Anumana
Anumana is a read-only MCP server that pre-checks AI-written SQL and vector queries for cost and risk before they run — using EXPLAIN, never executing anything.
Preflight SQL queries (
preflight_query): get risk tier (cheap/moderate/expensive/dangerous), rows scanned vs returned, scan strategy, and overhead flags (missing index, SELECT *, no LIMIT, N+1) without running the query.Preflight vector/RAG searches (
preflight_vector_search): catch pgvector traps — brute-force scan with no HNSW/IVFFlat index, top_k too large, unbounded search, metadata-filter/ANN recall loss.Rewrite for cost (
rewrite_query): get a verified equivalent rewrite with before/after planner cost and selectivity-gated index suggestions (HNSW for vector targets).Explain query behavior (
explain_query_working): plain-English logical gather order plus the actual physical plan, step by step.Grade a candidate query (
suggest_query): returnsnext_actionof accept or refine with high-severity flags and a verified cheaper rewrite.Read the real schema (
describe_schema_tool): tables, columns, indexes, and row counts via read-only catalog access — never data rows.Inspect configuration:
list_targetsshows configured databases (name, engine, diagnosability);list_policiesshows enforcement rules that can block or warn on queries.Work offline / zero-trust (
preflight_schema_only): static heuristic analysis against pasted CREATE TABLE DDL with no DB connection.Multi-DB support: pass
target=<name>to route any tool to a specific database; 12 engines across 7 paradigms (Postgres and SQLite live-tested).Never executes SQL: EXPLAIN only, read-only role recommended, no secrets or connection strings returned.
Offline-verified adapter for ClickHouse: preflight analysis of generated ClickHouse queries to catch expensive scans and costly patterns before they run, currently shipped as an untested adapter.
Offline-verified adapter for MongoDB: gives preflight foresight on generated Mongo queries, flagging costly scan patterns and suggesting cheaper equivalents, currently shipped as an untested adapter.
Offline-verified adapter for MySQL: performs query cost and risk preflight analysis (risk tier, scan strategy, rows scanned vs returned, rewrite suggestions) over MySQL queries, currently without live connection support.
Live-tested engine integration: analyzes SQL queries against a real Postgres schema using EXPLAIN (never EXPLAIN ANALYZE) without executing them, reporting risk tier, rows scanned vs returned, scan strategy, overhead flags, and verified equivalent rewrites with before/after planner cost plus selectivity-gated index suggestions. Connection is via a read-only DSN (ANUMANA_DSN).
Offline-verified adapter for Snowflake: analyzes generated Snowflake SQL for cost and risk before execution, reporting scan strategy, row counts, and rewrite deltas, currently shipped as an untested adapter.
Live-tested engine integration: runs the same preflight cost-and-risk analysis on SQLite queries, explaining the physical plan step by step and flagging unindexed scans and expensive operations without running the query.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Anumanapreflight this query: SELECT * FROM orders WHERE user_id = 42"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Anumana
Know what your query will cost — before you run it. Inference-grade foresight for every query your AI writes.
Anumana is an MCP server that catches the
costly query your AI coding agent just wrote — before it runs or reaches a PR.
It rides inside Claude, Cursor, Windsurf, Codex, Kiro, or any MCP-compatible
agent, reads your real schema via EXPLAIN (never EXPLAIN ANALYZE), and
tells you — in plain English — how the query behaves and whether it'll hurt.
Its scope is the queries AI agents actually generate: text-to-SQL today, and RAG / vector search (pgvector) alongside it — because an agent writing a similarity search has no idea it just triggered a brute-force scan over every embedding. Anumana is the feedback loop the agent is missing.
It is not another NL→SQL tool and not a DB-health dashboard. It does one job: stop AI-written database code from silently rotting production.
What it does (the features)
Tool | What it answers |
| "Will this SQL query be costly?" — risk tier (cheap/moderate/expensive/dangerous), rows scanned vs returned, scan strategy, and overhead flags. Without running it. |
| "Will this RAG similarity search be costly?" — catches the vector traps a plain SQL check misses: brute-force scan with no HNSW/IVFFlat index, |
| "Make it cheaper." — a verified equivalent rewrite with before/after planner cost, plus index suggestions gated on selectivity (won't tell you to index a column when the filter matches most of the table). |
| "How does this run?" — two layers: the logical gather order (FROM → WHERE → GROUP BY → HAVING → SELECT → ORDER BY → LIMIT) and the actual physical plan for your schema, step by step. |
| "I haven't given you DB creds yet." — static analysis against pasted |
Engines (12, across 7 paradigms): Postgres and SQLite are live-tested; MySQL, pgvector, MongoDB, DynamoDB, FalkorDB, Cassandra, Redshift, BigQuery, Snowflake and ClickHouse ship as offline-verified, untested adapters that are promoted to live one at a time. Full matrix + cost signals in SUPPORTED_ENGINES.md. The adapter interface is in DESIGN.md.
The one honest rule
Postgres planner cost is unitless — not milliseconds (docs).
Anumana never fakes a ~3.2s number. It reports rows scanned, scan strategy, a
risk tier, overhead flags, and the cost-delta of a rewrite — all defensible,
nothing invented. Every estimate carries an accuracy tier (UPPER_BOUND live,
HEURISTIC schema-only).
Related MCP server: mcp-database-tools
Install
pip install anumana-mcp # once published to PyPI
# or from source:
pip install -e .Then point your agent at it. The user installs it; the agent discovers the
tools automatically on connect via the MCP tools/list handshake — there is
no store to publish into.
Claude Desktop / Cursor / Windsurf / Kiro — mcpServers config block
{
"mcpServers": {
"anumana": {
"command": "uvx",
"args": ["anumana-mcp"],
"env": { "ANUMANA_DSN": "postgres://readonly@localhost:5432/mydb" }
}
}
}Use a read-only Postgres role. Anumana only ever EXPLAINs, but read-only is
defence in depth. Omit ANUMANA_DSN to run in schema-only mode (DDL in, no DB).
Try it with no database (30 seconds)
python3 src/demo.py # runs the engine on a canned plan, zero depsTest against a real Postgres
# a throwaway table, then:
ANUMANA_DSN=postgres://localhost/mydb anumana-mcpSee src/live_test.py for a psql-backed harness that proves the real
cost-delta and the selectivity gate on live data.
What's deliberately NOT here
No run_query (we never execute your SQL), no NL→SQL (the agent already does
that), no DB-health reports, no dollar-billing. Staying narrow is the strategy.
License
MIT — see LICENSE.
Community & contact
Contributions welcome — see CONTRIBUTING.md and the Code of Conduct. Adding a database engine is the highest- leverage contribution; the adapter contract is small (SUPPORTED_ENGINES.md).
Bugs / ideas: open a GitHub issue.
Security: see SECURITY.md — report privately.
Maintainer: nomore.report@gmail.com
Available Tools
9 toolsdescribe_schema_toolA
Read a database's REAL schema — tables/collections, columns/fields,
INDEXES, and row counts — so you can write a grounded, cost-aware query
BEFORE guessing. Call this FIRST when a user asks for data and you don't
already know the schema; it tells you which columns are indexed so your
query hits an index, not a full scan. READ-ONLY catalog access — never
reads data rows. If the schema can't be read it returns need_from_user
naming what to ask the user for. Pass target= in a multi-DB setup;
combine with list_targets to find which DB has the data.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full load and does well: it declares READ-ONLY catalog access, states it never reads data rows, and discloses the failure mode (returns `need_from_user` naming what to ask). It stops short of permissions, rate limits, or latency characteristics, so it is strong but not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose and the FIRST-call directive before the rationale, and each sentence adds a distinct fact (content, trigger, safety, failure mode, targeting). The dense em-dash enumeration is slightly heavy but still earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with an output schema already covering return shape, this covers purpose, trigger, safety, failure handling, and multi-DB targeting. The only notable omission is how it differs from the similarly named preflight_schema_only sibling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% (the lone `target` property has no description), so the description must compensate, and it does: it explains that target=<name> is used in a multi-DB setup and how to discover the right value via list_targets. That is meaningful guidance beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read a database's REAL schema') and enumerates exactly what is returned (tables/collections, columns/fields, indexes, row counts). It also implicitly separates itself from data-returning siblings by emphasizing catalog-only content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('Call this FIRST when a user asks for data and you don't already know the schema') and names the complementary sibling ('combine with list_targets to find which DB has the data'). The condition for the target parameter is stated as well ('in a multi-DB setup').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
explain_query_workingA
Explain in plain English HOW a query behaves — two layers: (1) the logical gather order (FROM -> WHERE -> GROUP BY -> HAVING -> SELECT -> ORDER BY -> LIMIT), why 'LIMIT 10' can still be slow; and (2) the actual physical plan the engine chose for THIS query, bottom-up. Call when a user asks why a query is slow or how it runs. Teaching tool. Pass target= in a multi-DB setup.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | ||
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does disclose the shape of the output (two layers, bottom-up physical plan) and the multi-DB targeting rule, but never states whether the query is actually executed, its read-only/cost profile, or any permission requirements — meaningful gaps for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the two output layers, then usage, then a one-word role marker, then the targeting note — each sentence carries information. It is slightly dense with parentheticals but nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be spelled out, and the description still usefully previews the two layers. Given no annotations, the only real omissions are side-effect/execution semantics and error behavior — minor for a read-only explain tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It adds real meaning for 'target' ('Pass target=<name> in a multi-DB setup'), but says nothing about 'sql' beyond the obvious, and gives no format/syntax hints for either parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a precise verb+resource (explain how a query behaves) and breaks the deliverable into two concrete layers: logical gather order and the engine's physical plan. This is unmistakably a teaching/diagnostic tool, cleanly separable from siblings like preflight_query (validation) or rewrite_query (rewriting), even without naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger: 'Call when a user asks why a query is slow or how it runs,' which tells the agent when this tool fits. It stops short of when-not-to-use guidance or naming the sibling alternatives (preflight_query, suggest_query) an agent might otherwise pick.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_policiesA
List the operator's standing enforcement policies — the rules that can BLOCK or WARN on a query regardless of what you intend. Each has a name, scope (which target/engine), condition (risk tier and/or flag), and action (block/warn/allow). preflight_query and suggest_query already apply these and attach the verdict; call this to explain to a user WHY a query was blocked. No policies configured means open by default (nothing blocked).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the policy object shape (name, scope, condition, action), the possible actions (block/warn/allow), and the important default that no configured policies means nothing is blocked. It does not explicitly state read-only/non-mutating behavior, but the verdict-attachment and default semantics are non-obvious context an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, front-loaded with the resource identity before the fields and the usage routing. Every clause adds information — definition, structure, default behavior, and the sibling relationship — with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be documented, yet the description still usefully summarizes the fields. For a no-param read tool it covers purpose, behavior defaults, and cross-tool routing, leaving an agent nothing essential missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no per-parameter semantics to convey; the baseline for a parameterless tool is 4. Nothing in the description is needed to call it correctly, and it introduces no misleading parameter hints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the operator's standing enforcement policies') and immediately characterizes what a policy is: name, scope, condition, action. It distinguishes itself from preflight_query and suggest_query by explaining those already apply policies while this one only enumerates them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('call this to explain to a user WHY a query was blocked') and implicitly rules out using it as a check step by noting that preflight_query and suggest_query already apply the policies and attach the verdict. The when and the alternatives are both present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_targetsA
List the databases Anumana is configured to analyse — each with its name, engine, and whether it's diagnosable. Call this FIRST in a multi-DB setup to see which target holds the data the user asked for, then pass target= to the other tools. In a single-DB setup you can omit target and the one database is used. Never returns connection strings or secrets.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does well: it discloses what the call returns (name, engine, diagnosability) and proactively rules out sensitive output ('Never returns connection strings or secrets'). It stops short of stating auth requirements or whether the target list is cached/live, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with what is listed, followed by when to call it and the security caveat. No filler or redundancy; every clause adds decision-relevant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter discovery tool with an output schema, the description covers purpose, ordering, downstream usage, and output sensitivity. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description usefully explains the target=<name> convention used by sibling tools, giving context for the values this call exposes, but there are no parameters of its own to document further.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the databases Anumana is configured to analyse') and enumerates returned attributes (name, engine, diagnosability). It also implicitly distinguishes itself from siblings like list_policies and the preflight_* tools by being the inventory/discovery call.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit sequencing ('Call this FIRST in a multi-DB setup'), the downstream handoff ('then pass target=<name> to the other tools'), and the single-DB alternative ('you can omit target and the one database is used'). An agent knows exactly when to call it and what to do with the result.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
preflight_queryA
Before running ANY SQL query you (the agent) just wrote, check how costly it will be on the real schema — WITHOUT executing it. Returns a risk tier (cheap/moderate/expensive/dangerous), rows scanned vs returned, scan strategy, and overhead flags (missing index, SELECT *, no LIMIT, N+1 / nested-loop blowup). EXPLAIN only — never runs the query. In a multi-DB setup pass target= (see list_targets). For similarity search use preflight_vector_search; with no DB use preflight_schema_only.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | ||
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it declares the tool never executes the query, describes the risk tiering, rows scanned vs returned, scan strategy, and the specific overhead flags it detects. That is exactly the behavioral context an agent needs before committing to a costly query.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the primary directive, then returns, then the safety guarantee, then routing. Every sentence earns its place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value enumeration is not strictly required, yet the description still previews the payload. Combined with the sibling routing and target guidance, nothing an agent needs to invoke this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains target fully ('in a multi-DB setup pass target=<name>', pointing to list_targets), but leaves sql undocumented beyond the obvious name. Adequate but not complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (preflight/check cost), resource (SQL query against the real schema), and scope (EXPLAIN only, never executes). It explicitly distinguishes itself from preflight_vector_search and preflight_schema_only, so an agent can route without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('before running ANY SQL query you just wrote'), when-not-to-use (similarity search, no DB), and names the exact alternatives with the condition that selects each. The multi-DB case is covered with the target=<name> instruction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
preflight_schema_onlyA
Analyse a query against pasted CREATE TABLE DDL with NO database connection — the zero-trust, offline front door. Call when the user gave you their schema (DDL) but not DB credentials. Catches SELECT *, missing LIMIT, un-indexed filter columns, LIKE '%...', functions on filtered columns. HEURISTIC only (no live counts) and says so. No target needed.
| Name | Required | Description | Default |
|---|---|---|---|
| ddl | Yes | ||
| sql | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does well: it discloses that results are HEURISTIC only, that there are no live counts, and that it 'says so' in output. It also enumerates the specific classes of issues caught (SELECT *, missing LIMIT, un-indexed filters, LIKE '%...', functions on filtered columns).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the differentiating capability (offline, zero-trust) and stays compact. The parenthetical 'the zero-trust, offline front door' is slightly marketing-flavored but earns space by signaling the routing distinction.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value detail is not required. The description covers what the tool examines and its heuristic limitation, which is enough for correct invocation; only parameter-shape guidance is thin.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% for 2 required params, so the description must compensate. It implies ddl = pasted CREATE TABLE DDL and sql = the query, but adds no format, sizing, or multi-statement guidance for either. Some meaning, but incomplete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (analyse) plus resource (query vs CREATE TABLE DDL) and the defining constraint (NO database connection). It clearly distinguishes itself from preflight_query by scoping to the offline case where no target/credentials exist.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger: 'Call when the user gave you their schema (DDL) but not DB credentials.' The 'No target needed' line reinforces when this applies versus a connection-requiring sibling, though it never names preflight_query as the alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
preflight_vector_searchA
Before running a VECTOR SIMILARITY SEARCH (pgvector: ORDER BY embedding <-> $1 LIMIT k, cosine <=>, inner-product <#>), check its cost WITHOUT
running it — for any RAG / semantic-search / nearest-neighbour query you
generate. Catches the vector traps a plain SQL check misses: brute-force
scan with no HNSW/IVFFlat index (FULL_VECTOR_SCAN), top_k too large
(TOP_K_TOO_LARGE), unbounded search (UNBOUNDED_VECTOR_SEARCH), and metadata-
filter/ANN recall loss (VECTOR_FILTER_INTERACTION). EXPLAIN only. Pass
target= in a multi-DB setup; the target should be a pgvector engine.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | ||
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it does well: 'EXPLAIN only' discloses that nothing is executed, and it enumerates the exact findings the agent can expect (FULL_VECTOR_SCAN, TOP_K_TOO_LARGE, UNBOUNDED_VECTOR_SEARCH, VECTOR_FILTER_INTERACTION). It doesn't state permissions or target-connection requirements beyond the multi-DB note.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core instruction ('check its cost WITHOUT running it') before the operator examples and trap list. Dense but nearly every clause carries information; the parenthetical operator enumeration is the only slightly heavy part.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value detail is unnecessary, yet the description still names the warning categories the agent will see. For a two-parameter read-only diagnostic tool, nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds real meaning for 'target' (name in a multi-DB setup, should be a pgvector engine) but says nothing about the required 'sql' parameter beyond contextual implication that it is the query to preflight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (check cost) and resource (vector similarity search) and explicitly frames the scope as pre-execution 'WITHOUT running it'. The pgvector operator examples (ORDER BY embedding <-> $1, <=>, <#>) make the target workload unmistakable and distinguish it from generic SQL preflight siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly says when to use it: before running any RAG / semantic-search / nearest-neighbour query, and contrasts it with 'a plain SQL check' which implicitly points to preflight_query. It stops short of naming that sibling explicitly or stating when NOT to use this tool (e.g. non-pgvector targets).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rewrite_queryA
Rewrite a slow query into a cheaper, equivalent one and PROVE the improvement by EXPLAIN-ing both and comparing planner cost. Call after a preflight flags a query expensive/dangerous. Returns the rewritten query, what changed, before/after cost, and index suggestions — ONLY suggesting a btree index when the filter is selective enough to help (an HNSW index for a vector target). Includes equivalence caveats. Pass target= in a multi-DB setup.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | ||
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the equivalence-caveat output, the btree-vs-HNSW index heuristic, and that improvement is proven by comparing planner cost rather than asserted. It never states whether the rewrite is applied or merely returned, and says nothing about required permissions or whether execution touches the target DB.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and the trigger condition, then the return contents. Dense and mostly waste-free, though the long multi-clause middle sentence about index suggestions is information-dense enough to slow reading.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so enumerating return fields (rewritten query, changes, before/after cost, index suggestions) is arguably redundant, yet the description still adds the equivalence-caveat and indexing-rule context. What remains missing is the read-only/apply question, which matters for a tool that inspects and rewrites SQL.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% with 2 parameters, so the description is the only source of meaning. It explains target adequately ('Pass target=<name> in a multi-DB setup'), but sql is left entirely implicit — no hint that it expects a concrete statement or what dialect/normalization is assumed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (rewrite a slow query into a cheaper equivalent) plus the verification method (EXPLAIN both, compare planner cost). It is clearly distinguishable from siblings like preflight_query, suggest_query, and explain_query_working. An agent can tell exactly what this tool produces without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the trigger condition: 'Call after a preflight flags a query expensive/dangerous,' which links it to preflight_query/preflight_vector_search. It also scopes the multi-DB case via target=<name>. It stops short of naming when NOT to use it or explicitly contrasting with suggest_query as the lighter-weight alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
suggest_queryA
Grade a query you (the agent) wrote for a user's data request and get
told whether to RUN it or REFINE it — the check step of generate->check->
refine. Workflow: (1) describe_schema_tool to learn columns + indexes,
(2) write a candidate for the user's intent, (3) call this. Returns
next_action: 'accept' (cheap/moderate — run it) or 'refine' (expensive/
dangerous — here are the high-severity flags + a VERIFIED cheaper rewrite;
fix and call again). You write the SQL; Anumana owns cost truth. Bound your
loop to ~3 rounds. Pass target= in a multi-DB setup.
| Name | Required | Description | Default |
|---|---|---|---|
| intent | Yes | ||
| target | No | ||
| candidate_sql | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does well: it discloses the return contract's semantics ('accept' = cheap/moderate, run it; 'refine' = expensive/dangerous with high-severity flags and a verified cheaper rewrite) and clarifies the division of labor ('You write the SQL; Anumana owns cost truth'). It omits error/auth conditions and whether the rewrite is applied automatically, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose, then the workflow, then the return semantics, with no filler sentences. It is dense with parentheticals and dash clauses, but each element (loop bound, multi-DB target, cost ownership) carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description need not enumerate return fields, and it still explains the meaning of next_action values. Given a 3-param tool with no annotations, the coverage of workflow, loop limits, and cost-ownership is nearly complete; only edge cases like malformed SQL or target resolution failures are unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, and it largely does: candidate_sql is framed as the query the agent wrote, intent as the user's data request, and target is given real meaning ('in a multi-DB setup'). It adds context the raw schema lacks, though it never states intent's expected format (natural language vs. structured).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('grade a query ... whether to RUN it or REFINE it') and positions the tool as the check step of a generate->check->refine loop. The agent can distinguish it from write-side siblings like rewrite_query and from schema-side siblings like describe_schema_tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit numbered workflow (describe_schema_tool -> write candidate -> call this), states the alternative branch ('refine' means fix and call again), bounds the loop to ~3 rounds, and tells the agent to pass target=<name> in a multi-DB setup. When-to-use and when-to-refine are both spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v0.2.0- First observed
describe_schema_tool - First observed
explain_query_working - First observed
list_policies - First observed
list_targets - First observed
preflight_query - First observed
preflight_schema_only - First observed
preflight_vector_search - First observed
rewrite_query - First observed
suggest_query
TDQS
Scored across 9 tools
The set has a dense cluster around cost-checking a query: preflight_query, suggest_query, and rewrite_query all assess/verify query cost and rewrite behavior, making it non-obvious which to call first (descriptions do disambiguate via the generate->check->refine framing). The preflight_* trio is well-separated by scope (SQL vs vector vs offline DDL), and explain_query_working is distinct as a teaching tool.
Most names follow a verb_noun pattern (list_targets, list_policies, rewrite_query, suggest_query) and the preflight_* prefix is consistent. However, describe_schema_tool adds a redundant '_tool' suffix and explain_query_working ends in '_working', breaking the pattern in two places.
Nine tools is well-scoped for a query cost-analysis/enforcement server, with each tool covering a recognizably distinct surface (targets, policies, three preflight variants, rewrite, explanation, schema, grading). No bloat or thinness.
The domain (analyze/grade/rewrite queries without executing them) is covered end-to-end: discover targets, inspect schema, learn policies, preflight SQL/vector/offline, rewrite, and explain. Minor gaps exist, e.g. no explicit connectivity/health probe or standalone equivalence-verification tool, but core workflows are complete.
Maintenance
Related MCP Connectors
Deterministic safety, correctness & cost gate that vets Postgres SQL before your AI agent runs it.
AI agents need permission before production SQL writes. Pilot $100 · Gateway $299. Lint≠authorize.
Query PostgreSQL databases in plain English — LLM-generated, safety-validated SQL.
Generate, fix, explain and run read-only SQL on PostgreSQL, MySQL and SQL Server
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnforces safety and governance for SQL queries executed by AI agents, providing read-only enforcement, cost estimation, and audit trails.Apache 2.0
- AlicenseAqualityDmaintenanceEnables AI agents to format SQL, explain queries in plain English, analyze schemas, build queries from natural language, and generate migrations, all without requiring a database connection.537 npmMIT
- AlicenseAqualityAmaintenanceLets AI agents estimate the cost and result size of BigQuery and Snowflake queries before they run, then execute them only within per-call byte, row, and dollar bounds. Estimates are labeled with an accuracy tier so agents never over-trust an approximate figure.456 PyPI1MIT
- AlicenseAqualityAmaintenanceEnables AI agents to query Trino and Apache Pinot lakehouses under enforced governance, where every SQL statement is AST-validated, table-allowlisted, priced from the engine's own plan before it runs, and blocked or admitted against scan-byte and intermediate-row budgets. It also grounds agents with schema discovery tools, returns verified results with warnings instead of misleading answers, and records every tool call on an audit trail.3Apache 2.0