pod
Other formats agents might prefer:
markdownjsonllms.txt

Agent? You probably want markdown or json, or Pod over MCP.

Reported issues for mcp-trino

Pod holds 22 of 24 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to mcp-trino.

Most discussed

Support for basic auth

Where users are replying their own MCP server locally it should be possible and documented to support trino clusters using basic authentication by providing a password as environment variable.

Read the thread · 2026-02-20 · open · external user · 1 comment

Decimal(38,10) columns silently dropped from SELECT * query results

Hi,

when querying a PostgreSQL through Trino that contains decimal(38,10) columns, the MCP server silently drops these columns from the result set. No error is returned — the columns simply don't appear in the JSON output.

Steps to reproduce:

Have a PostgreSQL view with a numeric(32,10) column (maps to decimal(38,10) in Trino)

Query via MCP execute_query:

SELECT * FROM catalog.public.my_view LIMIT 1;

-- Result: amount column is missing from JSON output

**Workaround — casti

Read the thread · 2026-02-06 · closed · external user · 1 comment

Feat: document setup with LibreChat

I am trying to use this MCP with LibreChat as client: https://github.com/danny-avila/LibreChat

I am having a lot of trouble getting the oauth to work. For context: I am using Azure AD for oauth in an enterprise context.

This might be a lot to ask, but would it be possible for you to add some documentation on how to configure the MCP in LibreChat?

Read the thread · 2025-10-30 · closed · external user · 1 comment

Token validation failed

I can connect to mcp server, but token verification failed.

OAuth: Validating token for tool list_catalogs: hJYK6wSu5afG9JMBjK0QOHddo+q69rnzYF9OGR7EDQM= 2025/09/05 10:56:56 OAuth: Token validation failed for tool list_catalogs: failed to parse and validate token: token is malformed: token contains an invalid number of segment

Read the thread · 2025-09-05 · closed · external user · 2 comments

SSL Verify

is it possible to skip TLS verify for internal dev and testing? What would be the env variable to use for this?

setting TRINO_SSL_INSECURE=true does not work and the cert is still verified ( Eg:- I get hostname verification errors

docker run -i --rm -p 8080:8080 -e -e TRINO_SSL_INSECURE=true -e MCP_TRANSPORT=http -e TRINO_ALLOW_WRITE_QUERIES=false -e TRINO_HOST=mytrinoserver -e TRINO_PORT=443 -e TRINO_USER=user -e TRINO_PASSWORD=password -e TRINO_SCHEME=https ghcr.io/tuannvm/mcp-trino:l

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/88) · 2025-08-25 · open · external user · 6 comments

### OAuth doesn't work with Claude Code

I tried both Google OAuth and HMAC OAuth. The configurations work in Cursor, but not in Claude Code.

Working Cursor config:

{ "mcpServers": { "mcp-trino-https": { "url": "https://remote-server.example.com:9096/sse", "headers": { "Authorization": "Bearer " } } } }


To note: Not using in localhost mode, the MCP Go Server sits on another publically accessible machine

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/75) · 2025-08-07 · closed · external user · 2 comments

### brew install fails - Error: mcp-trino: Failed to download resource "mcp-trino"

% brew tap tuannvm/mcp
==> Tapping tuannvm/mcp
Cloning into '/opt/homebrew/Library/Taps/tuannvm/homebrew-mcp'...
remote: Enumerating objects: 108, done.
remote: Counting objects: 100% (108/108), done.
remote: Compressing objects: 100% (60/60), done.
remote: Total 108 (delta 43), reused 89 (delta 28), pack-reused 0 (from 0)
Receiving objects: 100% (108/108), 29.60 KiB | 866.00 KiB/s, done.
Resolving deltas: 100% (43/43), done.
Tapped 3 formulae (17 files, 57.1KB).
% brew install mcp-trino
==> Dow

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/56) · 2025-07-02 · closed · external user · 2 comments

### Enhancement Request: Support Trino OAuth2 Authentication

Our Trino instance uses OAuth2 authentication by setting the `externalAuthentication` JDBC property to `true`.

Are there plans for the MCP to support this type of authentication?

Thank you

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/52) · 2025-06-11 · open · external user · 9 comments

## Most recent

### Looks like the arm64 container has an x86 binary

I'm getting `exec ./trino-mcp: exec format error` when I run the helm chart against Bottlerocket arm64 nodes
the tag I'm using is `4.3.1@sha256:7f74a66e97221a452ca900ba9d958db9b0867c0be85f65bad1322615923a8b6d` which correlates to the arm64 tag here:
https://github.com/tuannvm/mcp-trino/pkgs/container/mcp-trino/772251807?tag=4.3.1

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/219) · 2026-08-01 · open · external user · 1 comment

### OAuth scopes not configurable → `scopes_supported` omitted → Google (and strict IdPs) reject authorization with "Missing required parameter: scope"

## Summary

When OAuth is enabled with an IdP that **requires a `scope` parameter** on the authorization request (e.g. Google), the interactive OAuth flow fails: mcp-trino never advertises `scopes_supported` in its RFC 9728 protected-resource metadata and provides no way to configure OAuth scopes. MCP clients (e.g. Claude Desktop/Code) derive the scopes to request from that metadata — with it absent they send **no `scope`**, and Google rejects the request:

Error 400: invalid_request — "Miss

Read the thread · 2026-07-21 · open · external user · 0 comments

feat: support configurable OIDC scopes via OIDC_SCOPES env var

Problem

When using OAUTH_MODE=proxy with providers like Okta or Azure AD that require offline_access to issue refresh tokens, there is no way to configure which OIDC scopes mcp-trino requests. The scopes are hardcoded inside oauth-mcp-proxy, so users cannot add the scopes their IdP needs.

This blocks refresh-token-based flows in proxy mode — the access token expires and the client must re-authenticate from scratch.

Proposed Solution

Introduce an OIDC_SCOPES environment variable

Read the thread · 2026-06-05 · open · external user · 0 comments

Private security disclosure route?

Hi, I have a security report for this project and did not find an enabled GitHub private vulnerability reporting route or SECURITY.md contact.

Could a maintainer enable GitHub private vulnerability reporting or share the preferred private disclosure channel? I can provide the full technical details there.

Thanks.

Read the thread · 2026-05-20 · open · external user · 0 comments

fix: persistent OAuth state signing key

Context

MCP Trino logs on startup: ``` [WARN] No state signing key configured, generating random key (will not persist across restarts) ```

This means OAuth state parameters are invalidated on every pod restart, causing in-flight auth flows to fail with "state does not match" errors.

Related: #155

Current behavior

Random signing key generated per process start. Pod restarts or rolling deploys break active OAuth flows.

Desired behavior

Read signing key from env var `OAUTH_S

Read the thread · 2026-05-07 · closed · external user · 1 comment

feat: audit logging with OAuth user identity

Context

MCP Trino with OAuth enabled knows WHO is running each query (email, groups, roles from JWT). Currently this identity is used only for impersonation — it should also be logged for audit purposes.

Desired behavior

Every query execution logs:

  • User email/subject from JWT
  • Groups from JWT
  • Query text (truncated to 200 chars)
  • Timestamp
  • Duration
  • Row count
  • Success/failure

Log format: structured JSON via slog (already used throughout codebase).

Example:

{"level":"I

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/201) · 2026-05-07 · closed · external user · 0 comments

### feat: group-based catalog allowlist

## Context

With Keycloak groups mapped to JWT `groups` claim, MCP Trino can restrict which Trino catalogs each group can access.

## Current behavior

All authenticated users see all catalogs (`No Trino allowlists configured, all catalogs, schemas, and tables are accessible`).

## Desired behavior

Configure catalog access per group via environment variable or config:

TRINO_GROUP_CATALOG_MAP=data-analysts:lake_curated,lake_landing;finance:finance_prd,finance_sbx;data-engineers:*;engineerin

Read the thread · 2026-05-07 · closed · external user · 0 comments

feat: role-based write query enforcement via JWT claims

Context

MCP Trino has TRINO_ALLOW_WRITE_QUERIES as a global toggle. With Keycloak OAuth now active (lastro-internal realm), we can enforce write access per-user based on JWT role claims.

Current behavior

  • TRINO_ALLOW_WRITE_QUERIES=false → blocks ALL write queries for ALL users
  • TRINO_ALLOW_WRITE_QUERIES=true → allows ALL write queries for ALL users

Desired behavior

  • Users with mcp-readonly role (default) → read-only queries only
  • Users with mcp-admin role → write qu

Read the thread · 2026-05-07 · closed · external user · 0 comments

MCP in Claude desktop failing with failed to verify signature: failed to verify id token signature

HI

I have beed to trying to add this trino mcp in claude desktop with oauth flow using azure as provider.

I have set below env variables in my deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: trino-mcp
  namespace: etl
spec:
  replicas: 1
  selector:
    matchLabels:
      app: trino-mcp
  template:
    metadata:
      labels:
        app: trino-mcp
    spec:
      containers:
        - name: trino-mcp
          image: ghcr.io/tuannvm/mcp-trino:latest
          ports:
 

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/191) · 2026-04-22 · open · external user · 0 comments

### Request: Let CLI flags work when starting the MCP server

Hi! I’ve been using `mcp-trino` version 4.3.0 on Windows, and I really appreciate the CLI mode and profile-based configuration.

I noticed that in the new supported configuration, customized profiles in `~/config/trino/config.yaml` and flags like `--host`, `--port`, `--catalog`, `--user`, and `--password` work well for CLI commands, but they don’t seem to apply when starting the MCP server itself.

Right now, running the server in HTTP mode always requires environment variables. It would be grea

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/173) · 2026-03-27 · open · external user · 0 comments

### Cannot access catalog memory

I got 

`"failed to list tables: query execution failed: trino: query failed (200 OK): "USER_ERROR: Access Denied: Cannot access catalog memory": failed to list tables: query execution failed: trino: query failed (200 OK): "USER_ERROR: Access Denied: Cannot access catalog memory""`

when i sue list_tables tool

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/166) · 2026-03-18 · open · external user · 0 comments

### Incorrect sanitizeQueryForKeywordDetection when sql start with like "-- comment\n "

In trino/client.go, the isReadOnlyQuery function processes the query in this order:

  1. Replace \n with spaces
  2. Call sanitizeQueryForKeywordDetection() to remove comments

  The problem is that sanitizeQueryForKeywordDetection uses the regex --[^\r\n]* to match single-line
  comments, which relies on \n as the terminator. After step 1 replaces all \n with spaces, the -- comment
   regex matches from -- all the way to the end of the string (since there's no \n to stop it),
  effectively rem

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/161) · 2026-03-09 · open · external user · 0 comments

### State does not match - when refreshing token

Hey folks 👋

I’ve deployed the server to a Kubernetes cluster and overall everything seems to be working fine.

We’re using OAuth with Okta in our setup. The initial login flow works successfully.

"mcp-trino-http": { "url": "https://mcp-trino.qa.xxx.io/mcp" }


After the access token expires, VS Code prompts me again to open the browser for re-authentication. I accept, but during the callback step VS Code shows the following error:
**State does not match**

<img width="1385" height="

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/155) · 2026-02-11 · open · external user · 0 comments

### Expedia Group Adoption of MCP Trino

Hello maintainers,

I’m reaching out from Expedia Group. I’m a developer on the Analytics Platform team, and we’ve decided to adopt this MCP Trino project for use with our Trino clusters.

We may also contribute improvements or fixes back to the project as we integrate it. Please let us know if there are any preferred contribution workflows not outlined in the Contributing section, roadmap priorities, or areas where help would be most valuable.

[Read the thread](https://github.com/tuannvm/mcp-trino/issues/152) · 2026-02-04 · open · outside contributor · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/tuannvm/mcp-trino/issues).