{
  "slug": "io-github-mcpsmiths-cost-guard-mcp",
  "name": "io.github.mcpsmiths/cost-guard-mcp",
  "title": "Cost Guard MCP",
  "description": "Pre-flight query cost and result-size guardrails for AI agents on BigQuery, Snowflake, Databricks",
  "version": "0.6.0",
  "publishedAt": "2026-10-19T17:04:04.26828Z",
  "updatedAt": "2026-10-19T17:04:04.26828Z",
  "repoUrl": "https://github.com/mcpsmiths/cost-guard-mcp",
  "websiteUrl": null,
  "namespace": {
    "type": "github",
    "owner": "mcpsmiths"
  },
  "kind": "local",
  "packages": [
    {
      "registryType": "pypi",
      "identifier": "cost-guard-mcp",
      "version": "0.6.0",
      "transport": "stdio",
      "runtimeHint": null
    }
  ],
  "remotes": [],
  "envVars": [
    {
      "name": "GOOGLE_APPLICATION_CREDENTIALS",
      "isSecret": true,
      "isRequired": false,
      "description": "BigQuery: path to a service-account key file (Application Default Credentials). Required to use the bigquery engine."
    },
    {
      "name": "SNOWFLAKE_ACCOUNT",
      "isSecret": false,
      "isRequired": false,
      "description": "Snowflake: account identifier. Required to use the snowflake engine."
    },
    {
      "name": "SNOWFLAKE_USER",
      "isSecret": false,
      "isRequired": false,
      "description": "Snowflake: username. Required to use the snowflake engine."
    },
    {
      "name": "SNOWFLAKE_ROLE",
      "isSecret": false,
      "isRequired": false,
      "description": "Snowflake: role to assume. Required to use the snowflake engine; has no default and must never be ACCOUNTADMIN (ACCOUNTADMIN, SECURITYADMIN and ORGADMIN are rejected before any Snowflake connection is opened - the check runs when the Snowflake configuration is first loaded, on the first Snowflake tool call; the server process itself starts regardless, so a bad role surfaces as a failed check_credentials or a tool error, not as a startup exit)."
    },
    {
      "name": "SNOWFLAKE_SECONDARY_ROLES",
      "isSecret": false,
      "isRequired": false,
      "description": "Snowflake: secondary roles activated at login. NONE (default) means only SNOWFLAKE_ROLE is active in the session; ALL is the explicit opt-out that activates every role granted to SNOWFLAKE_USER."
    },
    {
      "name": "SNOWFLAKE_PRIVATE_KEY_PATH",
      "isSecret": true,
      "isRequired": false,
      "description": "Snowflake: path to an RSA private key file for key-pair auth (preferred over SNOWFLAKE_PASSWORD). Either this or SNOWFLAKE_PASSWORD is required to use the snowflake engine."
    },
    {
      "name": "SNOWFLAKE_PRIVATE_KEY_PASSPHRASE",
      "isSecret": true,
      "isRequired": false,
      "description": "Snowflake: passphrase for an encrypted SNOWFLAKE_PRIVATE_KEY_PATH key file, if the key is encrypted."
    },
    {
      "name": "SNOWFLAKE_PASSWORD",
      "isSecret": true,
      "isRequired": false,
      "description": "Snowflake: password (discouraged; prefer SNOWFLAKE_PRIVATE_KEY_PATH). Either this or SNOWFLAKE_PRIVATE_KEY_PATH is required to use the snowflake engine."
    },
    {
      "name": "SNOWFLAKE_EDITION",
      "isSecret": false,
      "isRequired": false,
      "description": "Snowflake: account edition that sets the USD/credit price of estimates - standard (default), enterprise, business_critical or vps. The per-call edition argument can only raise it."
    },
    {
      "name": "DATABRICKS_SERVER_HOSTNAME",
      "isSecret": false,
      "isRequired": false,
      "description": "Databricks: SQL warehouse server hostname (e.g. my-workspace.cloud.databricks.com, no scheme, no trailing slash). Required to use the databricks engine."
    },
    {
      "name": "DATABRICKS_HTTP_PATH",
      "isSecret": false,
      "isRequired": false,
      "description": "Databricks: SQL warehouse HTTP path (from the warehouse's Connection Details tab, e.g. /sql/1.0/warehouses/<warehouse-id>). Required to use the databricks engine."
    },
    {
      "name": "DATABRICKS_TOKEN",
      "isSecret": true,
      "isRequired": false,
      "description": "Databricks: personal access token (simplest auth option). Either this or DATABRICKS_CLIENT_ID + DATABRICKS_CLIENT_SECRET is required to use the databricks engine."
    },
    {
      "name": "DATABRICKS_CLIENT_ID",
      "isSecret": false,
      "isRequired": false,
      "description": "Databricks: OAuth machine-to-machine service-principal client ID (preferred for automated use). Requires DATABRICKS_CLIENT_SECRET as well."
    },
    {
      "name": "DATABRICKS_CLIENT_SECRET",
      "isSecret": true,
      "isRequired": false,
      "description": "Databricks: OAuth machine-to-machine service-principal client secret. Requires DATABRICKS_CLIENT_ID as well."
    },
    {
      "name": "COST_GUARD_ALLOW_MULTI_STATEMENT_SQL",
      "isSecret": false,
      "isRequired": false,
      "description": "Set to 1 to let estimate_query_cost/run_query_bounded accept text containing more than one SQL statement. Off by default: the cost cap is only known to cover the single statement the dry run/EXPLAIN priced. Skips only this server's scanner: Snowflake still rejects multi-statement text (sessions are pinned to MULTI_STATEMENT_COUNT=1), and only a single SELECT/WITH/VALUES statement is wrapped in a LIMIT subquery - a script runs unwrapped and its row cap (max_rows, default 1000) is enforced by the paged fetch."
    },
    {
      "name": "COST_GUARD_ALLOW_WRITE_STATEMENTS",
      "isSecret": false,
      "isRequired": false,
      "description": "Set to 1 (exactly that value) to let estimate_query_cost/run_query_bounded accept statements that are not reads. Off by default: only text whose first keyword (after comments and opening parentheses) is SELECT, WITH, VALUES, SHOW, DESCRIBE, DESC or EXPLAIN is estimated or run - a WITH must be followed by a SELECT or VALUES - because warehouse rows re-enter the model's context and can steer the next call. The gate is defence in depth: the authorisation boundary is the credential's grants (deploy a read-only principal). With COST_GUARD_ALLOW_MULTI_STATEMENT_SQL=1 every statement in the text must be a read, so BigQuery scripts (DECLARE/SET/BEGIN) need both opt-outs. Any other value leaves the gate on."
    },
    {
      "name": "COST_GUARD_MAX_IN_FLIGHT_QUERIES",
      "isSecret": false,
      "isRequired": false,
      "description": "Maximum number of run_query_bounded calls allowed in flight at once (positive integer, default 8). A cancelled call keeps its slot until its warehouse query completes or the 120 s watchdog fires; a call over the cap fails with a tool error naming this variable before any warehouse connection is opened."
    },
    {
      "name": "COST_GUARD_DATABRICKS_ALLOW_WAREHOUSE_START",
      "isSecret": false,
      "isRequired": false,
      "description": "Set to true (exactly that value) to let the read-only Databricks tools (check_credentials, estimate_query_cost) open a session on a SQL warehouse that is not RUNNING, which starts the warehouse and bills compute until it auto-stops. Off by default: the server first reads the warehouse's state through the Warehouses API (GET /api/2.0/sql/warehouses/<id>, CAN_VIEW/CAN_USE suffices) and, unless it is RUNNING - also when the state cannot be read - check_credentials returns ok=false and estimate_query_cost returns no byte or dollar figure, without opening a session. run_query_bounded is not gated: its own pre-execution estimate and the execution may start the warehouse. Any other value leaves the guard on."
    },
    {
      "name": "COST_GUARD_SNOWFLAKE_ALLOW_WAREHOUSE_RESUME",
      "isSecret": false,
      "isRequired": false,
      "description": "Set to true (exactly that value) to let the read-only Snowflake tools run SELECT CURRENT_REGION(), the INFORMATION_SCHEMA.QUERY_HISTORY read and check_credentials' session-context SELECT on a warehouse that is not STARTED, which can resume a suspended AUTO_RESUME warehouse and bill compute until it auto-suspends. Off by default: those statements are skipped unless the pinned warehouse's SHOW WAREHOUSES state is STARTED (also skipped when no warehouse is pinned or the state cannot be read), and the QUERY_HISTORY read is skipped whenever estimate_query_cost is called without a warehouse argument; estimate_query_cost then prices at Gen1 rates with the byte-tier heuristic and says so in a caveat, and check_credentials returns ok=true with a detail built from the SHOW WAREHOUSES row. USE WAREHOUSE, EXPLAIN USING JSON, SHOW WAREHOUSES and SELECT CURRENT_WAREHOUSE() always run; run_query_bounded is not gated. Any other value leaves the guard on."
    }
  ],
  "category": "databases",
  "subcategory": "sql",
  "company": "",
  "categoryAuto": true,
  "checks": [
    {
      "id": "source-linked",
      "label": "Source repository linked",
      "result": "pass",
      "detail": "https://github.com/mcpsmiths/cost-guard-mcp"
    },
    {
      "id": "version-pinned",
      "label": "Version pinned",
      "result": "pass",
      "detail": "Every package has an explicit version"
    },
    {
      "id": "secrets-requested",
      "label": "Secrets requested",
      "result": "warn",
      "detail": "Asks for 6 secrets: GOOGLE_APPLICATION_CREDENTIALS, SNOWFLAKE_PRIVATE_KEY_PATH, SNOWFLAKE_PRIVATE_KEY_PASSPHRASE, SNOWFLAKE_PASSWORD, DATABRICKS_TOKEN, DATABRICKS_CLIENT_SECRET"
    },
    {
      "id": "known-registry",
      "label": "Known package registry",
      "result": "pass",
      "detail": "All packages come from npm, PyPI, OCI, NuGet or MCPB"
    },
    {
      "id": "namespace",
      "label": "Namespace ownership",
      "result": "info",
      "detail": "Name verified via GitHub account mcpsmiths"
    },
    {
      "id": "meta-text",
      "label": "Registry text aimed at the AI",
      "result": "pass",
      "detail": "Description and settings contain no hidden characters or instructions to the AI"
    },
    {
      "id": "install-scripts",
      "label": "Install scripts",
      "result": "pass",
      "detail": "cost-guard-mcp 0.6.0 has no setup.py; nothing runs at install"
    },
    {
      "id": "code-flags",
      "label": "Code red flags",
      "result": "pass",
      "detail": "Read 108 files in cost-guard-mcp 0.6.0: no obfuscation, encoded execution, credential reads or data-collection endpoints found"
    },
    {
      "id": "ai-text",
      "label": "Text aimed at the AI",
      "result": "pass",
      "detail": "No hidden characters or instructions to the AI in 108 files, including comments and the README"
    }
  ],
  "scannedAt": "2026-10-29",
  "level": "Scanned",
  "install": [
    {
      "label": "Claude Desktop (pypi)",
      "kind": "claude_desktop_json",
      "text": "{\n  \"mcpServers\": {\n    \"cost-guard-mcp\": {\n      \"command\": \"uvx\",\n      \"args\": [\n        \"cost-guard-mcp==0.6.0\"\n      ]\n    }\n  }\n}"
    }
  ],
  "curated": true,
  "stars": 1,
  "archived": false,
  "pushedAt": "2026-10-26T22:41:55Z",
  "health": {
    "score": 49,
    "parts": {
      "popularity": 0.2027123839146225,
      "activity": 0.6,
      "issues": 0.6842105263157895,
      "security": 0.8
    },
    "fail": 0,
    "warn": 1,
    "raw": {
      "stars": 1,
      "forks": 0,
      "downloads": 59,
      "hn": null,
      "issuesOpen": 6,
      "issuesClosed": 13,
      "prsMerged": 89,
      "commits90": 0,
      "release": "2026-10-19T17:03:08Z",
      "pushed": "2026-10-26T22:41:55Z",
      "growth": null,
      "growthDays": null,
      "archived": false
    },
    "at": "2026-10-31T07:35:52.424Z"
  }
}