Environment

First-run setup

checking
Checking IAM

Bootstrap

Configure this TrinoHub AMI

Step 1 of 5
  1. Status
  2. Admin
  3. AWS
  4. Network
  5. Review
Instance profile Checking metadata
SQLite store Ready .trinohub/trinohub.sqlite3
UI network Pending set allowed CIDRs
No AWS access keys stored

The control plane uses the EC2 instance profile and passes a node role to cluster instances.

First admin admin
AWS region us-east-1
Cluster networking Private subnets, allowlisted UI
Credential model Instance profile only
Name Status Instance type Trino Region Workers Autoscaling Auto-suspend Owner Actions

Cluster configuration

Create Trino cluster

Instance type

Loading instance types…

Acceleration

Workers

Catalogs

Cluster

lakehouse-prod

Running
Active workers - No live capacity loaded
Running queries - No queue sample loaded
CPU - No CloudWatch sample loaded
Auto-suspend - Configured interval
Est. cost - Coordinator + workers, approx

Cluster resources

AWS managed
No AWS resources loaded

Utilization

No data yet

No utilization samples yet. Data appears after the autoscaler takes its first reading.

Recent scaling events

Time Event Signal Capacity
No scaling events loaded.

Catalogs

Data sources

IAM validated

Curation

Data products

A data product is a documented bundle of tables and views. AI clients find them by keyword through the search_data_products MCP tool, so a good summary is what makes the right data discoverable. Publishing one describes data — it never widens who can read it.

Product Location Owner Assets Tags Actions
No data products yet.

Curation

Query templates

A template publishes one parameterized query as a callable MCP tool. Clients supply typed values through run_query_template and never write SQL, so this is how you hand an agent a specific question rather than the run of the warehouse. Write holes as {{name}} in the SQL and declare each one below.

Template Cluster Parameters Status Actions
No query templates yet.
Ready Elapsed 0.0s · Rows 0
Run a query to see results.

Notebooks

Your notebooks

No notebooks yet. Create one to get started.

Ask Trino is new to the job and may make mistakes while learning about your data and organization. Double-check the responses.

Endpoint

Connect an AI client

Checking

TrinoHub speaks the Model Context Protocol, so Claude and other MCP hosts can search your data products, browse catalogs, and run read-only queries — acting as you, under your own grants and data policies.

If you have restricted access in Settings → Allowed UI CIDRs, the machine running the MCP client must fall inside that list too — the endpoint is gated by the same allowlist as the rest of the app.

Clients that discover authentication rather than take a pasted token can read /.well-known/oauth-protected-resource, which an unauthenticated call is pointed at. It advertises your configured SSO issuer as the authorization server, so set up Settings → SSO if you want OAuth-only hosts to connect.

Step 1

Get an API token

An MCP client authenticates with a tht_ API token and inherits the privileges of whoever owns it. Use a token for a low-privilege user or a service account if the client should only see part of your data.

Settings → API tokens. The token is shown once, at creation.

Step 2

Configure your client

Step 3

Available tools

Read live from this TrinoHub's tools/list, so it reflects exactly what a connected client will see. Arguments marked * are required.

Boundaries

What a client can and cannot do

  • Browse catalogs, schemas, tables, and columns on clusters you can reach, and search the data products you have been granted.
  • Run a single read-only SELECT, SHOW, DESCRIBE, or EXPLAIN and read the rows back, capped to 100 KB so a result cannot swamp the model's context.
  • Run a query template you have published, supplying typed parameter values that are validated and escaped before they reach the SQL.
  • Write, update, or delete anything — every statement passes the same read-only check as Ask Trino before it reaches Trino, and EXPLAIN ANALYZE is refused because it executes what it explains.
  • See clusters, catalogs, or rows its token's owner is not granted. Row filters and column masks still apply.
  • Manage clusters, users, or settings — no control-plane tools are exposed.

Query history

Recent activity

Status Query Cluster User Elapsed Rows

Automation

Scheduled SQL jobs

Job Cluster Schedule Runs as Last run Next run Actions
No scheduled jobs yet.

Access

Local users

User Email Role Status Actions

Access

Roles

Role Privileges Cluster access Catalog access Members Actions

Data security

Data policies

Table/column/row-level restrictions per role, enforced inside Trino via file-based access control. Users in roles with policies are limited to exactly those policies; everyone else keeps full access. Applied when a cluster (re)starts.

Role Scope Privileges Columns Row filter Actions
No data policies.

Data security

Tags & classification

Entity Tag Status Source Actions
No tags.
Tag Role Effect Actions
No tag policies.

AWS configuration

Loading
Region-
VPC-
Node profile-
UI CIDRs-

Comma-separated CIDRs allowed to reach the UI (for example 203.0.113.22/32, 198.51.100.0/24). Leave blank to allow any source your security group admits. Lists that would block your own address are rejected unless you confirm.

Cluster connectivity

Not set

Base domain for client connection strings. Each cluster is addressed as <cluster-name>.<base-domain> over HTTPS/443. TrinoHub only renders the name — point a wildcard *.<base-domain> DNS record at your coordinators. Leave blank to show the coordinator IP instead.

Node instance types

0 selected

Memory-optimized types recommended for Trino. Only enabled types appear on the Create cluster screen.

Loading instance types…

API

OpenAPI
Interactive docs Open docs
Schema Open JSON

Single sign-on (OIDC)

Disabled

Authorization-code flow against any OIDC provider (Okta, Entra ID, Google). IdP groups map to TrinoHub roles on every sign-in.

Sessions

12 h

Browser session lifetime. Shortening it does not revoke existing sessions — use "Sign out everywhere" to force re-authentication now.

Result cache

10 min

Identical read-only re-runs within this window are served from the stored result set instead of contacting the cluster. Results are point-in-time snapshots, cached per user. Set to 0 to disable.

Notifications

Off

JSON webhook (Slack-compatible text field) fired on the selected events. Leave the URL blank to disable.

Ask Trino

Default

The OpenRouter model Ask Trino uses to write SQL. Paste any model id from openrouter.ai/models (for example anthropic/claude-sonnet-4.5). Leave blank to use the built-in default. The OPENROUTER_API_KEY stays in the server environment and is never shown here.

API tokens

Long-lived bearer tokens for scripts and BI tools: send Authorization: Bearer <token> to any /api/* endpoint. A token acts as its user and inherits that user's roles. Create service accounts in the Users view for automation identities.

Name User Created Expires Last used Actions
No tokens.

Security audit log

-
When Actor Action Target Detail
No entries loaded.
Select a topic to begin.