Code Mode (sqlite_execute_code) dramatically reduces token usage (70–90%) by letting agents execute multi-step database operations inside a single sandboxed JavaScript call. Instead of dozens of back-and-forth tool calls, the agent writes JavaScript against the typed sqlite.* SDK — composing queries, chaining operations across all tool groups, and returning exactly the data it needs.

This mirrors the Code Mode pattern pioneered by Cloudflare: fixed token cost regardless of how many capabilities exist.

Code Mode executes user-provided JavaScript inside a process-level V8 isolate (isolated-vm), providing strict memory separation and secure C++ execution boundaries.

All sqlite.* API calls are forwarded to the main thread via a MessagePort-based RPC bridge, where the actual database operations execute. This provides:

• Process-level isolation — user code runs in a separate V8 instance with enforced heap limits
• Readonly enforcement — when readonly: true, stripped methods throw clear error messages listing available methods via Proxy traps
• Hard timeouts — worker termination if execution exceeds the configured limit (default 30s)
• V8 code generation restrictions — eval() and Function() construction from strings disabled at the V8 engine level
• RPC allowlist — host-side validation prevents workers from invoking unauthorized API methods
• Full API access — all 10 tool groups available via sqlite.* namespaces

If you control your own setup, run with only Code Mode enabled:

{
  "mcpServers": {
    "db-mcp-sqlite": {
      "command": "node",
      "args": [
        "/path/to/db-mcp/dist/cli.js",
        "--transport",
        "stdio",
        "--sqlite-native",
        "/path/to/database.db",
        "--tool-filter",
        "codemode"
      ]
    }
  }
}

This exposes just sqlite_execute_code plus built-in tools. The agent writes JavaScript against the typed sqlite.* SDK in one execution.

Tip: Instruct your AI agent to prefer Code Mode over individual tool calls:

"When using db-mcp, prefer sqlite_execute_code (Code Mode) for multi-step database operations to minimize token usage."

Code Mode exposes all tool groups through namespaced API objects:

When Code Mode executes, it injects full TypeScript definitions into the environment dynamically. This enables agents to confidently navigate the sqlite.* SDK and autocompletes expected parameters and types directly in memory, reducing hallucination.

// Multi-step operation in a single call
const tables = await sqlite.core.listTables();
const schema = await sqlite.core.describeTable({ table: "users" });
const stats = await sqlite.stats.statsBasic({ table: "users", column: "age" });
const recent = await sqlite.core.readQuery({
  sql: "SELECT * FROM users WHERE created_at > date('now', '-7 days')",
});

return { tables: tables.tables.length, schema, stats, recentUsers: recent.rows };

// JSON analysis pipeline
const analysis = await sqlite.json.analyzeSchema({
  table: "events",
  column: "payload",
});
const keys = await sqlite.json.keys({ table: "events", column: "payload" });
const security = await sqlite.json.securityScan({
  table: "events",
  column: "payload",
});

return { schema: analysis, topKeys: keys, security };

Code Mode executes inside a secure V8 isolate with defense-in-depth protections:

require, process, global, globalThis, module, exports, setTimeout, setInterval, setImmediate, Proxy — all strictly undefined in the sandbox.

29 static regex rules reject code containing require(), import(), eval(), Function(), __proto__, constructor.constructor, Reflect.*, Symbol.*, new Proxy(), fetch(), WebSocket, Object.getPrototypeOf, Object.defineProperty, and filesystem/network/child_process references. Code comments are stripped and \u/\x escapes are blocked prior to validation to prevent evasion.

• Frozen built-in prototypes — prevents prototype pollution
• Proxy constructor nullified — blocks Proxy-based escapes
• RPC allowlist — only authorized API methods are bridgeable
• Readonly Proxy traps — structured errors for stripped methods
• Audit logging — every execution logged with UUID, client ID, and metrics

When running in WASM mode (--sqlite), Code Mode is still available but with reduced API surface:

• Transactions — sqlite.transactions.* namespace is empty
• Window Functions — sqlite.stats.window* methods are unavailable
• FTS5 — sqlite.text.fts* methods are unavailable
• SpatiaLite — sqlite.geo.spatialite* methods are unavailable

sqlite.help() accurately reflects the available methods for the active backend.

• Tool Filtering — Code Mode in filter expressions
• Tool Reference — All tools with Code Mode API names
• OAuth & Security — Code Mode requires admin scope with OAuth