mcp-server-sqlite
pypi:mcp-server-sqlite@2025.4.25
Severity breakdown
Worst finding
Tool `Query Tools` exposes a code/command execution surface
· Query Tools
`Query Tools` looks like it executes code or shell commands (`read_query` - Execute SELECT queries to read data from the database - Input: - `query` (string): The SELECT SQL query to execute - Returns: Query results as array of objects - `write_query` - Execute INSERT, UPDATE, or DELETE queries - Input: - `query` (string): The SQL modification query - Returns: `{ affected_rows: number }` - `create_table` - Create new tables in the database - Input: - `query` (string): CREATE TABLE SQL statement - Returns: Confirmation of table creation). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.
fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.
All 1 finding
- criticalTool `Query Tools` exposes a code/command execution surface· Query Toolsexcessive agency
`Query Tools` looks like it executes code or shell commands (`read_query` - Execute SELECT queries to read data from the database - Input: - `query` (string): The SELECT SQL query to execute - Returns: Query results as array of objects - `write_query` - Execute INSERT, UPDATE, or DELETE queries - Input: - `query` (string): The SQL modification query - Returns: `{ affected_rows: number }` - `create_table` - Create new tables in the database - Input: - `query` (string): CREATE TABLE SQL statement - Returns: Confirmation of table creation). Arbitrary execution is the maximal authority a tool can hold -- it subsumes every other caveat, so it should never be exposed to an agent without a hard sandbox and an explicit, narrowly-scoped capability.
fix: Do not expose raw code/shell execution to an agent. If unavoidable, run it in a disposable sandbox with no network + no host FS, gate it behind a capframe-bind capability scoped to an allow-list of commands, and require holder-of-key proof per call.
How this was scored
Source registry — tool surface extracted from the package's README + manifest (R3/R5/R6/R7 fire; schema-dependent rules deferred). Findings are emitted by the public capframe.findings.v1 schema. Score = 100 − (10·Critical + 4·High + 2·Medium + 1·Low), clamped to [0, 100].
Disagree with a finding? Open an issue.