-
Notifications
You must be signed in to change notification settings - Fork 1
Configuration
Chris edited this page Jun 6, 2026
·
7 revisions
This page details the Command Line Interface (CLI) flags and Environment Variables available for configuring db-mcp.
The db-mcp server can be started with various options. CLI flags override corresponding environment variables.
| Flag | Purpose |
|---|---|
--transport, -t <type>
|
Transport type: stdio (default), http, sse
|
--port, -p <port>
|
HTTP port (default: 3000) |
--server-host <host> |
Host/IP to bind to (default: 127.0.0.1) |
--stateless |
Use stateless HTTP mode (no session management, no SSE) |
--enable-hsts |
Enable HSTS header (use when behind HTTPS) |
| Flag | Purpose |
|---|---|
--no-auth-enforcement |
Explicitly bypass auth enforcement for HTTP |
--oauth-enabled, -o
|
Enable OAuth 2.1 authentication |
--oauth-issuer <url> |
Authorization server URL (issuer) |
--oauth-audience <aud> |
Expected token audience |
--oauth-jwks-uri <url> |
JWKS URI (auto-discovered from issuer if not set) |
--oauth-clock-tolerance <seconds> |
Clock tolerance in seconds (default: 30) |
| Flag | Purpose |
|---|---|
--sqlite <path> |
Add SQLite database (WASM/sql.js backend) |
--sqlite-native <path> |
Add SQLite database (native/better-sqlite3 backend) |
--encryption-key <key> |
SQLCipher encryption key (native only) |
| Flag | Purpose |
|---|---|
--csv |
Load CSV extension for CSV virtual tables |
--spatialite |
Load SpatiaLite extension for GIS capabilities |
| Flag | Purpose |
|---|---|
--allowed-io-roots <paths> |
JSON array or comma-separated list of absolute paths allowed for IO operations. Required for HTTP transport. |
| Flag | Purpose |
|---|---|
--audit-log <path> |
Enable audit logging (JSONL file path, or stderr) |
--audit-no-redact |
Include tool arguments in audit entries (default is redacted) |
--audit-reads |
Also log read-scoped tool invocations |
--audit-backup |
Enable pre-mutation DDL snapshots |
--audit-backup-data |
Include sample data rows in snapshots |
| Flag | Purpose |
|---|---|
--help, -h
|
Show help |
--config, -c <path>
|
Load configuration from YAML/JSON file |
--dump-config |
Print the resolved configuration and exit |
--name <name> |
Server name (default: db-mcp) |
--version <version> |
Server version |
--metrics-export <type> |
Export metrics at HTTP /metrics (e.g., prometheus) |
--tool-filter <filter> |
Tool filter string (shortcuts or groups) |
| Variable | Default | Description |
|---|---|---|
PROJECT_REGISTRY |
— | Path to the project registry |
TEAM_DB_PATH |
— | Path to the team database |
MCP_HOST |
127.0.0.1 |
Host/IP to bind to (CLI: --server-host) |
SQLITE_DATABASE |
— | SQLite database path (CLI: --sqlite / --sqlite-native) |
DB_ENCRYPTION_KEY |
— | SQLCipher encryption key (CLI: --encryption-key) (Native only) |
DB_MCP_TOOL_FILTER |
— | Tool filter string (CLI: --tool-filter) |
METRICS_EXPORT |
— | Export metrics at HTTP /metrics (e.g., prometheus) (CLI: --metrics-export) |
OAUTH_ENABLED |
false |
Enable OAuth 2.1 (CLI: --oauth-enabled) |
OAUTH_ISSUER |
— | Authorization server URL (CLI: --oauth-issuer) |
OAUTH_AUDIENCE |
— | Expected token audience (CLI: --oauth-audience) |
OAUTH_JWKS_URI |
— | JWKS URI, auto-discovered if omitted (CLI: --oauth-jwks-uri) |
OAUTH_CLOCK_TOLERANCE |
60 |
Clock tolerance in seconds (CLI: --oauth-clock-tolerance) |
MCP_AUTH_TOKEN |
— | Simple bearer token for HTTP auth |
MCP_ENABLE_HSTS |
false |
Enable HSTS header |
NO_AUTH_ENFORCEMENT |
false |
Bypass auth enforcement |
LOG_LEVEL |
info |
Log verbosity: debug, info, warning, error
|
METADATA_CACHE_TTL_MS |
5000 |
Schema cache TTL in ms (auto-invalidated on DDL operations) |
CODEMODE_ISOLATION |
isolate |
Code Mode sandbox (isolate only) |
CODE_MODE_MAX_RESULT_SIZE |
10485760 |
Max Code Mode result payload in bytes |
MCP_RATE_LIMIT_MAX |
100 |
Max requests/minute per IP (HTTP transport) |
CSV_EXTENSION_PATH |
— | Custom path to CSV extension binary (native only) |
SPATIALITE_PATH |
— | Custom path to SpatiaLite extension binary (native only) |
ALLOWED_IO_ROOTS |
— | JSON array or comma-separated list of absolute paths allowed for IO operations (Required for HTTP transport) |
AUDIT_LOG |
— | Audit log file path, or stderr (CLI: --audit-log) |
AUDIT_REDACT |
true |
Redact tool arguments from audit entries (CLI: --audit-no-redact) |
AUDIT_READS |
false |
Also log read-scoped tool invocations (CLI: --audit-reads) |
AUDIT_BACKUP |
false |
Enable pre-mutation DDL snapshots (CLI: --audit-backup) |
AUDIT_BACKUP_DATA |
false |
Include sample data rows in snapshots (CLI: --audit-backup-data) |