SQLite MCP Sidecar MCP server

sqlite-sidecar-mcp

An agent-safe MCP sidecar for one live SQLite database.

It gives an AI agent controlled access to a database that another application already owns, and it limits the damage that an authorized but mistaken agent can cause.

[![ci][ci-shield]][ci-url] [![license][license-shield]][license-url] [![ghcr][ghcr-shield]][ghcr-url] [![dotnet][dotnet-shield]][dotnet-url]

Contents

• About the project
• Built with
• Getting started
• The eight tools
• Permissions
• Configuration
• Deployment
• Security
• Contributing
• License
• Contact
• Acknowledgments

About the project

An application owns a SQLite file. You want an agent to read it, and perhaps to change a few rows. Handing the agent a SQL connection gives it the whole file and one DELETE with a wrong predicate is unrecoverable. sqlite-sidecar-mcp sits next to that application as one more SQLite client and speaks MCP over HTTP. The owning application does not change.

It runs in production next to the MCP Canary API, where it gives the operator's coding agent read-only access to the live database.

flowchart TD
    agent[AI / MCP client] -->|HTTPS| proxy[Reverse proxy]
    proxy -->|private HTTP| sidecar[sqlite-sidecar-mcp]
    sidecar -->|SQLite client| db[(app.db)]
    app[Owning application] -->|SQLite client| db

The product defends against two callers. One is an unauthorized client, which the token and the request budget stop. The other is an authorized client that makes a mistake, and that one is the unusual part: an agent with permission to write can still write the wrong thing. Structured writes, a mandatory predicate, a row limit that counts cascades, and a per-minute write budget exist for it.

[!IMPORTANT]

One sidecar process serves one database. The request budget, the write budget and the

idempotency cache live in process memory. A second replica gives you two independent budgets and

two independent caches, and nothing reports it. Do not scale this service. Run a second sidecar

only for a different database or a different trust boundary.

Built with

• .NET 10, ASP.NET Core
• Model Context Protocol over Streamable HTTP
• Microsoft.Data.Sqlite with the bundled native SQLite
• TOON for row output, which costs fewer tokens than JSON

(back to top)

Getting started

Prerequisites

wrong path and leave an empty database next to the real one.

• Docker
• A SQLite database that already exists. The sidecar never creates one: creation would hide a

Run it

docker run -d --name sqlite-sidecar \
  -p 127.0.0.1:8080:8080 \
  -v /srv/myapp/data:/data \
  -e SQLITE_SIDECAR_DB=/data/app.db \
  -e SQLITE_SIDECAR_TOKEN='<a long random string>' \
  -e SQLITE_SIDECAR_PERMISSIONS=schema,read \
  --read-only --tmpfs /tmp \
  --cap-drop=ALL --security-opt=no-new-privileges \
  ghcr.io/xakpc/sqlite-mcp-sidecar:latest

The mount must be writable, also for the read-only permission set above. SQLite opens the -shm file read-write for a read-only connection to a WAL database, and a read-only mount fails in a way that reads like a permission fault rather than a configuration mistake.

Connect an agent

The endpoint is /db/mcp and the token goes in an Authorization header:

{
  "mcpServers": {
    "app-database": {
      "url": "https://example.com/db/mcp",
      "headers": { "Authorization": "Bearer <the token>" }
    }
  }
}

Shortened. The full README is on GitHub.