db-mcp (ShootaOT/db-mcp) is an MCP server listed on the M8ven Trust Index. It scores 68 out of 100, grade C. It declares 89 tools. No publisher has claimed this listing.

C
Caution
68/100

db-mcp

๐Ÿ”ง Optimize your SQLite experience with the db-mcp server, featuring OAuth 2.1 and 89 specialized tools for robust data management.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verifiedโšก Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

โšก Connect GitHub โ†’ continuous verification on every pushwhy connect โ†’

Who stands behind it

ShootaOT

Source: github_topic ยท also listed on github_repo_search

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access โ†’

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
๐Ÿšจ
Known vulnerabilities in dependencies: 1 critical, 2 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
// tools this server exposes89 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

server_info

Get information about the db-mcp server and registered adapters

server_health

Check health status of all database connections

list_adapters

List all registered database adapters

sqlite_backup

Create a backup of the database to a file.

sqlite_analyze

Analyze table statistics to improve query performance.

sqlite_integrity_check

Check database integrity for corruption or errors.

sqlite_optimize

Optimize database by reindexing and/or analyzing.

sqlite_read_query

Execute a SELECT query on the SQLite database. Returns rows as JSON. Use parameter binding for safety.

sqlite_write_query

Execute an INSERT, UPDATE, or DELETE query. Returns affected row count. Use parameter binding for safety.

sqlite_create_table

Create a new table in the database with specified columns and constraints.

sqlite_list_tables

List all tables and views in the database with their row counts.

sqlite_describe_table

Get detailed schema information for a table including columns, types, and constraints.

sqlite_drop_table

Drop (delete) a table from the database. This is irreversible!

sqlite_get_indexes

List all indexes in the database, optionally filtered by table.

sqlite_create_index

Create an index on one or more columns to improve query performance.

sqlite_fts_create

Create an FTS5 full-text search virtual table.

sqlite_fts_search

Search an FTS5 table using full-text query syntax.

sqlite_fts_rebuild

Rebuild an FTS5 index to optimize search performance.

sqlite_fts_match_info

Get FTS5 match ranking information using bm25.

sqlite_geo_distance

Calculate the distance between two geographic points using Haversine formula.

sqlite_geo_nearby

Find points within a radius of a center point.

sqlite_geo_bounding_box

Find points within a rectangular bounding box.

sqlite_geo_cluster

Cluster geographic points into grid cells.

sqlite_json_insert

Insert a row with JSON data. Automatically normalizes JSON for consistent storage.

sqlite_json_update

Update a value at a specific JSON path using json_set().

sqlite_json_select

Select rows and optionally extract specific JSON paths.

sqlite_json_query

Query JSON data with path-based filters and projections.

sqlite_json_validate_path

Validate a JSON path syntax without executing a query.

sqlite_json_merge

Merge JSON object into existing JSON column using json_patch().

sqlite_json_valid

Check if a string is valid JSON.

sqlite_json_extract

Extract a value from a JSON column at the specified path using json_extract().

sqlite_json_set

Set a value at a JSON path using json_set(). Creates path if it does not exist.

sqlite_json_remove

Remove a value at a JSON path using json_remove().

sqlite_json_type

Get the JSON type (null, true, false, integer, real, text, array, object) at a path.

sqlite_json_array_length

Get the length of a JSON array at the specified path.

sqlite_json_array_append

Append a value to a JSON array using json_insert().

sqlite_json_keys

Get the keys of a JSON object at the specified path.

sqlite_json_each

Expand a JSON array or object into rows using json_each().

sqlite_json_group_array

Aggregate column values into a JSON array using json_group_array().

sqlite_json_group_object

Aggregate key-value pairs into a JSON object using json_group_object().

sqlite_json_pretty

Format JSON string with indentation for readability.

sqlite_stats_basic

Get basic statistics (count, sum, avg, min, max) for a numeric column.

sqlite_stats_count

Count rows, optionally distinct values in a column.

sqlite_stats_group_by

Aggregate statistics grouped by a column.

sqlite_stats_histogram

Create a histogram with specified number of buckets.

sqlite_stats_percentile

Calculate percentiles (median, quartiles, etc.) for a column.

sqlite_stats_correlation

Calculate Pearson correlation coefficient between two numeric columns.

sqlite_stats_top_n

Get top N values from a column.

sqlite_stats_distinct

Get distinct values from a column.

sqlite_stats_summary

Get summary statistics for multiple columns at once.

sqlite_stats_frequency

Get frequency distribution of values in a column.

sqlite_regex_extract

Extract text matching a regex pattern. Processed in JavaScript after fetching data.

sqlite_regex_match

Find rows where column matches a regex pattern. Processed in JavaScript.

sqlite_text_split

Split a text column by delimiter into array results.

sqlite_text_concat

Concatenate multiple columns with optional separator.

sqlite_text_replace

Replace text in a column using SQLite replace() function.

sqlite_text_trim

Trim whitespace from text column values.

sqlite_text_case

Convert text to uppercase or lowercase.

sqlite_text_substring

Extract a substring from text column using substr().

sqlite_vector_create_table

Create a table optimized for vector storage with JSON vector column.

sqlite_vector_store

Store or update a vector in the database.

sqlite_vector_batch_store

Store multiple vectors in a batch operation.

sqlite_vector_search

Find similar vectors using cosine, euclidean, or dot product similarity.

sqlite_vector_get

Retrieve a vector by its ID.

sqlite_vector_delete

Delete vectors by their IDs.

sqlite_vector_count

Count vectors in a table.

sqlite_vector_stats

Get statistics about vectors in a table.

sqlite_vector_dimensions

Get the dimensions of vectors in a table.

sqlite_vector_normalize

Normalize a vector to unit length.

sqlite_vector_distance

Calculate distance or similarity between two vectors.

sqlite_generate_series

Generate a series of numbers using generate_series() virtual table.

sqlite_create_view

Create a view based on a SELECT query.

sqlite_list_views

List all views in the database.

sqlite_drop_view

Drop (delete) a view from the database.

sqlite_dbstat

Get database storage statistics using dbstat virtual table.

sqlite_vacuum

Rebuild the database to reclaim space and optimize structure.

sqlite_transaction_begin

Begin a new transaction. Use immediate or exclusive mode for write-heavy operations.

sqlite_transaction_commit

Commit the current transaction, making all changes permanent.

sqlite_transaction_rollback

Rollback the current transaction, discarding all changes.

sqlite_transaction_savepoint

Create a savepoint within the current transaction for partial rollback.

sqlite_transaction_release

Release a savepoint, keeping the changes made since it was created.

sqlite_transaction_rollback_to

Rollback to a savepoint, discarding changes made after it was created.

sqlite_transaction_execute

Execute multiple SQL statements in a single transaction. Automatically commits on success or rolls back on error.

sqlite_window_row_number

Assign sequential row numbers based on ordering. Useful for pagination and ranking.

sqlite_window_rank

Calculate rank of rows. RANK leaves gaps after ties, DENSE_RANK does not, PERCENT_RANK gives 0-1 range.

sqlite_window_lag_lead

Access previous (LAG) or next (LEAD) row values. Useful for comparing consecutive rows.

sqlite_window_running_total

Calculate running (cumulative) total. Useful for balance tracking, cumulative metrics.

sqlite_window_moving_avg

Calculate moving (rolling) average. Useful for smoothing time series data.

sqlite_window_ntile

Divide rows into N buckets. E.g., 4 buckets = quartiles, 10 = deciles, 100 = percentiles.

// known CVEs in dependencies1 critical2 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

criticalvitest@4.0.16GHSA-5xrq-8626-4rwp

When Vitest UI server is listening, arbitrary file can be read and executed

high@modelcontextprotocol/sdk@1.25.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.25.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

Depend on this server? Get alerted when its CVEs change.Watch this server free โ†’
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configDATABASE_URI
configDB_MCP_TOOL_FILTER
configLOG_LEVEL
configMYSQL_URI
configPOSTGRESQL_URI
configPOSTGRES_URI
configREDIS_URI
configSQLITE_DATABASE
configSQLITE_PATH
configTOOL_FILTER
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployMONGODB_URI
deployMONGO_URI
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

89/89 tools missing one or more hints โ€” server_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); server_health (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_adapters (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +86 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handlerโ€™s actual behaviour.

Tool inputs are validated

Only 0/3 tool handlers declare input schemas (0%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

27/89 tools referenced in tests (30%)

Write tests that reference each tool by name so every tool has at least one test.

Production dependencies are patched

0 critical, 2 high severity in production deps โ€” @modelcontextprotocol/sdk@1.25.1 (high), @modelcontextprotocol/sdk@1.25.1 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Dev dependencies

1 critical/high in dev-only deps (does not ship to users)

Upgrade dev dependencies when convenient.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance โ€” verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/shootaot/db-mcp?variant=verified)](https://m8ven.ai/mcp/shootaot/db-mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: b105a65d719daf9c2c48547dafa1572eec697de2
code hash: ff3750130d560200b66e2dd58ebba98b6821b392f1673d94d42c0b16098f1228
view raw JSON โ†’
Check MCPs from inside your assistant
Tool Check ยท MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives โ€” before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it โ†’Free ยท no account needed ยท works in any MCP client