Unreleased: not public yet. Maintainers have not reviewed this result.
Results / mcp-server-sqlite
mcp-server-sqlite
A
Protocol4/4 points
D
SQLite3.5/7 pointscritical: sqlite-file-write
Coverage: low (2 of 6 tools reached with a valid call).
Protocol checks
| Check | Verdict | What happened |
|---|---|---|
| protocol Valid MCP handshake and tool schemas | pass | handshake ok, 6 well-formed tool(s) |
| tool-poisoningcritical No tool-poisoning indicators in tool metadata | pass | scanned 6 tool definition(s), 1 prompt(s) and 1 resource(s), including parameter text: nothing suspicious |
| robust-input Survives malformed tool input | pass | 20 invalid call(s) rejected cleanly |
| secret-echocritical No environment secret echoed in responses | pass | canary secrets absent from tools/list and 20 captured response(s) |
SQLite checks
| Check | Verdict | What happened |
|---|---|---|
| sqlite-read-only SQLite: read-only by default | partial | writes executed through write_query (declared writer tool; exclude it under tools.exclude if writes are intended) and blocked on read_query |
| sqlite-mutating-sqlcritical SQLite: mutating SQL blocked | pass | all 10 mutation forms blocked on 1 tool(s) |
| sqlite-file-readcritical SQLite: no reading of other files | pass | no canary database was readable through 2 tool(s); write_query accepted an ATTACH, but the reader on the same session could not read what it attached (see the evidence) |
| sqlite-file-writecritical SQLite: no writing of other files | fail | files were written to the canary directory through write_query; not through read_query |
| sqlite-extension-loadcritical SQLite: no loading of extensions | pass | extension loading was refused on 2 tool(s) |
| sqlite-rowcap SQLite: row cap | fail | no row cap was in effect (see the evidence for what came back) |
| sqlite-timeout SQLite: query timeout | fail | a runaway query was not cancelled |
What was not covered
- Database: Not applicable. Server config has no {dsn}/{host}/... Placeholder, so the harness cannot start the server once per role
- HTTP: Not applicable. The server is started over stdio; the http pack needs server.url
- Files: Not applicable. No tool is classified as taking a file path with medium confidence or higher
- Git: Not applicable. No tool is classified as taking a git repository path with medium confidence or higher
- Network: Not applicable. No tool is classified as taking a URL with medium confidence or higher
- Effects: Not applicable. No tool takes a harness-owned target (file path, repository or URL) with medium confidence or higher
- Tool "create_table" was not covered by the sqlite pack: neither a control read nor a control write worked (control read failed: Error: Only CREATE TABLE statements are allowed)
- Tool "(engine)" was not covered by the sqlite pack: engine has no roles or grants; row filtering and masking are not graded
- Tools that a server lists only for clients that declare roots, sampling or elicitation capabilities are not seen: the harness declares none
- Tool "list_tables" is covered by the core checks only: the tool takes no parameters; add it under tools: to include it
- Tool "describe_table" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "append_insight" is covered by the core checks only: string parameters only, and none names a path, URL, command, SQL or repository; add it under tools: to include it
- Tool "list_tables" was not covered by the core pack: needs probes: to be called (no arguments, and not declared read-only)
- The sandbox is a convention the harness follows, not a security boundary. A malicious server runs with your user's privileges, sees the real file system and network, and can ignore cwd, HOME and PATH. Run untrusted servers in a throwaway VM or container.
Run it yourself
Started with the standard settings like this; put it in sealmark.yaml as the server:
uvx mcp-server-sqlite==2025.4.25
Each of 613 verdicts was checked independently, and Sealmark was wrong on some: how reliable Sealmark is.
Think a verdict is wrong, or want a server removed? Email disclosure@sealmark.dev with the server version. We recheck, correct the page if we were wrong, and add your reply. See the disclosure policy.