MCP SQLite Server

1.0.9 verified Sat Apr 25 auth: no javascript

An MCP (Model Context Protocol) server providing SQLite database interaction for AI agents. Version 1.0.9 (April 2026) includes critical SQL injection vulnerability fixes (CWE-89). The server exposes CRUD operations (create_record, read_records, update_records, delete_records), database introspection (list_tables, get_table_schema, db_info), and custom SQL execution. It is designed to be run as a stdio-based MCP tool in IDEs like Cursor, VS Code, and Windsurf. Compared to raw better-sqlite3 usage, it abstracts SQL via MCP tool calls and validates identifiers against sqlite_master. Requires Node >= 14.

Common errors

error Error: Connection closed ↓

cause MCP server process crashed or database path is invalid.

fix

Ensure the database file exists and the path is correct. Restart Cursor/VS Code after configuration changes.

error npx: command not found: mcp-sqlite ↓

cause npx cannot find the package; likely due to network issues or npm registry problems.

fix

Run 'npx mcp-sqlite' with the correct package name. If using npx, ensure you have internet access.

error TypeError: Cannot read properties of undefined (reading 'columns') ↓

cause Trying to get schema of a non-existent table or using an older version without proper validation.

fix

Verify the table exists using 'list_tables' first. Update to v1.0.9 for security fixes.

error ValidationError: Expected string, received object ↓

cause MCP tool arguments format is incorrect, e.g., passing data as a string instead of object.

fix

Ensure method is 'tools/call' and arguments follow the documented structure (e.g., 'data' must be an object).

Warnings

breaking SQL injection vulnerability (CWE-89) fixed in v1.0.9 - table and column names must be validated against sqlite_master; older versions allow arbitrary SQL via crafted table/column names. ↓

fix Update to v1.0.9 or later.

deprecated Zod v3 compatibility is deprecated since v1.0.8; tool definitions now use explicit string keys to support Zod v4. ↓

fix Ensure your MCP client supports the new schema structure. No action needed for v1.0.8+.

breaking VS Code MCP integration requires stricter JSON schema validation since v1.0.7; missing 'type':'stdio' or wrong key names cause tool registration failure. ↓

fix Use correct VS Code configuration: { 'servers': { 'name': { 'type':'stdio', 'command':'npx', 'args':['-y','mcp-sqlite','path'] } } }

gotcha Database path must be provided as a command-line argument; the server cannot work without a valid path. ↓

fix Always pass the path to your SQLite database file as the last argument to npx.

gotcha The package is a CLI/server and cannot be imported programmatically in Node.js; there is no exported API. ↓

fix Use npx to run the server. Do not attempt to require('mcp-sqlite').

gotcha Cursor uses 'mcpServers' key while VS Code uses 'servers' key; using wrong key results in tools not being registered. ↓

fix Check your IDE's documentation for the correct configuration key.

Install

npm install mcp-sqlite

yarn add mcp-sqlite

pnpm add mcp-sqlite

Imports

mcp-sqlite (CLI)
wrong
```
npm install mcp-sqlite && node node_modules/.bin/mcp-sqlite <path>
```
correct
```
npx -y mcp-sqlite <path-to-db>
```
Primary usage is via npx, not as programmatic import. The package is a CLI server.

MCP tools (via JSON-RPC)

wrong

{"method":"create_record","params":{"table":"users","data":{}}}

correct

{"method":"tools/call","params":{"name":"create_record","arguments":{"table":"users","data":{"name":"John"}}}}

All operations use MCP tools/call with proper method name. Direct method calls are invalid.

Configuration (Cursor)

wrong

{"mcpServers":{"mcp-sqlite":{"command":"npx","args":["mcp-sqlite","path"]}}}

correct

{"mcpServers":{"MCP SQLite Server":{"command":"npx","args":["-y","mcp-sqlite","path/to/db.db"]}}}

Cursor uses 'mcpServers' key; VS Code uses 'servers' key. The args array must include '-y' before the package name.

Configuration (VS Code)

wrong

{"mcpServers":{...}}

correct

{"servers":{"MCP SQLite Server":{"type":"stdio","command":"npx","args":["-y","mcp-sqlite","path/to/db.db"]}}}

VS Code uses a different structure with 'type':'stdio' and 'servers' key.

Quickstart

Demonstrates setting up mcp-sqlite with Cursor, creating a table, inserting a record, and reading it back via MCP tools.

// Create an SQLite database and run a Cursor MCP server example
// First, create a test database:
$ touch test.db
// Add Cursor MCP configuration to ~/.cursor/mcp.json:
{
  "mcpServers": {
    "MCP SQLite Server": {
      "command": "npx",
      "args": ["-y", "mcp-sqlite", "/absolute/path/to/test.db"]
    }
  }
}
// Restart Cursor and call the tool via MCP:
// "list_tables" returns empty if no tables
// Example create_record call:
{
  "method": "tools/call",
  "params": {
    "name": "create_record",
    "arguments": {
      "table": "users",
      "data": {
        "name": "Alice",
        "email": "alice@example.com"
      }
    }
  }
}
// Response: {"content":[{"type":"text","text":"Record created: id=1"}]}
// Note: database path must be absolute or relative to CWD