local-mcp-server
Provides tools for querying and executing SQL against SQLite databases defined via named aliases in the configuration, with restrictions on DROP/ALTER statements.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@local-mcp-serverread the contents of my TODO.md file"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
local-mcp-server
A stdio MCP server that exposes local file I/O, a small shell whitelist, and SQLite helpers. Built for wiring Cursor/Claude Desktop to stuff on your machine without giving the model full shell access.
Setup
npm install
npm run build
cp config.example.json config.json
# edit allowedRoots to match your machineAdd to your MCP client config (Cursor example):
{
"mcpServers": {
"local": {
"command": "node",
"args": ["D:/path/to/local-mcp-server/dist/index.js"],
"env": {
"LOCAL_MCP_CONFIG": "D:/path/to/local-mcp-server/config.json"
}
}
}
}Related MCP server: terminal-agent
Tools
Tool | What it does |
| Scoped to |
| Host stats, no secrets |
| Whitelist only: |
| SQLite via named aliases in config |
Limitations
File access is path-jail'd but still powerful — don't point
allowedRootsat$HOME.Shell tool is intentionally useless for real admin work.
db_execblocksDROP/ALTER; everything else is on you.Windows:
unamewon't work unless you have it installed.
Dev
npm run dev # tsx, stdio — hard to debug interactively
npm testMIT licensed. PRs welcome for additional read-only system probes.
Available Tools
7 toolsdb_execC
Run a mutating SQL statement (INSERT/UPDATE/DELETE)
| Name | Required | Description | Default |
|---|---|---|---|
| alias | Yes | ||
| sql | Yes | ||
| params | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description only states 'mutating', implying writes, but lacks details on side effects, permissions, or destructiveness. Minimal disclosure beyond the tool's basic nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short (6 words) and front-loaded. While concise, it sacrifices necessary detail; it is minimally adequate but could include parameter guidance without excessive length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, no annotations, and 0% schema coverage. The description fails to elaborate on SQL execution context, alias meaning, parameter usage, or return value. Incomplete for a 3-parameter mutation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description adds no meaning to parameters (alias, sql, params). It does not explain their purpose or format, leaving the agent to infer from names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Run a mutating SQL statement (INSERT/UPDATE/DELETE)', clearly identifying the verb and resource. It distinguishes from sibling tool db_query by specifying mutating operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for INSERT/UPDATE/DELETE but does not explicitly mention when not to use or name alternatives like db_query for SELECT. Context is clear but lacks guidance on exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
db_queryA
Run a read-only SQL query against a configured SQLite database
| Name | Required | Description | Default |
|---|---|---|---|
| alias | Yes | Database alias from config | |
| sql | Yes | SELECT statement | |
| params | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description explicitly states the tool is read-only, which is a key behavioral trait. It does not elaborate on error handling or performance, but the main constraint is adequately disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with purpose, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only SQL tool with no output schema, the description covers the essential purpose and constraint. Missing details like return format are acceptable given simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67%, and the description adds no additional meaning beyond the schema's parameter descriptions. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Run', the resource 'SQL query', and the constraint 'read-only' and 'against a configured SQLite database', which distinguishes it from sibling db_exec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly mentions 'read-only', implying it should be used for SELECT queries versus write operations in db_exec. However, it lacks explicit when-not-to-use or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_dirB
List entries in a directory
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Directory under an allowed root | . |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears full responsibility for behavioral disclosure. It only states 'list entries' but omits details such as whether hidden files are included, recursion behavior, output format, or error handling (e.g., permissions issues). This is insufficient for a tool that interacts with the filesystem.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded and contains zero filler. Every word earns its place, making it highly efficient for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one optional parameter, no output schema, no annotations), the description is adequate but leaves gaps. An agent may need to know if the list is recursive, whether paths are relative or absolute, and if hidden entries are included. The description does not address these.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (one parameter 'path' fully described with default and 'Directory under an allowed root'). The description adds no additional meaning beyond the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List entries in a directory' is a clear verb+resource statement. It distinctly sets the tool apart from siblings like read_file (file contents), write_file (writing), db_query (database), and run_command (execution), leaving no ambiguity about its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. For instance, it doesn't clarify that list_dir is for directory contents while read_file is for file contents, nor does it mention prerequisites like allowed root.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileC
Read a text file from an allowed directory
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Relative path under an allowed root |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It states 'Read a text file' implying read-only but does not confirm no side effects, nor does it mention encoding, size limits, error handling, or allowed directory specifics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence of 8 words, no filler, perfectly front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should hint at the return format (e.g., file content as string). It does not. Also missing details on allowed directories and error scenarios, making it incomplete for a read operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the 'path' parameter. The tool description does not add new meaning beyond the schema's 'Relative path under an allowed root', so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read' and the resource 'text file', with a qualifier 'from an allowed directory'. It is distinct from siblings like write_file (write) and list_dir (list), so purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus siblings (e.g., when to read a file vs list a directory). No explicit when-to-use or when-not-to-use information is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_commandC
Run a whitelisted shell command (no pipes)
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Single command name, e.g. echo | |
| args | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description provides minimal behavioral context. It mentions whitelisting and pipe prohibition but fails to disclose error handling, output capture, permissions, or command restrictions beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-front-loaded sentence with no wasted words. However, it is too brief for the complexity of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, no annotations, and two parameters, the description omits crucial details such as output format, error handling, security implications, and usage examples, making it incomplete for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%: only 'command' parameter has a description in the schema. The tool description adds 'no pipes' but does not clarify the 'args' parameter or constraints. Overall, it adds little value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Run') and the resource ('whitelisted shell command') with a specific constraint ('no pipes'), effectively distinguishing it from sibling tools like file or database operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as db_exec or system_info is provided. The description lacks explicit when-to-use or when-not-to context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_infoA
Return basic host information
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral traits. It fails to disclose what 'basic host information' includes, whether it is safe, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no extraneous words, achieving maximum conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema and annotations, the description is too brief. It does not explain what the returned 'basic host information' includes, leaving the agent uninformed about the output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0 parameters, the baseline is 4. The description is not required to add parameter information as none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Return basic host information' clearly states the verb (return) and resource (basic host information). It is distinct from sibling tools which involve databases, files, or commands.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving host info but does not provide explicit when-to-use or when-not-to-use guidance or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_fileC
Write text to a file (creates parent dirs)
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| content | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility for disclosing behavior. It only mentions that parent directories are created. Critical behaviors like overwrite policy, encoding, permissions, and error handling are not addressed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently conveys the core function and a key behavior. Every word serves a purpose, and there is no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two parameters and no output schema or annotations, the description is incomplete. It omits overwrite behavior, encoding, error cases, and any return value, leaving the agent uncertain about critical usage details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It adds meaning to the 'path' parameter by noting that parent directories are created. However, the 'content' parameter is not elaborated beyond its name, leaving ambiguity about format or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it writes text to a file, which is a specific verb and resource. It distinguishes from sibling tools like read_file and list_dir. However, it does not specify encoding or binary support, which could be clarified.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It mentions creating parent directories, which is a behavioral note, but lacks explicit when-to-use or when-not-to-use context. Sibling tools are listed but no comparison is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.2.1- First observed
db_exec - First observed
db_query - First observed
list_dir - First observed
read_file - First observed
run_command - First observed
system_info - First observed
write_file
TDQS
Scored across 7 tools
Each tool has a clear, distinct purpose: database operations separate read and write, file operations are split into listing, reading, and writing, and shell commands are distinct from system info. No overlapping responsibilities.
All tool names follow a consistent verb_noun pattern (e.g., db_query, list_dir, run_command), making the set predictable and easy to navigate.
With 7 tools, the server covers a broad range of basic local operations (database, file system, shell) without being bloated or insufficient. The scope is well-matched to a general-purpose utility server.
The tool surface covers essential CRUD-like operations for databases and files, plus command execution and system info. Minor gaps exist, like no explicit file deletion or directory creation, but write_file creates parent directories and the set is functional for common tasks.
Maintenance
Related MCP Connectors
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Artifact store for AI agents — read, write, and search files by path; share by rendered URL.
Let ChatGPT, Claude & Cursor use your Mac: email, calendar, iMessage, Teams, files. Local, free.
Securely search and manage workspace context files for AI agents and teams.
Related MCP Servers
- AlicenseAqualityCmaintenanceProvides filesystem, web search, SQLite, and system tools for AI assistants like Claude, enabling secure access to local resources and the web.6MIT
- AlicenseNot gradedqualityDmaintenanceLocal daemon that bridges AI assistants to the local filesystem with read-only commands and optional write mode, enforcing strict security filters to prevent credential leakage.5 npmMIT
- AlicenseNot gradedqualityBmaintenanceExposes local file system operations to AI assistants via Streamable HTTP with security features like auth, path whitelisting, and audit logging.240 npm2MIT
- FlicenseNot gradedqualityBmaintenanceEnables Claude Desktop or other MCP clients to execute shell commands, read/write files, and list directories on the local machine. Includes basic safety guardrails to block obviously destructive operations.-