Log inSubmit server
Cost Guard MCP logo

Cost Guard MCP

Prevents costly warehouse queries and oversized results with engine-aware estimates and per-call execution limits.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Cost Guard MCP

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "cost-guard-mcp": {
      "command": "uvx",
      "args": [
        "cost-guard-mcp"
      ],
      "env": {
        "GOOGLE_APPLICATION_CREDENTIALS": "YOUR_VALUE_HERE",
        "SNOWFLAKE_ACCOUNT": "YOUR_VALUE_HERE",
        "SNOWFLAKE_USER": "YOUR_VALUE_HERE",
        "SNOWFLAKE_ROLE": "YOUR_VALUE_HERE",
        "SNOWFLAKE_PRIVATE_KEY_PATH": "YOUR_VALUE_HERE",
        "SNOWFLAKE_PASSWORD": "YOUR_VALUE_HERE",
        "SNOWFLAKE_EDITION": "YOUR_VALUE_HERE",
        "SNOWFLAKE_SECONDARY_ROLES": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

cost-guard-mcp MCP server adds pre-flight cost checks and result-size limits for BigQuery, Snowflake, and Databricks. It estimates read-only SQL before execution, reports whether the estimate is precise, an upper bound, or heuristic, and can refuse calls that exceed byte, row, or dollar limits. Use it when an AI agent needs warehouse access without unrestricted query spend or unbounded result payloads. The server runs as a local stdio process and applies safeguards per call rather than through shared session state.

Use cases

  • Check warehouse credentials before allowing an agent to query
  • Estimate read-only SQL cost before execution
  • Refuse queries that exceed byte or dollar budgets
  • Limit returned rows and serialized result size
  • Inspect cost-estimate accuracy by warehouse engine

Key features

  • BigQuery, Snowflake, and Databricks support
  • Pre-flight query cost estimation
  • Per-call byte, row, and dollar caps
  • Single-statement read-query enforcement
  • Accuracy tiers for cost estimates
  • Credential and warehouse-state checks

Tools4

What Cost Guard MCP lets your agent do. Expand a tool for its parameters.

Verified live~2.1k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked

Recent health check succeeded.

9/9 checks healthy over the last 38d

What it can do

From the 4 tools this server returned when we ran it; 4 declare their own safety hints.

Handles credentials · 1Makes network requests · 4Read-only tools · 4
Network at startup2 connections
Files written at startupNone

Observed 2026-10-20 in an isolated sandbox. A description of reach, not a security audit.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 15d ago via OSV.dev · cost-guard-mcp (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
Last commit4d agoMost recent push to the default branch.
Tools exposed4Callable tools this server registers over MCP.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How Cost Guard MCP works

What cost-guard-mcp does

cost-guard-mcp places a decision point between an AI agent and BigQuery, Snowflake, or Databricks. It can validate connectivity, describe the reliability of each engine's cost signals, estimate a SQL statement before execution, and execute a statement only when it stays within caller-supplied limits.

The main protection is run_query_bounded. It checks an estimate against optional byte, row, and estimated-dollar ceilings before submitting the query. Calls refused for an excessive estimated cost or byte count do not run. Row and serialized-result limits can be discovered only after execution, so those refusals report that the query ran and return a truncated result where applicable.

How it works

Each cost response includes an accuracy tier. BigQuery estimates use dry-run information and are marked PRECISE; Snowflake uses EXPLAIN and reports an UPPER_BOUND; Databricks uses EXPLAIN COST and reports a HEURISTIC estimate. describe_engine_capabilities lets an agent inspect these distinctions before relying on a number.

Calls accept exactly one SQL statement. By default, the statement must be a read operation beginning with SELECT, WITH, VALUES, SHOW, DESCRIBE, DESC, or EXPLAIN; a common-table expression must resolve to SELECT or VALUES. Write statements can be enabled with an operator setting.

Result rows are labeled as untrusted warehouse data rather than instructions. run_query_bounded defaults to 1,000 rows and limits serialized output to 8 MiB. Nested values deeper than 64 levels may be replaced with a placeholder. A single SELECT, WITH, or VALUES statement is wrapped with a row limit; other admitted statement types are fetched until the cap.

Setup and configuration

The server uses a local stdio process and needs credentials for the warehouse being accessed. BigQuery can use GOOGLE_APPLICATION_CREDENTIALS pointing to a service-account key file or application-default credentials from gcloud.

Snowflake requires SNOWFLAKE_ACCOUNT, SNOWFLAKE_USER, and SNOWFLAKE_ROLE, plus either SNOWFLAKE_PRIVATE_KEY_PATH or SNOWFLAKE_PASSWORD. The configured role is the authorization boundary: administrative roles including ACCOUNTADMIN, SECURITYADMIN, and ORGADMIN are rejected. Secondary roles default to NONE; SNOWFLAKE_SECONDARY_ROLES=ALL enables them where necessary, but allows SQL to use every role held by the user. SNOWFLAKE_EDITION can set the account edition used for pricing.

Call check_credentials after configuring an engine. Snowflake and Databricks checks read warehouse state before opening a session that could cause compute charges. The COST_GUARD_SNOWFLAKE_ALLOW_WAREHOUSE_RESUME and COST_GUARD_DATABRICKS_ALLOW_WAREHOUSE_START settings opt into bypassing those state checks.

Tools and capabilities

  • check_credentials verifies connectivity with limited metadata or control-plane operations.
  • describe_engine_capabilities explains which cost signals are exact or approximate.
  • estimate_query_cost evaluates one permitted SQL statement without running the query itself.
  • run_query_bounded estimates and conditionally executes one statement using caller-provided caps.
  • warehouse_size and Snowflake edition can raise an estimate, but cannot price below the observed warehouse. Some warehouse types have no modeled dollar rate.
  • Snowflake sessions use the configured role, restrict multi-statement execution, and apply bounded statement timeouts.

Limitations and notes

Estimates can have different reliability levels, and some stopped or suspended warehouses prevent metadata lookups or dollar estimates. A dollar cap refuses execution when no dollar figure is available. run_query_bounded is not protected from warehouse start or resume side effects, so an allowed call may incur compute charges.

An executed field must be inspected on every bounded-query response. false means the query was not submitted; true means the warehouse ran it, including row-cap and result-size refusals. Narrow a query instead of repeatedly rerunning it for more rows.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Cost Guard MCP

cost-guard-mcp is an MCP server that connects AI agents to BigQuery, Snowflake, and Databricks with tools for credential checks, engine capability inspection, pre-query cost estimates, and bounded query execution. It can refuse statements exceeding byte, row, or estimated-dollar limits and reports whether a refused query actually ran.

Run cost-guard-mcp as a local stdio process and configure credentials for the warehouse engine you plan to use. BigQuery supports application-default credentials or GOOGLE_APPLICATION_CREDENTIALS; Snowflake requires account, user, role, and private-key or password authentication settings.

cost-guard-mcp supports BigQuery, Snowflake, and Databricks. Its credential checks, capability descriptions, cost estimates, and bounded query tool accept an engine selection for these warehouse systems.

Yes. Call run_query_bounded with maximum bytes, rows, or estimated dollars. The server estimates the statement first and refuses it when a pre-execution limit is exceeded; row and serialized-result limits can instead produce a refusal after the query has run.

Yes. cost-guard-mcp uses a local stdio MCP process, so it can be configured in Cursor as an MCP server. The warehouse credentials and relevant environment variables must be available to the launched process.

Related MCP servers

All in Databases All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewCost Guard MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/cost-guard-mcp?style=directory)](https://allmcps.com/mcp/cost-guard-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/cost-guard-mcp"><img src="https://allmcps.com/api/badge/cost-guard-mcp?style=directory" alt="Cost Guard MCP on AllMCPs" /></a>