Model Context Protocol moderate risk

Trino

MCP server for Trino, enabling AI assistants to interact with Trino's distributed SQL query engine via standardized tools and optional OAuth 2.1 authentication.

Connections & Capabilities

Connects To

GitHubPostgreSQLMySQLMongoDBDockerAzureS3

Capabilities

readwriteexec

Quickstart

Install

brew install mcp-trino

Config

{
  "mcpServers": {
    "mcp-trino": {
      "command": "docker",
      "args": ["run", "--rm", "-i",
               "-e", "TRINO_HOST=<HOST>",
               "-e", "TRINO_PORT=<PORT>",
               "-e", "TRINO_USER=<USERNAME>",
               "-e", "TRINO_PASSWORD=<PASSWORD>",
               "-e", "TRINO_SCHEME=http",
               "ghcr.io/tuannvm/mcp-trino:latest"],
      "env": {}
    }
  }
}

Exposed MCP Tools (6)

high

execute_query

Executes a SQL query against the Trino cluster.

Can modify or expose sensitive data depending on the query and user permissions.

safe

list_catalogs

Lists available catalogs in the Trino cluster.

Read-only operation that reveals catalog names.

safe

list_schemas

Lists available schemas within a specified catalog.

Read-only operation that reveals schema names.

safe

list_tables

Lists available tables within a specified schema.

Read-only operation that reveals table names.

safe

get_table_schema

Retrieves the schema of a specified table.

Read-only operation that reveals table structure.

safe

explain_query

Explains the execution plan of a SQL query.

Read-only operation that analyzes query execution.

Safety Assessment

This MCP server provides a controlled interface to Trino. It is relatively safe when used with read-only queries and proper OAuth configuration. Enabling user impersonation and allowing arbitrary SQL execution increases the risk significantly.

Optional OAuth 2.1 authentication with multiple providers (Okta, Google, Azure AD).
Supports both native and proxy OAuth modes for varying client capabilities.
Allows restricting AI focus to specific schemas for performance and security.
Includes query attribution by tagging queries with OAuth user information.

Executes SQL queries, potentially leading to data modification or information disclosure.
User impersonation feature, if enabled, relies on Trino's permission system.
Secrets management for proxy mode OAuth requires careful handling.
Vulnerable to SQL injection if queries are not properly sanitized.