Provides AI clients with safe, structured access to SQLite databases using tools for SQL execution and schema searching.
Also known as arifulislamat/database-mcp, @database-mcp/sqlite
- Stars
- 5
- Tools
- —
- Downloads, 30 days
- 905
- Latest version
- 0.5.0
- Last commit
- Nov 1, 2026
- License
- MIT
What is database-mcp-sqlite MCP?
database-mcp-sqlite provides AI clients with safe, structured access to SQLite databases using tools for SQL execution and schema searching.
Summary generated from the project's README
About database-mcp-sqlite MCP server
Giving AI clients structured and secure access to SQLite databases is the primary function of this server. It provides a minimal interface consisting of two specific tools: execute_sql for running queries and search_objects for exploring the database schema. This setup ensures the model's context window remains clean by using progressive disclosure, where calling search_objects without arguments lists tables, and adding a table name reveals columns, indexes, and foreign keys.
Developers can implement this using TypeScript via npm, Python through PyPI, or as a native Rust binary. Security is a core focus, featuring a read-only mode enforced by both SQL guards and database session settings. To prevent runaway processes or excessive data usage, the server includes default row caps of 1000 and statement timeouts of 30 seconds. Connection details like the DSN are configured at launch through flags, environment variables, or YAML files rather than through chat prompts, ensuring credentials remain protected and are never accepted via tool calls.
What you can do with it
- 1Explore database schemaAn AI can discover the structure of a database by listing tables and then inspecting specific columns or foreign keys.
- 2Execute SQL queriesA developer can instruct an AI to run specific SQL commands against a local SQLite file.
- 3Prevent resource exhaustionThe server automatically limits the amount of data returned and the time a query can run to protect the system.
Written from the project's README. Every use case is checked against a quote from it.
How to install database-mcp-sqlite MCP
Formats verified 10 Nov 2026Install database-mcp-sqlite MCP in Claude Code
$ claude mcp add --env SQLITE_PATH=<SQLITE_PATH> database-mcp-sqlite -- npx -y @database-mcp/sqliteInstall database-mcp-sqlite MCP in Cursor
~/.cursor/mcp.json
{
"mcpServers": {
"database-mcp-sqlite": {
"command": "npx",
"args": [
"-y",
"@database-mcp/sqlite"
],
"env": {
"SQLITE_PATH": "<SQLITE_PATH>"
}
}
}
}Install database-mcp-sqlite MCP in VS Code
.vscode/mcp.json
{
"servers": {
"database-mcp-sqlite": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@database-mcp/sqlite"
],
"env": {
"SQLITE_PATH": "<SQLITE_PATH>"
}
}
}
}Install database-mcp-sqlite MCP in Claude Desktop
claude_desktop_config.json
{
"mcpServers": {
"database-mcp-sqlite": {
"command": "npx",
"args": [
"-y",
"@database-mcp/sqlite"
],
"env": {
"SQLITE_PATH": "<SQLITE_PATH>"
}
}
}
}Install database-mcp-sqlite MCP in Codex
~/.codex/config.toml
[mcp_servers.database-mcp-sqlite] command = "npx" args = ["-y", "@database-mcp/sqlite"] [mcp_servers.database-mcp-sqlite.env] SQLITE_PATH = "<SQLITE_PATH>"
Install database-mcp-sqlite MCP in Gemini CLI
~/.gemini/settings.json
{
"mcpServers": {
"database-mcp-sqlite": {
"command": "npx",
"args": [
"-y",
"@database-mcp/sqlite"
],
"env": {
"SQLITE_PATH": "<SQLITE_PATH>"
}
}
}
}Configuration
SQLITE_PATHRequiredPath to the SQLite database file
SQLITE_PATHRequiredPath to the SQLite database file
SQLITE_PATHRequiredPath to the SQLite database file
| Name | Description | |
|---|---|---|
| SQLITE_PATH | Path to the SQLite database file | Required |
| SQLITE_PATH | Path to the SQLite database file | Required |
| SQLITE_PATH | Path to the SQLite database file | Required |
Automated checks
Ran Nov 12, 2026Full report →Passed our automated checks. That is not a security audit: read the code and give the server the narrowest access it needs. How checks work
- Source repository linked and reachablePass
- Open source license (OSI)Pass
- Commit or release in the last yearPass
- Package name not close to a popular packagePass
- Remote endpoint uses HTTPSNot checked
- Destructive tools are labelledNot checked
- No hidden instructions to the modelPass
- No critical advisory in the package or its dependenciesPass
README
View on GitHubdatabase-mcp
MCP servers that give AI clients safe, structured access to SQL databases.
One installable package per database engine, in TypeScript (npm), Python
(PyPI), and Rust (crates.io). Every package exposes the same minimal
two-tool surface, execute_sql and search_objects, with guardrails on by
default: read-only mode, row caps, and statement timeouts.
Packages
| Engine | TypeScript (npm) | Python (PyPI) | Rust (crates.io) |
|---|---|---|---|
| SQLite | @database-mcp/sqlite |
database-mcp-sqlite |
database-mcp-rs-sqlite |
| libSQL | @database-mcp/libsql |
database-mcp-libsql |
database-mcp-rs-libsql |
| MySQL | @database-mcp/mysql |
database-mcp-mysql |
database-mcp-rs-mysql |
| MariaDB | @database-mcp/mariadb |
database-mcp-mariadb |
database-mcp-rs-mariadb |
| Postgres | @database-mcp/postgres |
database-mcp-postgres |
database-mcp-rs-postgres |
All three lines are published and pass the same language-agnostic conformance suite against real databases in CI, so behavior is identical regardless of language. Every engine is also listed on the MCP Registry with all three install options: npm, PyPI, and cargo.
Rust crates are named database-mcp-rs-<engine> because the plain names are
taken on crates.io; the command each one installs is still
database-mcp-<engine>. Go is planned.
Design principles
- Two tools, no more. A tiny tool surface keeps the model's context window
clean.
search_objectsprogressively discloses schema: call it with no arguments to list tables, with a table name to get columns, indexes, and foreign keys. - Safe by default. Read-only mode is enforced in two layers: a conservative SQL guard, plus a session-level read-only setting in the database itself. Rows are capped (default 1000) and statements time out (default 30s).
- Configured at launch, never via chat. Connection details come from flags, a YAML config file, or environment variables. Credentials are never accepted through a tool call.
- Secrets never appear in logs. Passwords live in non-printable secret types, DSNs are sanitized before logging, and a redaction filter guards the log boundary.
Quick start
Pick your engine's package; each README has the full config surface. SQLite via npm:
{
"mcpServers": {
"sqlite": {
"command": "npx",
"args": ["-y", "@database-mcp/sqlite", "--dsn", "/absolute/path/to/database.db"]
}
}
}
Or via PyPI: use "command": "uvx" and
"args": ["database-mcp-sqlite", "--dsn", "/absolute/path/to/database.db"].
Or as a native binary, with no Node or Python runtime: run
cargo install database-mcp-rs-sqlite, then use
"command": "database-mcp-sqlite" with the same args minus the package
name.
Flags, environment variables, and YAML config are identical across all three lines.
Networked engines take credentials from the environment (MYSQL_*,
MARIADB_*, POSTGRES_*/DATABASE_URL, LIBSQL_URL/LIBSQL_AUTH_TOKEN),
*_FILE mounted secrets, or a YAML file via --config. Never from a chat
prompt.
Contributing
See CONTRIBUTING.md. The short version: the conformance
suite is the definition of done. A change is mergeable only when
conformance/run.mjs passes against every affected server.
License
database-mcp-sqlite MCP questions
How do I add database-mcp-sqlite MCP to Claude Code?
Run claude mcp add --env SQLITE_PATH=<SQLITE_PATH> database-mcp-sqlite -- npx -y @database-mcp/sqlite in your terminal. Add --scope user to make it available in every project.
How do I add database-mcp-sqlite MCP to Cursor?
Open ~/.cursor/mcp.json and add the server under mcpServers, using the Cursor config shown in the install section above.
How safe is the database access?
The server is safe by default, enforcing read-only mode through SQL guards and database settings, capping rows at 1000, and setting a 30s statement timeout.
Can I provide database credentials through a chat prompt?
No, credentials must be configured at launch via flags, environment variables, or a YAML config file; they are never accepted through tool calls.
What tools are available in this server?
The server exposes two minimal tools: execute_sql for running queries and search_objects for discovering the database schema.