LAGAAM_ALLOWED_TABLES": "<YOUR_VALUE>",
        "LAGAAM_ALLOW_ALL_TABLES": "<YOUR_VALUE>",
        "LAGAAM_ENGINE": "<YOUR_VALUE>",
        "TRINO_HOST": "<YOUR_VALUE>",
        "TRINO_PORT": "<YOUR_VALUE>",
        "TRINO_USER": "<YOUR_VALUE>",
        "PINOT_CONTROLLER_URL": "<YOUR_VALUE>",
        "PINOT_BROKER_URL": "<YOUR_VALUE>",
        "PINOT_USER": "<YOUR_VALUE>",
        "PINOT_PASSWORD": "<YOUR_VALUE>",
        "LAGAAM_AGENT_NAME": "<YOUR_VALUE>",
        "LAGAAM_MAX_SCAN_BYTES": "<YOUR_VALUE>",
        "LAGAAM_MAX_ROWS": "<YOUR_VALUE>",
        "LAGAAM_MAX_INTERMEDIATE_ROWS": "<YOUR_VALUE>",
        "LAGAAM_MAX_RETURNED_ROWS": "<YOUR_VALUE>",
        "LAGAAM_QUERY_TIMEOUT": "<YOUR_VALUE>",
        "LAGAAM_METADATA_TTL": "<YOUR_VALUE>",
        "LAGAAM_AUDIT_LOG": "<YOUR_VALUE>"
      }
    }
  }
}

LAGAAM_ALLOWED_TABLES required — Comma list of catalog.schema.table grants; the server will not start without it
LAGAAM_ALLOW_ALL_TABLES — true to run with no grant at all: an explicit opt-out, off by default
LAGAAM_ENGINE — Which adapter to run
TRINO_HOST — Trino coordinator host
TRINO_PORT — Trino coordinator port
TRINO_USER — Trino user
PINOT_CONTROLLER_URL — Pinot controller URL
PINOT_BROKER_URL — Pinot broker URL
PINOT_USER — Pinot user; unset means no auth
PINOT_PASSWORD secret — Pinot password; unset means no auth
LAGAAM_AGENT_NAME — Identity stamped on the audit trail
LAGAAM_MAX_SCAN_BYTES — Scan-bytes budget per query, checked before it runs (default 50 GiB)
LAGAAM_MAX_ROWS — Scanned-row estimate budget per query; unset means ungated
LAGAAM_MAX_INTERMEDIATE_ROWS — Rows the engine would build at its widest step, not rows returned, so a LIMIT doesn't lower it
LAGAAM_MAX_RETURNED_ROWS — Rows returned to the agent per query, capped at 100000; a bigger LIMIT in the query is lowered to it
LAGAAM_QUERY_TIMEOUT — Wall-clock seconds per query
LAGAAM_METADATA_TTL — Metadata cache TTL, seconds
LAGAAM_AUDIT_LOG — Audit JSONL file path; unset means stderr