Starburst has written a careful definition of agentic analytics, and the best paragraph in it is about MCP. In What Is Agentic Analytics?, the Trino company argues that an analytical agent “plans, queries, iterates, and can act,” and that its common failure is missing business context: an agent that does not know churn means “a cancellation within 30 days” queries the support table instead of subscriptions, and “the numbers look plausible, but the answer is wrong.” The line worth keeping: “Better models don’t fix missing definitions.”
The post carries no market figures, so there is nothing to discount except the product pitch. The governance advice is the substance: enforce read-only access on the query path, apply RBAC and ABAC, log audit trails from day one, and align Iceberg snapshot expiration with compliance policy “so that past agent queries can be accurately reconstructed.” On MCP it is blunt: “its protocol-level read-only signals are purely advisory. True security depends entirely on what the server enforces.” Starburst says it enforces that server-side by parsing every request through the Trino SQL parser and rejecting writes before execution, and that it exposes its context layer “to external agents through an MCP endpoint.” That claim is specific and checkable, which is to its credit.
The catalog cannot yet check it. The Starburst provider page holds one API page, the Starburst Galaxy REST API, which the catalog describes as an OAuth2 client-credentials API for clusters, catalogs, users, roles, privileges, access policies, data products and SQL jobs. That is the management surface for the data products and access policies the post tells readers to build first. The MCP endpoint and AIDA, the agent the post holds up as the pattern, do not appear as API pages, and there is no agentic access profile.
Starburst scores 37.8 on the Kin Score, thin band. Discoverability is 73.2 and developer ergonomics 64.3; contract quality is 0.0 and contract governance 4.5. Agent Readiness is 2.5, human-only: auth clarity is the only lit dimension, and spec presence, agentic access and MCP server are all unlit. A company that writes “true security depends entirely on what the server enforces” understands better than most that an agent can only trust what it can read. Its MCP endpoint is, by its own account, real. Until it is published where a crawler can find it, the public record measures Starburst as a platform agents cannot reach.