Lagaam

io.github.lagaam-ai/lagaam

Stops an agent's Trino or Pinot query before it runs if it costs too much or reads outside its grant

Connect this server

Add this to your MCP client config — claude_desktop_config.json (Claude Desktop) or .cursor/mcp.json (Cursor).Suits: Claude Desktop · Cursor.

{
  "mcpServers": {
    "lagaam": {
      "command": "uvx",
      "args": [
        "lagaam"
      ],
      "env": {
        "LAGAAM_ALLOWED_TABLES": "<your LAGAAM_ALLOWED_TABLES>",
        "LAGAAM_ENGINE": "trino",
        "TRINO_HOST": "localhost",
        "TRINO_PORT": "8080",
        "TRINO_USER": "lagaam",
        "TRINO_PASSWORD": "<your TRINO_PASSWORD>",
        "TRINO_JWT": "<your TRINO_JWT>",
        "TRINO_VERIFY": "true",
        "PINOT_CONTROLLER_URL": "http://localhost:9000",
        "PINOT_BROKER_URL": "http://localhost:8000",
        "PINOT_PASSWORD": "<your PINOT_PASSWORD>",
        "LAGAAM_AGENT_NAME": "anonymous",
        "LAGAAM_MAX_SCAN_BYTES": "53687091200",
        "LAGAAM_MAX_INTERMEDIATE_ROWS": "50000000",
        "LAGAAM_MAX_RETURNED_ROWS": "1000",
        "LAGAAM_QUERY_TIMEOUT": "300",
        "LAGAAM_METADATA_TTL": "300"
      }
    }
  }
}
Environment variables
  • LAGAAM_ALLOWED_TABLESrequiredComma list of catalog.schema.table grants; the server will not start without it
  • LAGAAM_ENGINEWhich adapter to run
  • TRINO_HOSTTrino coordinator host
  • TRINO_PORTTrino coordinator port
  • TRINO_USERTrino user
  • TRINO_PASSWORDsecretPassword for TRINO_USER; unset means no login. Not with TRINO_JWT
  • TRINO_JWTsecretJWT to log in with instead of a password; unset means no login
  • TRINO_VERIFYTLS cert check: true, false, or the path of a CA bundle (PEM)
  • PINOT_CONTROLLER_URLPinot controller URL
  • PINOT_BROKER_URLPinot broker URL
  • PINOT_PASSWORDsecretPinot password; unset means no auth
  • LAGAAM_AGENT_NAMEIdentity stamped on the audit trail
  • LAGAAM_MAX_SCAN_BYTESScan-bytes budget per query, checked before it runs (default 50 GiB)
  • LAGAAM_MAX_INTERMEDIATE_ROWSRows the engine would build at its widest step, not rows returned, so a LIMIT doesn't lower it
  • LAGAAM_MAX_RETURNED_ROWSRows returned to the agent per query, capped at 100000; a bigger LIMIT in the query is lowered to it
  • LAGAAM_QUERY_TIMEOUTWall-clock seconds per query
  • LAGAAM_METADATA_TTLMetadata cache TTL, seconds

A starting point — check the repository for exact arguments and setup. Restart your client after editing the config.

Category
Developer Tools
Version
1.0.0
Registry
active
Published
11/6/2026
Browse all Developer Tools →

Add the badge to your site

Show visitors that Lagaam is listed here — it’s also the link we check for a free listing.

Lagaam — listed on Serverdex

HTML — for your website

<a href="https://serverdex.io/server/io-github-lagaam-ai-lagaam?utm_source=badge"><img src="https://serverdex.io/brand/badge.svg" alt="Lagaam — listed on Serverdex" width="123" height="40" loading="lazy"></a>

Recommended. A dofollow link from your own domain is the one that counts for search engines, and it's the link we check for a free listing.

Markdown — for your README

[![Lagaam — listed on Serverdex](https://serverdex.io/brand/badge.svg)](https://serverdex.io/server/io-github-lagaam-ai-lagaam?utm_source=badge)

Nice for visibility, but GitHub marks README links nofollow, so it doesn't pass authority. Use the HTML badge on your site as well.