Bricks that install on their own, on what you already have.

A brick is a repository, a package, an installation guide and a proof script. It installs on an existing Trino, directory and catalogue, and asks for neither the AKKO platform nor another engine.

Available · 0.3.0 · Apache 2.0

akko-mcp-trino

The governed MCP server for Trino. Every tool call carries the user's identity; Trino and its policy engine decide. Nine read-only tools, catalogue discovery, semantic context for the model (Trino comments, a file, OpenMetadata), two principals, quotas, audit, revocation.

Documentation Source code PyPI

$ pip install akko-mcp-trino

260tests, 100 % coverage
8replayable proofs on a real cluster
3transports: streamable-http, sse, stdio
2identity modes: impersonation, JWT passthrough

How it works

The functional proof, as it prints

tests/proofs/akko-mcp-trino-live-proof.sh

== 3. Verifications depuis le pod ==-- RFC 9728OK    metadonnees sans jeton200OK    authorization_servers = emetteurhttps://keycloak…/realms/akkoOK    401 porte resource_metadataTrue-- double identiteOK    sans cle agent : refus nomme401/agent_key_missingOK    cle inconnue : refus nommeagent_key_unknownOK    cle ok, sans jeton401/unauthenticatedOK    jeton forge401-- deux comptes, deux reponses (core_postgres.clients.customers)OK    alice : emails en clairTrue (6 lignes)OK    carol : emails masquesTrue (3 lignes)OK    carol : pays["FR"]-- quotasOK    429 une fois la fenetre pleineTrueOK    Retry-After + raisonrate_limited/N-- revocationOK    jeton deconnecte refuse401/revoked-- jointure d'audit (journal du pod)OK    ligne d'audit aliceexecute_query alice_admin cursor True TrueOK    jamais le jeton dans l'audit0== PREUVE OK ==  21/21

Open source soon

akko-lab

The platform lab: JupyterHub notebooks, code environments and model tracking, with data access governed like everything else. It will be published on the same model as akko-mcp-trino: a repository, a package, proofs.

Planned

Identity broker

Token exchange between providers (RFC 8693): a Keycloak user becomes an identity accepted by a Kerberised Trino or by Ranger, without a shared account.

Planned

Policy sync

A classification set in the catalogue (OpenMetadata) becomes a policy in Ranger or OPA, and a refusal in the engine.

Planned

Benchmark

Two accounts, two answers, on your engines: the proof that governance holds, replayable by a third party.

Licences

What is open, and under which licence.

Published bricks

Apache 2.0. akko-mcp-trino and its OpenMetadata provider are published today; akko-lab will follow. Code on GitHub, packages on PyPI, replayable proofs with the code.

Upstream components

Trino, Iceberg, OpenMetadata, Airflow, Spark, Superset, JupyterHub, MLflow, Keycloak, OPA are open source projects that AKKO installs and wires without forking them.

The platform and the control plane

Delivered under an Enterprise licence, with installation, updates and support. The installation documentation is public.

Is the AKKO platform open source?: No. The platform stays under an enterprise licence. akko-mcp-trino is the first brick published under Apache 2.0, because governed access for AI agents is useful to the whole Trino ecosystem; akko-lab will follow on the same principle.
Can I use a brick without AKKO?: Yes. Every published brick installs on its own, on your Trino, your directory and your catalogue, and never requires the platform.

Try a brick, or talk to us.

Install akko-mcp-trino in one command, replay the proofs, and tell us what is missing.

Read the documentation Request a demonstration