Steampipe for coding agents

When a coding agent needs information about cloud or SaaS resources, Steampipe lets it use SQL, a language for querying data, to ask providers about their resources. Steampipe plugins connect provider service APIs to database tables, which SQL queries use to retrieve data. Steampipe gets the data from the provider's API when a query asks for it and keeps the results in a short-lived query cache. The Steampipe MCP server connects an agent to the tables through the Model Context Protocol (MCP), a standard interface that lets agents call external tools.

For example, ask an agent to inspect AWS S3 buckets and summarize the results. The agent can find the available tables, run a query that only reads data, and report what it returns. Steampipe plugins support the same kind of query for other services.

Connect an agent to Steampipe

To run Steampipe locally, you need Steampipe itself and the plugin for the service you want to inspect. The MCP server also needs Node.js version 16 or higher and a running Steampipe service. You can connect the server to a Turbot Pipes workspace with a connection string instead. The Steampipe MCP repository explains how to configure the server for an agent and describes the connection options.

For a local AWS example, install Steampipe with Homebrew on macOS, then install the AWS plugin. The Steampipe README has an install script for Linux and for Windows through WSL2.

brew install turbot/tap/steampipe
steampipe plugin install aws

Set up AWS credentials outside the agent prompt. The AWS plugin page says the plugin finds credentials and the region the same way the AWS CLI does, unless you set them in its aws.spc config file. By default it queries a single region. These credentials let Steampipe access AWS APIs, so grant them only the permissions needed to list the resources in your inventory query. Then start Steampipe on your machine:

steampipe service start --database-listen local

The --database-listen local flag from the service reference accepts database connections from this machine only.

Add the MCP server to your coding agent’s MCP configuration. The MCP setup page uses the @turbot/steampipe-mcp npm package. By default, the server connects to the local Steampipe service at postgresql://steampipe@localhost:9193/steampipe. Check the repository’s current instructions if your agent uses a different configuration location or format.

{
  "mcpServers": {
    "steampipe": {
      "command": "npx",
      "args": ["-y", "@turbot/steampipe-mcp"]
    }
  }
}

For a Turbot Pipes workspace, the documentation adds the workspace connection string as a further item in args. The MCP server runs on the same machine as your agent. Keep credentials out of the prompt and source code. A Turbot Pipes connection string contains a password, so store it in the agent’s protected configuration instead of committing it to a repository.

Query bucket inventory

The MCP server provides tools to list tables, show the columns in a table, and run SQL queries that only read data. They are called steampipe_table_list, steampipe_table_show and steampipe_query. For an inventory, ask the agent to inspect the AWS bucket table first. Then it can use the table structure provided by the installed plugin instead of guessing the column names.

A prompt for the agent could be:

Use Steampipe to inspect the AWS S3 bucket table, then run a read-only query that returns up to five rows. Tell me which columns you used and summarize only what the query results show. Do not change AWS resources.

The agent can use the tools to list tables and inspect their columns. After checking what is available, it can send SQL like this to the query tool, which only reads data:

SELECT name, region, account_id
FROM aws_s3_bucket
LIMIT 5;

The query returns up to five bucket records with the name, region and account_id columns. The aws_s3_bucket table page lists these columns and many more. The MCP server's own guidance is to request only the columns you need. The rows depend on the AWS account and credentials you configured for Steampipe, so the output varies. If the installed plugin does not have that table name, the agent should use the table-list tool to find the AWS bucket table it provides before querying.

You install the plugin and start Steampipe on your machine. When the rows are not in the cache, the SQL query sends network requests to AWS to retrieve current data. The MCP server’s query tool only reads data, so this example does not change AWS resources. Steampipe’s documentation explains how to set up the command-line tool and service.

Account for live API limits

Steampipe queries fetch data from service APIs, so a query that is not answered from the cache sends API requests. A query across many accounts or resources takes longer and can hit provider rate limits, which restrict how many requests a provider accepts. Steampipe lets you set limiters in a plugin's config file to limit how many requests run at once and how many start each second. Keep the agent’s query focused by using filters and limits. The caching guide says results stay in the cache for 300 seconds by default, so a repeated query in that window can return the cached rows instead of fresh data.

A Steampipe query shows what the provider returns now. It cannot show what a bucket’s configuration looked like last week unless someone saved that data at the time. Steampipe can save query results as snapshots, either to a local file or to Turbot Pipes. A snapshot is a saved copy of query results from a point in time. For recurring analysis or comparisons with past data, save snapshots regularly or use a data pipeline that stores the results.