Mudit Kapoor

Software engineer by day. Building my own things at night.
First one: @lagaamdev 🐎

[Mudit Kapoor @mudit_builds]

Trino can't stop this before it runs:

SELECT ... FROM orders CROSS JOIN lineitem LIMIT 10

Reads 0.7 MB, builds 902M rows. Scan caps pass it, LIMIT hides nothing, the shared cluster stalls.

Agents write this by accident. Lagaam refuses it pre-execution.

https://t.co/h1oaEyRcto

[Mudit Kapoor @mudit_builds]

@sagar_batchu @UberEng @speakeasydev Agree the gateway is the right choke point. The part I keep hitting: identity has to narrow per hop. User → agent → tool should each get a smaller grant than the one before, not the user's full scope copied along. Otherwise the gateway knows who, but not how much.

[Mudit Kapoor @mudit_builds]

@andrewqu And once the trench coat comes off, the agent is querying your database directly. Learned this building an MCP server for Trino: the scary query isn't malicious, it's a cross join with LIMIT 10 that reads 0.7 MB and builds 900M rows. Cost has to be checked before it runs.

[Mudit Kapoor @mudit_builds]

@fr0gger_ The "don't read it, don't ask" line is the tell. Text inside a repo should never be able to lower the agent's own confirmation bar. "Run this unreviewed script" should hit the same gate whether it comes from CLAUDE.md or a stranger in an issue.

[Mudit Kapoor @mudit_builds]

@dsp_ Great to see. Which properties are you going after first: the protocol state machine (nothing before initialize, etc.) or the auth flows? Auth feels like where a proof would pay off most, since that's where SDKs quietly drift from the spec.

[Mudit Kapoor @mudit_builds]

@Jhaddix Agree. Model safety lowers the base rate, but the chain still works because every step uses access the agent already had. The fix that holds up is boring: scope what each tool call can touch, so a successful injection lands somewhere small.

[Mudit Kapoor @mudit_builds]

Each Claude project's memory is an island. My open-source project and its launch planning live in separate projects, so I exported one's memory as a file and uploaded it into the other.

Would love read-only cross-project memory, or parent/child projects sharing one. @claudeai

[Mudit Kapoor @mudit_builds]

Fix: charge a live segment at the row count where it seals.

My first fix read that from table config. I lowered it from 100 to 10, the live segment kept 100, and I quoted 110 rows for a query that scanned 170.

Now it reads the segment's own value.

https://t.co/h1oaEyRcto

[Mudit Kapoor @mudit_builds]

My cost check trusted a number that said 0.

Pinot's live segment, the one taking new writes, reports 0 rows. I checked 10 times in 30 seconds. It had 50.

Believe that and the newest data is free to query. That's the data people run Pinot for.

[Mudit Kapoor @mudit_builds]

@nssalian "Trino read-only, writes only through Spark" is the underrated part. When only one path can change data, the rest of the platform gets much easier to reason about. Did ad hoc Trino ever slow down the scheduled stuff, or did it have its own cluster?

[Mudit Kapoor @mudit_builds]

@thomas_rehmer The SUPABASE_DB_PASSWORD gap is the line that matters. A scoped token only helps if the agent never sees the raw connection string, because that path skips every check the MCP server does. One token per agent also gets you an audit trail for free.

[Mudit Kapoor @mudit_builds]

@JoshARosen The receipts turn into a data problem fast. After a few hundred runs you want every tool call as a row you can query: which agent, what it ran, what it cost, what got refused. Otherwise "show your work" is a long log nobody reads.

[Mudit Kapoor @mudit_builds]

@fatalbagel @mmitchell_ai If that's the one I'm thinking of, it's the same root cause: credentials the agent never needed for its task.

[Mudit Kapoor @mudit_builds]

@AMdatalakehouse One assertion I'd add if agents will query the output: table stats exist and are fresh. Without them the engine can't estimate what a query will cost, so anything that prices queries upfront has to either guess or refuse.

[Mudit Kapoor @mudit_builds]

@therealdanvega The LiteLLM one stings because the proxy holds every model key you have. Pinning helps, but scoped, short-lived keys per service are what stop a compromised proxy from turning into a compromised account.

[Mudit Kapoor @mudit_builds]

@DanKornas Filtering the schema by grants before the prompt is built is the right layer. The other half is cost: an agent can write correct SQL that's far too expensive for a shared cluster. Accuracy and cost need separate checks.

[Mudit Kapoor @mudit_builds]

@mmitchell_ai Those database wipes are the clearest case. The agent had permissions that made it possible at all. Read-only creds plus an AST check that rejects DDL before execution turns that into a failed tool call instead of an incident, whatever the prompt said.

[Mudit Kapoor @mudit_builds]

What it does per query: sqlglot AST check (single SELECT, no DDL/DML, no SELECT *), per-agent table allowlist, EXPLAIN (TYPE IO) for bytes + EXPLAIN (TYPE LOGICAL) for widest-step rows, budget gate, audit line.

Trino + Pinot. uvx lagaam, or in Claude Code: /plugin install lagaam@lagaam

11/11 bad agent queries caught pre-execution in the benchmark, the well-scoped one runs untouched.

[Mudit Kapoor @mudit_builds]

Trino can't stop this before it runs:

SELECT ... FROM orders CROSS JOIN lineitem LIMIT 10

Reads 0.7 MB, builds 902M rows. Scan caps pass it, LIMIT hides nothing, the shared cluster stalls.

Agents write this by accident. Lagaam refuses it pre-execution.

https://t.co/h1oaEyRcto

[Mudit Kapoor @mudit_builds]

@simonw Sandboxes cover what the agent's process can touch. The gap I keep hitting is one level up: a sandboxed agent with a read-only DB user can still send a valid SELECT that stalls a shared warehouse.

[Mudit Kapoor @mudit_builds]

@Bozos Same pattern on the cost side: valid SQL, wrong price. I measured a cross join on Trino that reads 0.7 MB and would build 902M rows. "It ran" is a weak check for accuracy and for cost.