SQLite (archived)

Grade history

12 scans on record between 2026-06-28 and 2026-07-04. The grade has not changed across them.

History as recorded by this registry's own scans. The cause is an attribution from the inputs the registry records — the scanner engine identity and the declared tool surface — not proof of what changed on the server. Generated 2026-08-02.

How to read this grade

• What was scanned: mcp-server-sqlite, as distributed.
• When: 2026-07-04 08:18:07.
• By what: mcpaudit 2.4.0, applied to the published danger rubric (weights, bands, and the critical cap are all public).
• What the grade means: this registry's opinion, computed by the disclosed automated methodology against the artifact version above, on the scan date above. It measures conformance to the rubric at scan time.
• What it does not claim: it is not a statement that the product is malicious, insecure in your deployment, or unfit for use, and it is not an endorsement or certification.
• Because this server declares few or no tool-behavior annotations, its F reflects risk inferred from spec defaults — read it as cannot verify safe, not known dangerous.
• Disagree? Grades are re-checkable against the same package version, and corrections are welcome: open a dispute — see the dispute & correction policy.

Spec-shift exposure

BREAKS against MCP 2026-07-28-rc · confidence high · ruled 2026-07-18

What to change

• D1 [upstream-blocked] Pass stateless=True to server.run() at src/mcp_server_sqlite/server.py:373, alongside a floor bump to an SDK release that exposes the parameter. The server holds no per-connection state that depends on the handshake, so the change is behavior-preserving. Effort is upstream-blocked, not trivial: modelcontextprotocol/servers-archived is unmaintained by policy and mcp-server-sqlite has not published since 2025-04-25, so no maintainer exists to land it - a consumer would have to fork or vendor.

This is a point-in-time ruling against a release candidate, not the published specification, and it is independent of the danger grade above. Neither figure constrains the other.

Provenance & dispute

• Listing basis: operator-listed from a public catalog. This entry was not submitted by its vendor.
• Scan target: the published pypi artifact mcp-server-sqlite, installed and scanned locally using sandbox image mcp-trust-scan:corpus-2026-07-03. The public record stores the sandbox image, but not the network mode, so this page does not claim network isolation for that run.
• Credentials: none declared, none used.
• Dispute: vendor or maintainer of this server? Dispute this grade — first response within 14 days.

Findings

Score breakdown