Cost Guard MCP server

by mcpsmiths·io.github.mcpsmiths/cost-guard-mcp·v0.6.0·1 stars

No reviews yet

Pre-flight query cost and result-size guardrails for AI agents on BigQuery, Snowflake, Databricks

B82/100grade B

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

B82/100

not scanned yet

Adoption

New

1 stars

Reviews

Write one

Nobody has reviewed Cost Guard MCP yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Cost Guard MCP tools

No tool declarations could be read from the package source. They show once the server is installed.

Not scanned yet. New listings are scanned within a day or two of arriving.

How Cost Guard MCP compares

Against every graded Databases MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 82/100; higher than 55% of 802 Databases servers
GitHub stars: 1; more than 45% of 602 Databases servers

Release history: 6 versions in the registry since 2026-09-14, latest 2026-10-19, typically one every 4 days.

Install Cost Guard MCP in Claude Code, Cursor or VS Code

claude mcp add cost-guard-mcp -- uvx cost-guard-mcp

Add to Cursor

What the publisher says

From the Cost Guard MCP repository's README, as published. We do not edit it. Read it on GitHub

cost-guard-mcp

Pre-flight query cost & result-size guardrails for AI agents, across BigQuery, Snowflake, and Databricks — before the query ever runs.

Why

An AI agent using a warehouse MCP can silently trigger a full-table scan that costs hundreds of dollars, or return millions of rows that flood its own context window. No existing warehouse MCP tells the agent "how much will this cost" or "how much data will this return" before running the query.

What makes this different

Every cost estimate discloses its accuracy tier — PRECISE (BigQuery dryRun), UPPER_BOUND (Snowflake EXPLAIN), or HEURISTIC (Databricks EXPLAIN COST) — so your agent never over-trusts a heuristic number.
Per-call bounds — runquerybounded takes maxbytesbilled / maxrows / maxestimatedcostusd on each call; no shared session state required.
Zero infrastructure — a single local stdio process. No database, no gateway, no Docker Compose.

Tools

check_credentials(engine, warehouse?) — verifies credentials/connectivity without running any real query; call this first after configuring a new engine. Supports BigQuery, Snowflake, and Databricks.
describeenginecapabilities(engine) — what's exact vs. approximate for this engine.
estimatequerycost(engine, sql, warehouse?, warehousesize?, edition?) — pre-flight cost estimate, tagged with its accuracy tier. Supports BigQuery, Snowflake, and Databricks. warehousesize (Snowflake/Databricks) and edition (Snowflake) default to the smallest/standard tier if omitted — set them to match the warehouse you actually run on, or the dollar figure understates cost on a larger one.
runquerybounded(engine, sql, maxbytesbilled?, maxrows?, maxestimatedcostusd?, warehouse?, warehouse_size?, edition?) — refuses to run if the estimate exceeds your bound. Supports BigQuery, Snowflake, and Databricks.

Setup

BigQuery

Set GOOGLEAPPLICATIONCREDENTIALS to a service-account key file path (or run gcloud auth application-default login).

Snowflake

Set SNOWFLAKEACCOUNT, SNOWFLAKEUSER, SNOWFLAKEROLE (required — no default, never ACCOUNTADMIN), and either SNOWFLAKEPRIVATEKEYPATH (preferred) or SNOWFLAKE_PASSWORD (discouraged).

Databricks

Set DATABRICKSSERVERHOSTNAME and DATABRICKSHTTPPATH (from the SQL warehouse's Connection Details tab), and either DATABRICKSTOKEN (a personal access token, simplest) or DATABRICKSCLIENTID + DATABRICKSCLIENT_SECRET (OAuth machine-to-machine via a service principal, preferred for automated use). Only Serverless SQL warehouses are priced accurately — see Known Limitations.

A note on credentials with MCP hosts

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

2026-09-19downgradeA → Bscore 82

Cost Guard MCP: common questions

Is Cost Guard MCP server safe?: Mostly: it is graded B (82/100). Read the Cost Guard MCP safety report
How do I install Cost Guard MCP?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Cost Guard MCP need an API key?: Yes. The registry entry asks for GOOGLE_APPLICATION_CREDENTIALS, SNOWFLAKE_PRIVATE_KEY_PATH, SNOWFLAKE_PRIVATE_KEY_PASSPHRASE, SNOWFLAKE_PASSWORD and 2 more.
Is Cost Guard MCP maintained?: The last commit was 37 days ago (2026-09-28). The latest release is v0.6.0.
What can I use instead of Cost Guard MCP?: Servers from other publishers that do the same job: Faucet MCP server and OSS Snowflake MCP Server.
How does Cost Guard MCP compare with other Databases MCP servers?: safety score 82/100 (higher than 55% of 802 Databases servers); github stars 1 (more than 45% of 602 Databases servers). Full comparison.

Alternatives to Cost Guard MCP

Same job from other publishers: the closest match first, then the best rated.

Faucet
SQL database to MCP tools and REST API: PostgreSQL, MySQL, SQL Server, Oracle, SQLite, Snowflake.
not reviewed
Established
A
OSS Snowflake MCP Server
MCP Server for Snowflake from Snowflake Labs
not reviewed
Established
B

Run it through the gateway

Local package. It runs on your machine, not through the gateway.

Rating: —
Safety grade: B · 82/100
Stars: 1
Downloads/wk: –
Price: Free
Licence: MIT
Transport: Local · pypi
Version: 0.6.0
Category: Databases
Last release: 2026-09-28

Credentials it needs

GOOGLE_APPLICATION_CREDENTIALSsecretBigQuery: path to a service-account key file (Application Default Credentials). Required to use the bigquery engine.
SNOWFLAKE_ACCOUNTSnowflake: account identifier. Required to use the snowflake engine.
SNOWFLAKE_USERSnowflake: username. Required to use the snowflake engine.
SNOWFLAKE_ROLESnowflake: role to assume. Required to use the snowflake engine; has no default and must never be ACCOUNTADMIN (ACCOUNTADMIN, SECURITYADMIN and ORGADMIN are rejected before any Snowflake connection is opened - the check runs when the Snowflake configuration is first loaded, on the first Snowflake tool call; the server process itself starts regardless, so a bad role surfaces as a failed check_credentials or a tool error, not as a startup exit).
SNOWFLAKE_SECONDARY_ROLESSnowflake: secondary roles activated at login. NONE (default) means only SNOWFLAKE_ROLE is active in the session; ALL is the explicit opt-out that activates every role granted to SNOWFLAKE_USER.
SNOWFLAKE_PRIVATE_KEY_PATHsecretSnowflake: path to an RSA private key file for key-pair auth (preferred over SNOWFLAKE_PASSWORD). Either this or SNOWFLAKE_PASSWORD is required to use the snowflake engine.
SNOWFLAKE_PRIVATE_KEY_PASSPHRASEsecretSnowflake: passphrase for an encrypted SNOWFLAKE_PRIVATE_KEY_PATH key file, if the key is encrypted.
SNOWFLAKE_PASSWORDsecretSnowflake: password (discouraged; prefer SNOWFLAKE_PRIVATE_KEY_PATH). Either this or SNOWFLAKE_PRIVATE_KEY_PATH is required to use the snowflake engine.
SNOWFLAKE_EDITIONSnowflake: account edition that sets the USD/credit price of estimates - standard (default), enterprise, business_critical or vps. The per-call edition argument can only raise it.
DATABRICKS_SERVER_HOSTNAMEDatabricks: SQL warehouse server hostname (e.g. my-workspace.cloud.databricks.com, no scheme, no trailing slash). Required to use the databricks engine.
DATABRICKS_HTTP_PATHDatabricks: SQL warehouse HTTP path (from the warehouse's Connection Details tab, e.g. /sql/1.0/warehouses/<warehouse-id>). Required to use the databricks engine.
DATABRICKS_TOKENsecretDatabricks: personal access token (simplest auth option). Either this or DATABRICKS_CLIENT_ID + DATABRICKS_CLIENT_SECRET is required to use the databricks engine.
DATABRICKS_CLIENT_IDDatabricks: OAuth machine-to-machine service-principal client ID (preferred for automated use). Requires DATABRICKS_CLIENT_SECRET as well.
DATABRICKS_CLIENT_SECRETsecretDatabricks: OAuth machine-to-machine service-principal client secret. Requires DATABRICKS_CLIENT_ID as well.
COST_GUARD_ALLOW_MULTI_STATEMENT_SQLSet to 1 to let estimate_query_cost/run_query_bounded accept text containing more than one SQL statement. Off by default: the cost cap is only known to cover the single statement the dry run/EXPLAIN priced. Skips only this server's scanner: Snowflake still rejects multi-statement text (sessions are pinned to MULTI_STATEMENT_COUNT=1), and only a single SELECT/WITH/VALUES statement is wrapped in a LIMIT subquery - a script runs unwrapped and its row cap (max_rows, default 1000) is enforced by the paged fetch.
COST_GUARD_ALLOW_WRITE_STATEMENTSSet to 1 (exactly that value) to let estimate_query_cost/run_query_bounded accept statements that are not reads. Off by default: only text whose first keyword (after comments and opening parentheses) is SELECT, WITH, VALUES, SHOW, DESCRIBE, DESC or EXPLAIN is estimated or run - a WITH must be followed by a SELECT or VALUES - because warehouse rows re-enter the model's context and can steer the next call. The gate is defence in depth: the authorisation boundary is the credential's grants (deploy a read-only principal). With COST_GUARD_ALLOW_MULTI_STATEMENT_SQL=1 every statement in the text must be a read, so BigQuery scripts (DECLARE/SET/BEGIN) need both opt-outs. Any other value leaves the gate on.
COST_GUARD_MAX_IN_FLIGHT_QUERIESMaximum number of run_query_bounded calls allowed in flight at once (positive integer, default 8). A cancelled call keeps its slot until its warehouse query completes or the 120 s watchdog fires; a call over the cap fails with a tool error naming this variable before any warehouse connection is opened.
COST_GUARD_DATABRICKS_ALLOW_WAREHOUSE_STARTSet to true (exactly that value) to let the read-only Databricks tools (check_credentials, estimate_query_cost) open a session on a SQL warehouse that is not RUNNING, which starts the warehouse and bills compute until it auto-stops. Off by default: the server first reads the warehouse's state through the Warehouses API (GET /api/2.0/sql/warehouses/<id>, CAN_VIEW/CAN_USE suffices) and, unless it is RUNNING - also when the state cannot be read - check_credentials returns ok=false and estimate_query_cost returns no byte or dollar figure, without opening a session. run_query_bounded is not gated: its own pre-execution estimate and the execution may start the warehouse. Any other value leaves the guard on.
COST_GUARD_SNOWFLAKE_ALLOW_WAREHOUSE_RESUMESet to true (exactly that value) to let the read-only Snowflake tools run SELECT CURRENT_REGION(), the INFORMATION_SCHEMA.QUERY_HISTORY read and check_credentials' session-context SELECT on a warehouse that is not STARTED, which can resume a suspended AUTO_RESUME warehouse and bill compute until it auto-suspends. Off by default: those statements are skipped unless the pinned warehouse's SHOW WAREHOUSES state is STARTED (also skipped when no warehouse is pinned or the state cannot be read), and the QUERY_HISTORY read is skipped whenever estimate_query_cost is called without a warehouse argument; estimate_query_cost then prices at Gen1 rates with the byte-tier heuristic and says so in a caveat, and check_credentials returns ok=true with a detail built from the SHOW WAREHOUSES row. USE WAREHOUSE, EXPLAIN USING JSON, SHOW WAREHOUSES and SELECT CURRENT_WAREHOUSE() always run; run_query_bounded is not gated. Any other value leaves the guard on.

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing

Badge for your README

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/mcpsmiths-cost-guard-mcp.svg)](https://mcp.market/server/mcpsmiths-cost-guard-mcp)

How the badge works