Provides read-only access to SQLite databases, allowing exploration of tables and columns via resources, and running SELECT queries via a tool. Supports both local (stdio) and remote (HTTP) transports with safety features.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@sqlite-explorer-mcp show me the customers table schema"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A production-grade Model Context Protocol server that exposes a read-only SQLite database to any MCP client (Claude Code, Claude Desktop, …). It ships both transports, real input/output bounds, structured logging, auth, tests, CI, and a container.
Built on the official @modelcontextprotocol/sdk (v1.29.x).
Capability | MCP primitive | Why |
Discover tables / columns | Resource ( | Read-only context the model reads; cacheable, side-effect-free |
Run a query | Tool ( | An action with cost/risk: validated input, can fail, auditable |
The server is defined once (src/server.ts) and exposed over two transports from shared code:
src/stdio.ts — for local clients (the client launches it as a subprocess).
src/http.ts — Streamable HTTP for remote clients on other machines.
Related MCP server: paycoreDb
The read-only boundary is the engine, not a string check. The DB is opened
{ readonly: true } with PRAGMA query_only = ON; SQLite rejects any write regardless of the SQL
sent. The single-statement / SELECT-only gate in src/db.ts only produces clearer errors.
Output is bounded — MAX_ROWS cap + busy_timeout so a runaway scan can't exhaust memory.
Secrets via Zod-validated env (src/env.ts); nothing hardcoded. HTTP requires a 32+ char
MCP_BEARER_TOKEN, checked with a constant-time compare and fail-closed.
The stdout rule — on stdio, stdout is the JSON-RPC channel. All logging goes to stderr
(src/logger.ts); an ESLint no-console rule enforces it.
npm install
npm run seed # creates data.db (sample customers + orders)
npm test # unit + in-memory integration tests
npm run buildnpx @modelcontextprotocol/inspector node build/stdio.js # debug standalone first
claude mcp add --transport stdio sqlite -- node "$(pwd)/build/stdio.js"export MCP_BEARER_TOKEN=$(openssl rand -hex 32)
npm run start:http
# from any machine (behind TLS in production):
claude mcp add --transport http sqlite https://your-host/mcp \
--header "Authorization: Bearer $MCP_BEARER_TOKEN"Confirm with claude mcp list and /mcp inside a session.
docker build -t sqlite-explorer-mcp .
docker run --rm -p 8080:8080 \
-e MCP_BEARER_TOKEN=$(openssl rand -hex 32) \
-e BIND_HOST=0.0.0.0 \
-v "$(pwd)/data.db:/app/data.db:ro" \
sqlite-explorer-mcpTerminate TLS at a reverse proxy in front of the container; never expose the plain HTTP port publicly. For per-user identity/revocation, Streamable HTTP also supports OAuth 2.0 — ship the bearer token first and add OAuth only when compliance requires named-user attribution.
All via environment (see .env.example): SQLITE_PATH, PORT, BIND_HOST, MCP_BEARER_TOKEN,
MAX_ROWS, QUERY_TIMEOUT_MS, LOG_LEVEL.
MIT
List all table names.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full responsibility for behavioral disclosure. It only states the core action ('List all table names') without additional details such as whether authentication is required, whether it is a read-only operation, or any potential side effects. The description adds no behavioral context beyond what the name and title already convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, short sentence ('List all table names.') that directly and efficiently conveys the tool's purpose. There is no wasted wording, and it is immediately understandable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no output schema), the description provides the essential information: it lists table names. While it does not explicitly state the return format (e.g., array of strings), the phrase 'List all table names' strongly implies the output. The description is adequate for this basic tool, though a slight enhancement could note the output type or any filtering absence.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so schema description coverage is 100% vacuously. The description adds no parameter details, but none are needed. The baseline for 0 params is 4, and the description appropriately matches the parameterless nature without causing confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List all table names' uses a specific verb ('List') and clearly identifies the resource ('table names') with a clear scope ('all'). It distinguishes this tool from the sibling 'query' by indicating it lists table names rather than querying data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. With a sibling tool 'query' present, there is no mention of which operation would be appropriate for different scenarios. The description simply states the function without any usage context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Run a single read-only SQL SELECT/WITH statement and return rows as JSON. Read the schema://tables and schema://table/{name} resources first to learn the schema.
| Name | Required | Description | Default |
|---|---|---|---|
| sql | Yes | a single read-only SELECT/WITH statement |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, but the description explicitly discloses that the tool is read-only, accepts a single statement, and returns JSON. This covers the key safety trait and output behavior, but it does not discuss error handling or result size limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with two sentences that front-load the core purpose and then provide the prerequisite schema-reading instruction. There is no redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description covers the core function, read-only safety, return format, and schema learning prerequisite. It lacks details on pagination or error behavior, but these are not critical for basic usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides a full description for the sql parameter ('a single read-only SELECT/WITH statement'). The tool description repeats the same information without adding additional semantic detail, so it meets the baseline but does not go beyond.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a single read-only SQL SELECT/WITH statement and returns rows as JSON. This identifies the specific verb and resource, distinguishing it from the sibling tool list_tables.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides a clear usage prerequisite: read the schema://tables and schema://table/{name} resources first. However, it does not explicitly mention when not to use this tool or directly reference list_tables as an alternative for listing tables.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
v1.0.0list_tablesquerylist_tables and query have clearly distinct purposes: one lists table names, the other executes SQL queries. There is no ambiguity or overlap between them.
Both tool names are verbs, but list_tables follows a verb_noun pattern while query is a standalone verb. This is a minor deviation, not a major inconsistency.
With only two tools, the server feels thin at first glance. However, the tools cover the core functionality for a read-only SQLite explorer, making the count borderline but not excessive.
The tool set provides list_tables for discovery and query for arbitrary read-only SQL, which covers most exploration needs. There is no dedicated schema tool, but query can access sqlite_master, so gaps are minor and workable.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Explore, query, and inspect SQLite databases with ease. List tables, preview results, and view det…
Read-only PostgreSQL, MySQL, SQL Server access via MCP — 24 dialect-aware hosted tools.
Query, join, profile, clean and convert CSV/JSON/Parquet with server-side DuckDB over MCP.
Read-only MCP server for ClassQuill, a tutoring-business-management platform.
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/FrankieSoltero/sqlite-explorer-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
