Skip to main content
Glama
mcpsmiths

cost-guard-mcp

by mcpsmiths

cost-guard-mcp

Pre-flight query cost & result-size guardrails for AI agents, across BigQuery and Snowflake — before the query ever runs.

Why

An AI agent using a warehouse MCP can silently trigger a full-table scan that costs hundreds of dollars, or return millions of rows that flood its own context window. No existing warehouse MCP tells the agent "how much will this cost" or "how much data will this return" before running the query.

Related MCP server: BQ Agent Gateway

What makes this different

  • Every cost estimate discloses its accuracy tierPRECISE (BigQuery dryRun), UPPER_BOUND (Snowflake EXPLAIN), or HEURISTIC (Databricks, not yet shipped) — so your agent never over-trusts a heuristic number.

  • Per-call boundsrun_query_bounded takes max_bytes_billed / max_rows / max_estimated_cost_usd on each call; no shared session state required.

  • Zero infrastructure — a single local stdio process. No database, no gateway, no Docker Compose.

Tools

  • describe_engine_capabilities(engine) — what's exact vs. approximate for this engine.

  • estimate_query_cost(engine, sql, warehouse?) — pre-flight cost estimate, tagged with its accuracy tier.

  • run_query_bounded(engine, sql, max_bytes_billed?, max_rows?, max_estimated_cost_usd?) — refuses to run if the estimate exceeds your bound.

Setup

BigQuery

Set GOOGLE_APPLICATION_CREDENTIALS to a service-account key file path (or run gcloud auth application-default login).

Snowflake

Set SNOWFLAKE_ACCOUNT, SNOWFLAKE_USER, SNOWFLAKE_ROLE (required — no default, never ACCOUNTADMIN), and either SNOWFLAKE_PRIVATE_KEY_PATH (preferred) or SNOWFLAKE_PASSWORD (discouraged).

Install

uvx cost-guard-mcp

Known limitations

  • Databricks is not yet supported (deferred past v1).

  • Snowflake's UPPER_BOUND estimate excludes Cortex AI Function ("AI Credits") cost.

  • BigQuery Editions/capacity-billed projects cannot get a dollar estimate — only a byte count (capacity billing has no fixed $/byte rate).

License

MIT

Available Tools

3 tools
describe_engine_capabilitiesA
Read-only

Declare which cost signals are exact vs. approximate for the given warehouse engine.

Call this before estimate_query_cost or run_query_bounded to understand how much to trust the accuracy_tier on their responses for this engine.

ParametersJSON Schema
NameRequiredDescriptionDefault
engineYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
engineYes
known_gapsNo
default_accuracy_tierYes
supports_precise_bytesYes
supports_dollar_estimateYes

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, so the safety profile is covered. The description adds that responses carry an accuracy_tier that varies by engine, which is useful context, but it says nothing about caching, latency, or whether capability data is stable across calls.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and followed by the invocation order. Nothing is redundant or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the description need not explain return values, and it correctly covers purpose and call ordering. It could go slightly further by indicating what the accuracy_tier levels imply for downstream trust, but nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the single parameter is an enum (bigquery/snowflake/databricks) whose meaning is self-evident, and the description identifies it as 'the given warehouse engine'. It adds no format or constraint detail beyond that, so the baseline 3 is appropriate for a trivially self-documenting enum.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb and resource: it reports, per warehouse engine, which cost signals are exact versus approximate. That purpose is clearly distinct from the cost-estimation and bounded-execution siblings, so an agent can tell what this tool produces without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly prescribes sequencing ('Call this before estimate_query_cost or run_query_bounded') and names both alternatives by name, plus the reason to call it (interpreting accuracy_tier). This is the strongest form of when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

estimate_query_costA
Read-only

Estimate the cost of a SQL query before running it. ALWAYS call this before running an expensive-looking query. The response's accuracy_tier tells you how much to trust the number: PRECISE (exact), UPPER_BOUND (real cap, may overstate), HEURISTIC (rough).

ParametersJSON Schema
NameRequiredDescriptionDefault
sqlYes
engineYes
warehouseNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
engineYes
caveatsNo
currencyNo
accuracy_tierYes
estimated_bytesNo
estimated_cost_usdNo

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover safety (readOnlyHint, openWorldHint), and the description adds genuine behavioral value by decoding the response's accuracy_tier vocabulary (PRECISE/UPPER_BOUND/HEURISTIC) so the agent knows how much to trust the result. It does not disclose latency, rate limits, or failure modes, so it stops short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the core action, then the usage rule, then the interpretation key. Every sentence carries distinct information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only estimation tool with an output schema present, the description supplies the two things an agent most needs: when to call it and how to interpret accuracy_tier. The only gap is guidance on the optional warehouse argument, which is minor given the overall coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and there are three parameters, yet the description says nothing about sql, engine, or warehouse semantics. The engine enum values are self-explanatory, but the optional warehouse parameter and what it selects are unexplained in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Estimate the cost of a SQL query') with a clear temporal scope ('before running it'). An agent can distinguish it from run_query_bounded (which executes) and describe_engine_capabilities (which describes) without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly prescribes when to call it ('ALWAYS call this before running an expensive-looking query'), giving a clear precondition. It does not name the sibling run_query_bounded as the follow-up action, so the routing is implied rather than spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_query_boundedA

Run a query only if its pre-flight cost estimate is within your given bounds; refuses otherwise (check result.status — "refused" means it did NOT run and result.hint explains why). NOTE: unlike estimate_query_cost, a successful call here has a real monetary/quota side effect — don't call this repeatedly without inspecting the result of each call.

ParametersJSON Schema
NameRequiredDescriptionDefault
sqlYes
engineYes
max_rowsNo
warehouseNo
max_bytes_billedNo
max_estimated_cost_usdNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
hintNo
rowsNo
reasonNo
statusYes
estimateNo
row_countNo

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false and openWorldHint=true; the description goes well beyond them by disclosing the cost-bound gate, the 'refused' status sentinel, the result.hint diagnostic, and the real monetary/quota side effect of a successful call. This is exactly the extra context a mutating, cost-bearing tool needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core behavior and free of padding; the parenthetical about refusal and hint is the only slightly dense clause but it carries real information. Efficient overall.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values needn't be documented, yet the description still usefully explains the 'refused'/'hint' shape. Behavior and cost implications are complete for a bounded-execution tool; the only real omission is per-parameter meaning, which keeps this from a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 6 parameters, and the description never explains any of them — engine, warehouse, max_rows, max_bytes_billed, max_estimated_cost_usd are all left to the raw titles. The phrase 'your given bounds' hints at the max_* parameters but gives no mapping, units, or default behavior, so it fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource ('run a query') plus the governing condition ('only if its pre-flight cost estimate is within your given bounds') and the failure mode ('refuses otherwise'). It explicitly names the sibling estimate_query_cost, so an agent can distinguish the two without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives the selection condition against the alternative ('unlike estimate_query_cost...'), the refusal semantics, and an explicit anti-pattern warning ('don't call this repeatedly without inspecting the result of each call'). When-to-use and when-not are both covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.0
    • First observeddescribe_engine_capabilities
    • First observedestimate_query_cost
    • First observedrun_query_bounded

TDQS

A4.2/5.0

Scored across 3 tools

Disambiguation4/5

Each tool has a distinct role: capability discovery, pre-flight estimation, and bounded execution. However, estimate_query_cost and the internal estimating in run_query_bounded could cause slight confusion about when to use each, though descriptions clarify the difference.

Naming Consistency5/5

All tool names use snake_case with a consistent verb_noun pattern (describe_, estimate_, run_). There are no deviations or mixed conventions.

Tool Count4/5

Three tools form a minimal but focused set for a cost-guard server, each earning its place. The count sits at the low end of the typical 3-15 range, but is reasonable for the specialized scope.

Completeness4/5

The core lifecycle of advisory estimation and bounded execution is fully covered. There is a minor gap around tools for retrieving or setting quota/bound context, but agents can work around this for the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables safe, read-only interaction with Google BigQuery through Claude, with layered guardrails preventing dangerous or expensive queries. Exposes tools for listing datasets, tables, estimating costs, and running queries.
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to query business databases directly via natural language, with enforced read-only access and secure query limits. Supports SQLite and PostgreSQL, and works with any OpenAI-compatible model.
    0
    ISC
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enforces safety and governance for SQL queries executed by AI agents, providing read-only enforcement, cost estimation, and audit trails.
    Apache 2.0