mcp-sqlite

library0.3.2jsnpmunverified

An MCP (Model Context Protocol) server providing SQLite database interaction for AI agents. Version 1.0.9 (April 2026) includes critical SQL injection vulnerability fixes (CWE-89). The server exposes CRUD operations (create_record, read_records, update_records, delete_records), database introspection (list_tables, get_table_schema, db_info), and custom SQL execution. It is designed to be run as a stdio-based MCP tool in IDEs like Cursor, VS Code, and Windsurf. Compared to raw better-sqlite3 usage, it abstracts SQL via MCP tool calls and validates identifiers against sqlite_master. Requires Node >= 14.

database llm-agents

npm install mcp-sqlite

github ↗package ↗

INSTALL

IMPORT

SIG · MCP-SQLITE

mcp-sqlite

databasejavascriptv0.3.2

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

mcp-sqlite (CLI)

✓ npx -y mcp-sqlite <path-to-db>

✗ npm install mcp-sqlite && node node_modules/.bin/mcp-sqlite <path>

Primary usage is via npx, not as programmatic import. The package is a CLI server.

MCP tools (via JSON-RPC)

✓ {"method":"tools/call","params":{"name":"create_record","arguments":{"table":"users","data":{"name":"John"}}}}

✗ {"method":"create_record","params":{"table":"users","data":{}}}

All operations use MCP tools/call with proper method name. Direct method calls are invalid.

Configuration (Cursor)

✓ {"mcpServers":{"MCP SQLite Server":{"command":"npx","args":["-y","mcp-sqlite","path/to/db.db"]}}}

✗ {"mcpServers":{"mcp-sqlite":{"command":"npx","args":["mcp-sqlite","path"]}}}

Cursor uses 'mcpServers' key; VS Code uses 'servers' key. The args array must include '-y' before the package name.

Configuration (VS Code)

✓ {"servers":{"MCP SQLite Server":{"type":"stdio","command":"npx","args":["-y","mcp-sqlite","path/to/db.db"]}}}

✗ {"mcpServers":{...}}

VS Code uses a different structure with 'type':'stdio' and 'servers' key.

Demonstrates setting up mcp-sqlite with Cursor, creating a table, inserting a record, and reading it back via MCP tools.

// Create an SQLite database and run a Cursor MCP server example // First, create a test database: $ touch test.db // Add Cursor MCP configuration to ~/.cursor/mcp.json: { "mcpServers": { "MCP SQLite Server": { "command": "npx", "args": ["-y", "mcp-sqlite", "/absolute/path/to/test.db"] } } } // Restart Cursor and call the tool via MCP: // "list_tables" returns empty if no tables // Example create_record call: { "method": "tools/call", "params": { "name": "create_record", "arguments": { "table": "users", "data": { "name": "Alice", "email": "alice@example.com" } } } } // Response: {"content":[{"type":"text","text":"Record created: id=1"}]} // Note: database path must be absolute or relative to CWD

mcp-sqlite --version

Debug

Known issues

breakingSQL injection vulnerability (CWE-89) fixed in v1.0.9 - table and column names must be validated against sqlite_master; older versions allow arbitrary SQL via crafted table/column names.

fix

Update to v1.0.9 or later.

affects: <1.0.9

deprecatedZod v3 compatibility is deprecated since v1.0.8; tool definitions now use explicit string keys to support Zod v4.

fix

Ensure your MCP client supports the new schema structure. No action needed for v1.0.8+.

affects: >=1.0.8

breakingVS Code MCP integration requires stricter JSON schema validation since v1.0.7; missing 'type':'stdio' or wrong key names cause tool registration failure.

fix

Use correct VS Code configuration: { 'servers': { 'name': { 'type':'stdio', 'command':'npx', 'args':['-y','mcp-sqlite','path'] } } }

affects: >=1.0.7

gotchaDatabase path must be provided as a command-line argument; the server cannot work without a valid path.

fix

Always pass the path to your SQLite database file as the last argument to npx.

affects: all

gotchaThe package is a CLI/server and cannot be imported programmatically in Node.js; there is no exported API.

fix

Use npx to run the server. Do not attempt to require('mcp-sqlite').

affects: all

gotchaCursor uses 'mcpServers' key while VS Code uses 'servers' key; using wrong key results in tools not being registered.

fix

Check your IDE's documentation for the correct configuration key.

affects: all

Errors

Common errors & fixes

Error: Connection closed

MCP server process crashed or database path is invalid.

fix

Ensure the database file exists and the path is correct. Restart Cursor/VS Code after configuration changes.

npx: command not found: mcp-sqlite

npx cannot find the package; likely due to network issues or npm registry problems.

fix

Run 'npx mcp-sqlite' with the correct package name. If using npx, ensure you have internet access.

TypeError: Cannot read properties of undefined (reading 'columns')

Trying to get schema of a non-existent table or using an older version without proper validation.

fix

Verify the table exists using 'list_tables' first. Update to v1.0.9 for security fixes.

ValidationError: Expected string, received object

MCP tool arguments format is incorrect, e.g., passing data as a string instead of object.

fix

Ensure method is 'tools/call' and arguments follow the documented structure (e.g., 'data' must be an object).

Upgrade

Version history

0.3.2latest on npm

Audit

Dependencies

better-sqlite3requiredUnderlying SQLite database engine

Agent activity

29 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/jparkerweb/mcp-sqlite ↗

packagehttps://www.npmjs.com/package/mcp-sqlite ↗