Lagaam runs on your own machine — the client starts it, so there is no endpoint to ping. 474 installs a week from pypi. Last commit 6 Nov 2026.
Stops an agent's Trino or Pinot query before it runs if it costs too much or reads outside its grant
Nothing serious here today
Today is the operative word: we check Lagaam every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add lagaam -e 'LAGAAM_ALLOWED_TABLES=<LAGAAM_ALLOWED_TABLES>' -- uvx lagaam{
"mcpServers": {
"lagaam": {
"command": "uvx",
"args": [
"lagaam"
],
"env": {
"LAGAAM_ALLOWED_TABLES": "<LAGAAM_ALLOWED_TABLES>"
}
}
}
}[mcp_servers.lagaam]
command = "uvx"
args = ["lagaam"]
env = { LAGAAM_ALLOWED_TABLES = "<LAGAAM_ALLOWED_TABLES>" }{
"mcpServers": {
"lagaam": {
"command": "uvx",
"args": [
"lagaam"
],
"env": {
"LAGAAM_ALLOWED_TABLES": "<LAGAAM_ALLOWED_TABLES>"
}
}
}
}{
"servers": {
"lagaam": {
"type": "stdio",
"command": "uvx",
"args": [
"lagaam"
],
"env": {
"LAGAAM_ALLOWED_TABLES": "<LAGAAM_ALLOWED_TABLES>"
}
}
}
}Put your own value in place of
<LAGAAM_ALLOWED_TABLES> (Comma list of catalog.schema.table grants; the server will not start without it).
The author’s registry entry marks it as required.
Optional settings from the registry entry, left out of the block above:
LAGAAM_ALLOW_ALL_TABLES (true to run with no grant at all: an explicit opt-out, off by default), LAGAAM_ENGINE (Which adapter to run), TRINO_HOST (Trino coordinator host), TRINO_PORT (Trino coordinator port), TRINO_USER (Trino user), TRINO_PASSWORD (Password for TRINO_USER; unset means no login. Not with TRINO_JWT), TRINO_JWT (JWT to log in with instead of a password; unset means no login), TRINO_HTTP_SCHEME (http or https; unset means https once a password or JWT is set, else http), TRINO_VERIFY (TLS cert check: true, false, or the path of a CA bundle (PEM)), PINOT_CONTROLLER_URL (Pinot controller URL), PINOT_BROKER_URL (Pinot broker URL), PINOT_USER (Pinot user; unset means no auth), PINOT_PASSWORD (Pinot password; unset means no auth), LAGAAM_AGENT_NAME (Identity stamped on the audit trail), LAGAAM_MAX_SCAN_BYTES (Scan-bytes budget per query, checked before it runs (default 50 GiB)), LAGAAM_MAX_ROWS (Scanned-row estimate budget per query; unset means ungated), LAGAAM_MAX_INTERMEDIATE_ROWS (Rows the engine would build at its widest step, not rows returned, so a LIMIT doesn't lower it), LAGAAM_MAX_RETURNED_ROWS (Rows returned to the agent per query, capped at 100000; a bigger LIMIT in the query is lowered to it), LAGAAM_QUERY_TIMEOUT (Wall-clock seconds per query), LAGAAM_METADATA_TTL (Metadata cache TTL, seconds), LAGAAM_AUDIT_LOG (Audit JSONL file path; unset means stderr).
Alternatives to Lagaam
same job, measured the same wayYour agent checks your notes before installing and stops on packages you or your team ruled out.
Read-only PostgreSQL for AI agents: every statement is checked before it runs. No account needed.
An AI agent's safe read-only scout to orient in an unknown repository before touching it.
Check text for leaked credentials before an agent writes or commits it. Runs locally.
Check GitHub repos and shell commands for malware-delivery tricks before an AI agent runs them
MCP proxy that checks every tools/call against Agent Trust policy, with evidence, before it runs.
Check an MCP server, skill or plugin before your agent uses it: tool text on record, changes graded.
Make a coding agent prove it: run the repo's real tests, typecheck and lint before it says done.
Lagaam — questions
Answers built from our own checks of this server.