Power your agent
Perintah milik penerbit sendiri. Bukan endpoint PlugMCP.
Host a copy with our keys and logs.
npx -y [email protected]Claude Code tidak punya tautan instal untuk perintah lokal. Salin perintah di bawah dan jalankan di terminal.
claude mcp add neverinfamous-db-mcp -- npx -y db-mcp@1.0.2Jalankan di terminal.
{ "mcpServers": { "neverinfamous-db-mcp": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
URL remote atau perintah di mesin Anda? Perbedaan kedua cara instal
Jalankan di PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
BukaDari penerbit
SQLite MCP Server with 170+ specialized tools, 11 data resources + 11 help resources, and 10 prompts, audit logging with DDL backup snapshots, HTTP/SSE Transport, OAuth 2.1 authentication, tool filtering, granular access control, and structured error handling with categorized, actionable responses. Available in WASM and better-sqlite3 variants.
Secure Database MCP Server featuring a V8 Isolate Code Mode sandbox that unifies 181+ tools, delivering 70-90% token savings. Built for enterprise with HTTP/SSE transports, OAuth 2.1, dynamic filtering, granular RBAC, audit logging, deterministic error handling, Prometheus metrics, and encryption at rest for maximum observability and safety.
Pull and run instantly:
docker pull writenotenow/db-mcp:latest
Run with volume mount:
docker run -i --rm \
-v $(pwd):/workspace \
writenotenow/db-mcp:latest \
--sqlite-native /workspace/database.db
Clone the repository:
git clone https://github.com/neverinfamous/db-mcp.git
Navigate to directory:
cd db-mcp
Install dependencies:
pnpm install
Build the project:
pnpm run build
Run the server with Native backend (better-sqlite3 — full features, requires Node.js native build):
node dist/cli.js --transport stdio --sqlite-native ./database.db
Or with WASM backend (sql.js — cross-platform, no compilation required):
node dist/cli.js --transport stdio --sqlite ./database.db
Backend Choice: Use
--sqlite-nativefor full features (181 MCP tools / 170 group tools, transactions, window functions, SpatiaLite). Use--sqlitefor WASM mode (154 MCP tools / 143 group tools, no native dependencies).
node dist/cli.js --transport stdio --sqlite-native :memory:
Expected output:
[db-mcp] Starting MCP server...
[db-mcp] Registered adapter: Native SQLite Adapter (better-sqlite3) (sqlite:default)
[db-mcp] Server started successfully
Run the test suite:
pnpm run test
Code Mode (sqlite_execute_code) dramatically reduces token usage (70–90%) and is included by default in all presets.
Code executes in a worker-thread sandbox — a separate V8 isolate with its own memory space. All sqlite.* API calls are forwarded to the main thread via a MessagePort-based RPC bridge, where the actual database operations execute. This provides:
readonly: true, stripped methods throw clear error messages listing available methods via Proxy trapseval() and Function() construction from strings disabled at the V8 engine level via codeGeneration: { strings: false, wasm: false }sqlite.* (e.g., sqlite.core.readQuery(), sqlite.json.extract())Set CODEMODE_ISOLATION=vm with CODEMODE_ISOLATION_INSECURE=1 to fall back to the in-process vm module sandbox if needed.
If you control your own setup, you can run with only Code Mode enabled — a single tool that provides access to all 180+ tools' worth of capability through the sqlite.* API:
{
"mcpServers": {
"db-mcp-sqlite": {
"command": "node",
"args": [
"/path/to/db-mcp/dist/cli.js",
"--transport",
"stdio",
"--sqlite-native",
"/path/to/database.db",
"--tool-filter",
"codemode"
]
}
}
}
This exposes just sqlite_execute_code plus built-in tools. The agent writes JavaScript against the typed sqlite.* SDK — composing queries, chaining operations across all 10 tool groups, and returning exactly the data it needs — in one execution. This mirrors the Code Mode pattern pioneered by Cloudflare for their entire API: fixed token cost regardless of how many capabilities exist.
[!TIP] Maximize Token Savings: Instruct your AI agent to prefer Code Mode over individual tool calls:
"When using db-mcp, prefer
sqlite_execute_code(Code Mode) for multi-step database operations to minimize token usage."
[!IMPORTANT] AI-enabled IDEs like Cursor have tool limits. With 180+ tools in the native backend, you must use tool filtering to stay within limits. Use shortcuts or specify groups to enable only what you need.
If you prefer individual tool calls, starter provides Core + JSON + Text:
{
"args": ["--tool-filter", "starter"]
}
Specify exactly the groups you need:
{
"args": ["--tool-filter", "core,json,stats"]
}
Note: Native includes FTS5 (5), window functions (6), transactions (8), and SpatiaLite (7) not available in WASM.
Note: +4 built-in tools (server_info, server_health, list_adapters, sqlite_execute_code) are injected into every group.
You can list individual tool names (without + prefix) to create a fully custom whitelist — only the tools you specify will be enabled:
Enable exactly 3 tools (whitelist mode):
--tool-filter "read_query,write_query,list_tables"
Mix tools from different groups:
--tool-filter "read_query,fuzzy_search,vector_search"
Combine with a shortcut or group:
--tool-filter "starter,+vector_search,+fuzzy_search"
This is useful for scripted or automated clients that need a minimal, precise set of capabilities.
Examples:
--tool-filter "starter"
--tool-filter "core,json,text,stats"
--tool-filter "starter,+stats"
--tool-filter "starter,-vector"
Legacy Syntax (still supported):
If you start with a negative filter (e.g., -vector,-geo), it assumes you want to start with all tools enabled and then subtract.
--tool-filter "-stats,-vector,-geo,-backup,-monitoring,-transactions,-window"
SQLite supports both built-in extensions (compiled into better-sqlite3) and loadable extensions (require separate binaries).
CSV Extension:
Download a precompiled binary or compile from source: https://www.sqlite.org/csv.html
Set the environment variable (Linux/macOS):
export CSV_EXTENSION_PATH=/path/to/csv.so
On Windows, use .dll:
export CSV_EXTENSION_PATH=/path/to/csv.dll
Or use the CLI flag:
db-mcp --sqlite-native ./data.db --csv
SpatiaLite Extension:
Install the library for your platform:
sudo apt install libspatialite-devbrew install libspatialiteSet the environment variable:
export SPATIALITE_PATH=/path/to/mod_spatialite.so
Or use the CLI flag:
db-mcp --sqlite-native ./data.db --spatialite
Note: Extension binaries must match your platform and architecture. The server searches common paths automatically, or use the
CSV_EXTENSION_PATH/SPATIALITE_PATHenvironment variables for custom locations.
MCP resources provide read-only access to database metadata:
On-demand tool reference documentation, filtered by --tool-filter:
Efficiency Tip: Data resources are always readable regardless of tool configuration. The "Min Config" column shows the smallest configuration that provides tools to act on what the resource exposes. Help resources are served on-demand — agents read them only when working with a specific tool group.
MCP prompts provide AI-assisted database workflows:
Tip: Lower
METADATA_CACHE_TTL_MSfor development (e.g.,1000), or increase it for production with stable schemas (e.g.,60000= 1 min). Schema cache is automatically invalidated on DDL operations (CREATE/ALTER/DROP).
db-mcp [options]
Transport: --transport <stdio|http|sse> --port <N> --server-host <host> --stateless
Auth: --oauth-enabled --oauth-issuer <url> --oauth-audience <aud>
Database: --sqlite <path> | --sqlite-native <path> [--encryption-key <key>]
Extensions: --csv --spatialite (native only)
Security: --allowed-io-roots <paths>
Audit: --audit-log <path> --audit-no-redact --audit-reads --audit-backup --audit-backup-data
Server: --name <name> --version <ver> --metrics-export <type> --tool-filter <filter>
CLI flags override environment variables. Run
node dist/cli.js --helpfor full details.
Add to your ~/.cursor/mcp.json, Claude Desktop config, or equivalent:
{
"mcpServers": {
"db-mcp-sqlite": {
"command": "node",
"args": [
"C:/path/to/db-mcp/dist/cli.js",
"--transport",
"stdio",
"--sqlite-native",
"C:/path/to/your/database.db",
"--tool-filter",
"codemode"
]
}
}
}
[!TIP] Switching backends: The config above uses the Native backend (better-sqlite3, 181 MCP tools). To use the WASM backend (sql.js, 154 MCP tools, zero native dependencies), change
--sqlite-nativeto--sqlitein the args array. See the Backend Options table in DOCKER_README for feature differences.
Variants (modify the args array above):
See Tool Filtering to customize which tools are exposed.
For remote access, web-based clients, or HTTP-compatible MCP hosts, use the HTTP transport:
node dist/cli.js \
--transport http \
--port 3000 \
--sqlite-native ./database.db \
--allowed-io-roots $(pwd)
Docker:
docker run --rm -p 3000:3000 \
-v ./data:/app/data \
writenotenow/db-mcp:latest \
--transport http --port 3000 \
--sqlite-native /app/data/database.db \
--allowed-io-roots /app/data
The server supports two MCP transport protocols simultaneously, enabling both modern and legacy clients to connect:
Modern protocol (MCP 2025-03-26) — single endpoint, session-based:
Sessions are managed via the Mcp-Session-Id header.
For serverless/stateless deployments where sessions are not needed:
node dist/cli.js --transport http --port 3000 --stateless --sqlite-native ./database.db --allowed-io-roots $(pwd)
In stateless mode: GET /mcp returns 405, DELETE /mcp returns 204, /sse and /messages return 404. Each POST /mcp creates a fresh transport.
Legacy protocol (MCP 2024-11-05) — for clients like Python mcp.client.sse:
db-mcp secures the HTTP transport using strict OAuth 2.1 authentication:
Full OAuth 2.1 with RFC 9728/8414 compliance for production multi-tenant deployments:
node dist/cli.js \
--transport http \
--port 3000 \
--sqlite-native ./database.db \
--allowed-io-roots $(pwd) \
--oauth-enabled \
--oauth-issuer http://localhost:8080/realms/db-mcp \
--oauth-audience db-mcp-server
Additional flags:
--oauth-jwks-uri <url>(auto-discovered if omitted),--oauth-clock-tolerance <seconds>(default: 60).
Access control is managed through OAuth scopes:
This implementation follows:
The server exposes metadata at /.well-known/oauth-protected-resource.
Note for Keycloak users: Add an Audience mapper to your client (Client → Client scopes → dedicated scope → Add mapper → Audience) to include the correct
audclaim in tokens.
[!NOTE] Per-tool scope enforcement: Scopes are enforced at the tool level — each tool group maps to a required scope (
read,write, oradmin). Unknown or unmapped tools default toadmin(fail-closed). When OAuth is enabled, every tool invocation checks the calling token's scopes before execution. When OAuth is not configured, scope checks are skipped entirely.
[!TIP] Audit identity integration: When OAuth is enabled alongside audit logging (
--audit-log), audit entries for write/admin tools automatically capture the authenticated user (claims.sub) and granted scopes. This provides a complete forensic trail linking every mutation to a specific identity. Without OAuth, these fields arenull/[].
[!WARNING] HTTP without authentication: When using
--transport httpwithout enabling OAuth, all clients have full unrestricted access. Always enable authentication for production HTTP deployments. See SECURITY.md for details.
db-mcp supports transparent database encryption using SQLCipher via the better-sqlite3-multiple-ciphers driver. When encryption is enabled, the server automatically encrypts both your target database (if newly created) and the sidecar SystemDb audit log, ensuring your schema, queries, and results are protected at rest.
Important WASM Limitation: The WASM backend (sql.js) does not support encryption. If you supply an encryption key to the WASM backend, it will gracefully ignore it for the target database. However, this can cause conflicts if both a Native and WASM backend share the same --audit-log file (since the Native backend will encrypt the shared audit log, causing the WASM backend to crash when reading it). To avoid this in dual-backend setups, assign a separate audit log (e.g., --audit-log mcp-audit-wasm.db) for your WASM instance.
Configuring the Key:
You can provide the key via the --encryption-key CLI flag or the DB_ENCRYPTION_KEY environment variable.
DB_ENCRYPTION_KEY="your-strong-passphrase-here"
x and wrapped in single quotes:
DB_ENCRYPTION_KEY="x'2DD29CA851E7B56E4697B0E1F08507293D761A05CE4D1B628663F411A8086D99'"
[!WARNING] Audit Log Compatibility: The
DB_ENCRYPTION_KEYenvironment variable applies globally and will cause the internalSystemDbto attempt to decrypt your audit log (--audit-log). If you have an existing unencrypted audit log, the server will fail to start withfile is not a database. To encrypt ONLY your target database (leaving the audit log unencrypted), use the--encryption-keyCLI flag instead of the global environment variable.
Performance benchmarks measure framework overhead on critical hot paths using Vitest bench (tinybench). The suite validates that framework plumbing stays negligible relative to actual database I/O:
pnpm run bench # Run all benchmarks
pnpm run bench:verbose # Verbose mode with detailed timings
Contributions are welcome! Please read our Contributing Guidelines before submitting a pull request.
For security concerns, please see our Security Policy.
⚠️ Never commit credentials - Store secrets in
.env(gitignored)
This project is licensed under the MIT License - see the LICENSE file for details.
Please read our Code of Conduct before participating in this project.
Secure Database MCP Server featuring a V8 Isolate Code Mode sandbox that unifies 181+ tools, delivering 70-90% token savings. Built for enterprise with HTTP/SSE transports, OAuth 2.1, dynamic filterin
{ "mcpServers": { "neverinfamous-db-mcp": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}Ringkasan umum
Secure Database MCP Server featuring a V8 Isolate Code Mode sandbox that unifies 181+ tools, delivering 70-90% token savings. Built for enterprise with HTTP/SSE transports, OAuth 2.1, dynamic filtering, granular RBAC, audit logging, deterministic error handling, Prometheus metrics, and encryption at rest for maximum observability and safety.
Tool
Belum ada daftar tool. Server remote mendapatkannya setelah pemeriksaan kesehatan pertama.
FAQ
Salin konfigurasi stdio untuk Cursor, Claude Desktop, Claude Code, atau VS Code di halaman ini. Konfigurasi ini memakai instalasi dari penerbit, bukan proxy PlugMCP.
Tidak ada variabel lingkungan wajib yang tercantum di catatan ini.
Db berjalan secara lokal melalui stdio.
Terakhir diperiksa 2026-10-28. Secure Database MCP Server featuring a V8 Isolate Code Mode sandbox that unifies 181+ tools, delivering 70-90% token savings. Built for enterprise with HTTP/SSE transports, OAuth 2.1, dynamic filtering, granular RBAC, audit logging, deterministic error handling, Prometheus metrics, and encryption at rest for maximum observability and safety.