sqlite3 · SQLite

SQLite CLI for AI Agents

Inspect and transform local SQLite databases with stable batch and machine-readable output modes.

Official toolOperational risk: R0–R3verified

Install for an Agent Report broken data

Agent readiness

86/100

Evidence confidence

verified

Documentation checked

2026-07-10

Independently tested version

3.51.0

Install for an Agent

Choose an official installation path that matches the runtime. Pin a version for team or CI use, then record the version before the first task.

HomebrewRecommended

macos · linux

$ shell

brew install sqlite

winget

windows

$ shell

winget install SQLite.SQLite

Authentication and Minimum Permissions

Grant only the permissions the task needs. Pass credentials through environment variables or a platform secret store, never through prompts, repositories, or logs.

No authentication requiredHeadless authentication supported

No service credential is required; restrict filesystem and network access to the task.

Methods: none
Secret environment variables: None
Credential storage: No service credential is stored for this CLI.

Agent and Environment Compatibility

Confirm shell access first, then check the platform, network boundary, and credential path.

claude-codecodexgemini-clicopilot-cli

Environments: local, ci, container, headless, remote
Platforms: macos, linux, windows

Structured Output for Reliable Automation

Prefer a machine-readable format. Treat stdout as the result channel and stderr as diagnostics so the agent can parse failures separately.

json · csv · html · markdown

Use -json or -csv where supported and keep diagnostic logs on stderr.

-json-csv

Independently captured output sample

3.51.0 · macOS 26.5.1 (arm64), local non-interactive shell

Executed command

sqlite3 ':memory:' 'select json_object("ok", true);'

Captured stdout · json

{"ok":1}

Sample JSON Schema

{
  "type": "object",
  "additionalProperties": false,
  "required": [
    "ok"
  ],
  "properties": {
    "ok": {
      "type": "integer",
      "enum": [
        1
      ]
    }
  }
}

R0–R3 Command Risk Guide

Risk is assigned per command. R0 is local or remote read-only, R1 is reversible local write, R2 changes remote state, and R3 can be irreversible or production-impacting.

Read-only does not mean public

R0 only means the command does not change local or remote state. A read-only command may still return secrets, identity data, configuration, or production data. Expose only the minimum needed for the task, and never place it in logs, prompts, or commits.

R0Query a local database

Reads bounded rows and emits JSON.

$ shell

sqlite3 -json data.db "SELECT * FROM table_name LIMIT 20"

IdempotentSensitive output

R1Export a table

Writes a new local CSV file without changing the database.

$ shell

sqlite3 -csv data.db "SELECT * FROM table_name" > output.csv

Confirmation requiredMay repeat a changeSensitive output

R3Delete rows

Permanently removes rows when no backup or transaction rollback remains.

$ shell

sqlite3 data.db "DELETE FROM table_name WHERE ..."

Confirmation requiredMay repeat a change

How the Agent Readiness Score Is Built

Readiness describes how reliably an agent can operate the tool. It does not make every command safe and it does not replace an independent execution test.

Documentation indicates an agent-readiness score of 86/100. A bounded local smoke test is recorded for 3.51.0; review its limitations before relying on untested commands.

Structured output

Use -json or -csv where supported and keep diagnostic logs on stderr.

18/20

Headless operation

Official documentation describes a non-interactive authentication or execution path.

14/15

Safety controls

CLI Finder separates read commands from commands that require confirmation.

11/15

Determinism

Commands use explicit arguments and documented output controls where available.

8/10

Authentication

No service credential is required; restrict filesystem and network access to the task.

10/10

Documentation

This entry cites official documentation checked on 2026-07-10.

9/10

Installation

Official installation paths cover macOS, Linux, and Windows.

8/8

Maintenance

An official source repository is linked for release and maintenance review.

6/7

Agent artifacts

CLI Finder can generate registry-derived skills and policies; the tool itself was not credited with shipping them.

2/5

Generate a Skill or Agent Policy

Choose an agent and safety mode to generate a copyable artifact with installation, allowed commands, approval boundaries, and the evidence limitation.

Artifact typeTarget agentSafety mode

Generated artifact preview

SKILL.md

---
name: sqlite-agent-workflow
description: Use SQLite CLI for local databases, schema inspection, CSV or JSON export with explicit command risk and evidence boundaries.
---

# SQLite CLI agent workflow

Use this skill when the task needs local databases, schema inspection, CSV or JSON export, data repair.

## Evidence boundary

- Registry confidence: `verified`
- Documentation checked: `2026-07-10`
- Locally tested version: `3.51.0`
- Treat only the recorded executed checks as independently verified; every unlisted command remains documentation-only.

## Executed smoke checks

- `sqlite3 --version` — passed; exit 0. The recorded smoke check completed successfully.
- `sqlite3 ':memory:' 'select json_object("ok", true);'` — passed; exit 0. The recorded smoke check completed successfully.
- `sqlite3 ':memory:' 'select json_object("ok", true);' | jq -e '.ok == 1'` — passed; exit 0. The in-memory JSON result passed the recorded jq assertion.

## Installation

- Homebrew (macos, linux): `brew install sqlite`
- winget (windows): `winget install SQLite.SQLite`

## Authentication

- Methods: none
- Secret environment variables: none
- Minimum permissions: No service credential is required; restrict filesystem and network access to the task.
- Credential storage: No service credential is stored for this CLI.
- Never print, persist, or commit credential values.

## Allowed commands (read-only)

- `sqlite3 -json data.db "SELECT * FROM table_name LIMIT 20"` — R0: Reads bounded rows and emits JSON.

## Commands requiring explicit approval (read-only)

- None recorded.

## Forbidden commands (read-only)

- R1 `sqlite3 -csv data.db "SELECT * FROM table_name" > output.csv` — Writes a new local CSV file without changing the database.
- R3 `sqlite3 data.db "DELETE FROM table_name WHERE ..."` — Permanently removes rows when no backup or transaction rollback remains.

## Execution rules

1. Mode boundary: R0 exact commands may be used; R1, R2, and R3 commands are forbidden.
2. Confirm the selected account, project, context, database, namespace, or environment before any command.
3. Prefer structured output using `-json`, `-csv`.
4. Capture the exact command, exit code, stdout, and stderr separately.
5. A generated prefix policy must prompt unless that exact prefix is explicitly marked suffix-safe; do not infer safety from the executable name.
6. Never broaden credentials or disable safety controls to make a command succeed.

## Official sources

- [SQLite command-line shell documentation](https://sqlite.org/cli.html)
- [SQLite command-line shell documentation source repository](https://github.com/sqlite/sqlite)

CLI vs MCP vs API for This Task

CLI

Use the CLI on a developer machine, in CI, or in a container when the task should reuse existing shell state, credentials, and scripts and remain directly observable.

MCP

Consider MCP when the agent benefits from controlled tool definitions, delegated identity, or centrally governed server-side access.

API

Use the direct API for persistent application integrations, high-volume requests, or event-driven work where starting a process adds unnecessary overhead.

Read the full CLI vs MCP guide

Verification History and Official Evidence

CLI Finder records documentation review separately from real execution. Installation, help, exit codes, and output cannot be called Verified until they were run.

Current evidence boundary

Version output, an in-memory read query, SQLite JSON output, and a successful parse were executed locally. File databases, locking, migrations, writes, extensions, backups, and destructive statements were not tested.

Evidence confidence: verified
Independently tested version: 3.51.0 · 2026-07-10
Test environment: macOS 26.5.1 (arm64), local non-interactive shell

Executed checks

PassedExit code: 0
sqlite3 --version
The recorded smoke check completed successfully.
stdout excerpt
3.51.0 2025-06-12 (64-bit)
PassedExit code: 0
sqlite3 ':memory:' 'select json_object("ok", true);'
The recorded smoke check completed successfully.
stdout excerpt
{"ok":1}
PassedExit code: 0
sqlite3 ':memory:' 'select json_object("ok", true);' | jq -e '.ok == 1'
The in-memory JSON result passed the recorded jq assertion.
stdout excerpt
true