read_query
Execute read-only SQL queries (SELECT, WITH, EXPLAIN) to fetch data from a SQLite database without modifications.
Instructions
Execute a read-only SQL query (SELECT, WITH/CTE, or EXPLAIN). Use this for fetching data.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | The SELECT SQL query to execute |
Implementation Reference
- src/index.ts:199-209 (registration)Tool registration of 'read_query' with input schema requiring a 'query' string property.
{ name: 'read_query', description: 'Execute a read-only SQL query (SELECT, WITH/CTE, or EXPLAIN). Use this for fetching data.', inputSchema: { type: 'object' as const, properties: { query: { type: 'string', description: 'The SELECT SQL query to execute' }, }, required: ['query'], }, }, - src/index.ts:280-285 (handler)Handler for the 'read_query' tool: extracts the query, validates it, executes it via db.all(), and returns results as JSON text.
case 'read_query': { const { query } = toolArgs as { query: string }; validateReadQuery(query); const rows = db.all(query); return { content: [{ type: 'text', text: JSON.stringify(rows, null, 2) }] }; } - src/index.ts:36-44 (helper)Validation helper ensuring read_query only accepts SELECT, WITH, or EXPLAIN queries and rejects multiple statements.
function validateReadQuery(query: string): void { const normalized = query.trim().toLowerCase(); if (!normalized.startsWith('select') && !normalized.startsWith('with') && !normalized.startsWith('explain')) { throw new McpError(ErrorCode.InvalidParams, 'Only SELECT, WITH (CTE), and EXPLAIN queries are allowed for read_query'); } if (queryHasMultipleStatements(query)) { throw new McpError(ErrorCode.InvalidParams, 'Multiple statements are not allowed'); } } - src/index.ts:64-73 (helper)Helper used by validateReadQuery (and others) to detect multiple SQL statements by stripping strings, comments, and checking for semicolons.
function queryHasMultipleStatements(query: string): boolean { const stripped = query .replace(/'[^']*'/g, '') // remove single-quoted strings .replace(/"[^"]*"/g, '') // remove double-quoted identifiers .replace(/--[^\n]*/g, '') // remove line comments .replace(/\/\*[\s\S]*?\*\//g, '') // remove block comments .trim() .replace(/;$/, ''); // remove trailing semicolon return stripped.includes(';'); }