sqlite-hub 2.0.0 → 2.0.1

package/README.md

@@ -269,7 +269,7 @@ SQLite Hub also provides a local JSON API for app info, database metadata, table
 
 ## MCP
 
-SQLite Hub includes a local stdio MCP server for agents such as Codex. It exposes the shared API/CLI service layer as guarded tools for schema inspection, read-only queries, query-plan explanation, backups, type generation, documents, and chart creation. See the [MCP documentation](./docs/MCP.md) for setup, tool names, and security boundaries.
+SQLite Hub includes a local MCP server for agents such as Codex. When SQLite Hub is running, the MCP endpoint is available at `/mcp`; a stdio fallback is also available through `sqlite-hub-mcp`. It exposes the shared API/CLI service layer as guarded tools for schema inspection, read-only queries, query-plan explanation, backups, type generation, documents, and chart creation. See the [MCP documentation](./docs/MCP.md) for setup, tool names, and security boundaries.
 
 ## Changelog
 

package/docs/MCP.md

@@ -4,7 +4,29 @@ SQLite Hub ships a local MCP server so agents can inspect and automate the same
 
 The MCP server uses the shared SQLite Hub service layer. API, CLI, and MCP calls all go through the same database registry, query execution, type generation, backup, document, and chart logic.
 
-## Start
+## Start With SQLite Hub
+
+When SQLite Hub is running, the MCP server is available on the same local web server:
+
+```toml
+[mcp_servers.sqlitehub]
+url = "http://127.0.0.1:4173/mcp"
+startup_timeout_sec = 10
+tool_timeout_sec = 60
+```
+
+If SQLite Hub is started with a custom port, use that port in the URL:
+
+```toml
+[mcp_servers.sqlitehub]
+url = "http://127.0.0.1:PORT/mcp"
+startup_timeout_sec = 10
+tool_timeout_sec = 60
+```
+
+The Settings `MCP` tab shows a copyable Codex config with the active host and port.
+
+## Stdio Fallback
 
 When SQLite Hub is installed from npm, use:
 
@@ -12,7 +34,7 @@ When SQLite Hub is installed from npm, use:
 sqlite-hub-mcp
 ```
 
-For a local checkout, point Codex at the script directly:
+For a local checkout, Codex can also spawn the stdio server directly:
 
 ```toml
 [mcp_servers.sqlitehub]
@@ -22,7 +44,7 @@ startup_timeout_sec = 10
 tool_timeout_sec = 60
 ```
 
-The server uses stdio transport. It is intended for local agents running on the same machine as SQLite Hub. It does not expose a network listener and does not require API tokens for local stdio use.
+The stdio fallback is intended for local agents running on the same machine as SQLite Hub. It does not expose a network listener and does not require API tokens for local stdio use.
 
 ## Tools
 
@@ -64,11 +86,13 @@ These statements are blocked in `run_readonly_query`:
 
 Backups are always created through SQLite Hub's managed backup service. Chart creation stores chart metadata only. The MCP server does not write arbitrary local files.
 
+The HTTP MCP endpoint runs on SQLite Hub's existing loopback server. It is local-only and uses the same localhost request guard as the internal API. API tokens are not exposed through MCP tool responses.
+
 ## Settings Status
 
 The Settings view has an `MCP` tab. It shows whether the MCP server is running, whether an agent is connected, active client count, the last connection time, last tool call, transport, exposed tools, and a copyable Codex config example.
 
-For stdio, connection state is tracked from MCP `initialize` and tool calls. When the MCP process exits cleanly, SQLite Hub marks the session as disconnected.
+For HTTP, connection state is tracked from MCP `initialize` and tool calls against `/mcp`. For stdio, connection state is tracked from MCP `initialize` and tool calls in the spawned process. When the stdio MCP process exits cleanly, SQLite Hub marks the session as disconnected.
 
 ## Example Prompts
 

package/docs/changelog.md

@@ -1,6 +1,7 @@
 # v2.0.0
 
 - mcp
+- mcp http endpoint starts with sqlite hub
 
 # v1.5.0
 

package/frontend/js/views/settings.js

@@ -240,7 +240,7 @@ function renderMcpSection(settings) {
           <div class="space-y-4 p-6">
             <div>
               <div class="text-[10px] font-mono uppercase tracking-[0.2em] text-on-surface-variant/60">
-                Local_Command
+                MCP_ENDPOINT
               </div>
               <div class="mt-3 border border-outline-variant/10 bg-surface-container-high px-4 py-3 font-mono text-sm text-primary-container">
                 ${escapeHtml(command)}
@@ -265,7 +265,7 @@ function renderMcpSection(settings) {
             <div>Read-only queries are limited to SELECT, PRAGMA, and EXPLAIN.</div>
             <div>Mutating SQL statements are blocked server-side before execution.</div>
             <div>Destructive actions must use existing SQLite Hub safety mechanisms such as verified backups.</div>
-            <div>Local stdio MCP is allowed because it runs on the same machine as SQLite Hub and does not expose network credentials.</div>
+            <div>The local HTTP MCP endpoint is bound to SQLite Hub's loopback server and does not expose API tokens.</div>
           </div>
         </section>
       </div>

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "sqlite-hub",
-    "version": "2.0.0",
+    "version": "2.0.1",
     "description": "SQLite-only local management app backend and SPA shell",
     "license": "MIT",
     "main": "server/server.js",

package/server/mcp/httpRouter.js

@@ -0,0 +1,95 @@
+const express = require("express");
+const {
+  createJsonRpcError,
+  handleMcpRequest,
+  MCP_PROTOCOL_VERSION,
+} = require("./stdioServer");
+
+function isJsonRpcBatch(message) {
+  return Array.isArray(message);
+}
+
+async function handleHttpMcpMessage(message, services) {
+  try {
+    return await handleMcpRequest(message, services);
+  } catch (error) {
+    services.statusService?.markError?.(error);
+    return createJsonRpcError(message?.id, error);
+  }
+}
+
+async function handleHttpMcpBatch(messages, services) {
+  const responses = await Promise.all(
+    messages.map((message) => handleHttpMcpMessage(message, services))
+  );
+
+  return responses.filter(Boolean);
+}
+
+function createMcpHttpRouter({ services }) {
+  if (!services?.toolService || !services?.statusService) {
+    throw new Error("MCP HTTP router requires MCP services.");
+  }
+
+  const router = express.Router();
+
+  services.statusService.markServerRunning();
+
+  router.get("/", (req, res) => {
+    res
+      .set({
+        Allow: "POST, OPTIONS",
+        "MCP-Protocol-Version": MCP_PROTOCOL_VERSION,
+      })
+      .status(405)
+      .json({
+        error: "SQLite Hub MCP uses Streamable HTTP POST requests.",
+      });
+  });
+
+  router.options("/", (req, res) => {
+    res
+      .set({
+        Allow: "POST, OPTIONS",
+        "MCP-Protocol-Version": MCP_PROTOCOL_VERSION,
+      })
+      .status(204)
+      .end();
+  });
+
+  router.post("/", async (req, res) => {
+    const message = req.body;
+
+    res.set({
+      "Content-Type": "application/json",
+      "MCP-Protocol-Version": MCP_PROTOCOL_VERSION,
+    });
+
+    if (isJsonRpcBatch(message)) {
+      const responses = await handleHttpMcpBatch(message, services);
+
+      if (!responses.length) {
+        res.status(202).end();
+        return;
+      }
+
+      res.json(responses);
+      return;
+    }
+
+    const response = await handleHttpMcpMessage(message, services);
+
+    if (!response) {
+      res.status(202).end();
+      return;
+    }
+
+    res.json(response);
+  });
+
+  return router;
+}
+
+module.exports = {
+  createMcpHttpRouter,
+};

package/server/routes/settings.js

@@ -37,8 +37,22 @@ function buildSettingsMetadata(context) {
   };
 }
 
-function buildMcpCodexConfig() {
-  const serverPath = path.resolve(__dirname, "../../bin/sqlite-hub-mcp.js");
+function buildMcpHttpUrl(req) {
+  const host = String(req?.get?.("host") ?? "127.0.0.1:4173").trim() || "127.0.0.1:4173";
+  return `http://${host}/mcp`;
+}
+
+function buildMcpCodexConfig({ url = null, commandPath = null } = {}) {
+  if (url) {
+    return [
+      "[mcp_servers.sqlitehub]",
+      `url = ${JSON.stringify(url)}`,
+      "startup_timeout_sec = 10",
+      "tool_timeout_sec = 60",
+    ].join("\n");
+  }
+
+  const serverPath = commandPath ?? path.resolve(__dirname, "../../bin/sqlite-hub-mcp.js");
 
   return [
     "[mcp_servers.sqlitehub]",
@@ -49,11 +63,13 @@ function buildMcpCodexConfig() {
   ].join("\n");
 }
 
-function buildMcpSettingsStatus(appStateStore) {
+function buildMcpSettingsStatus(appStateStore, options = {}) {
+  const httpUrl = options.httpUrl ?? null;
+  const stdioCommandPath = path.resolve(__dirname, "../../bin/sqlite-hub-mcp.js");
   const statusService = new McpStatusService({
     appStateStore,
     exposedTools: MCP_TOOL_DEFINITIONS,
-    transport: "stdio",
+    transport: httpUrl ? "http" : "stdio",
   });
   const status = statusService.getStatus();
 
@@ -63,8 +79,11 @@ function buildMcpSettingsStatus(appStateStore) {
       name: tool.name,
       description: tool.description,
     })),
-    command: `node ${path.resolve(__dirname, "../../bin/sqlite-hub-mcp.js")}`,
-    codexConfig: buildMcpCodexConfig(),
+    command: httpUrl ?? `node ${stdioCommandPath}`,
+    codexConfig: buildMcpCodexConfig({ url: httpUrl, commandPath: stdioCommandPath }),
+    httpUrl,
+    stdioCommand: `node ${stdioCommandPath}`,
+    stdioCodexConfig: buildMcpCodexConfig({ commandPath: stdioCommandPath }),
   };
 }
 
@@ -128,7 +147,9 @@ function createSettingsRouter({ appStateStore, connectionManager, tokenService,
     route((req, res) => {
       res.json(
         successResponse({
-          data: buildMcpSettingsStatus(appStateStore),
+          data: buildMcpSettingsStatus(appStateStore, {
+            httpUrl: buildMcpHttpUrl(req),
+          }),
         })
       );
     })
@@ -172,6 +193,7 @@ function createSettingsRouter({ appStateStore, connectionManager, tokenService,
 module.exports = {
   createSettingsRouter,
   buildMcpCodexConfig,
+  buildMcpHttpUrl,
   buildMcpSettingsStatus,
   buildSettingsMetadata,
   checkLatestAppVersion,

package/server/server.js

@@ -23,6 +23,8 @@ const { TableDesignerService } = require("./services/sqlite/tableDesignerService
 const { MediaTaggingService } = require("./services/sqlite/mediaTaggingService");
 const { ApiTokenService } = require("./services/apiTokenService");
 const { DatabaseCommandService } = require("./services/databaseCommandService");
+const { createMcpServices } = require("./mcp/stdioServer");
+const { createMcpHttpRouter } = require("./mcp/httpRouter");
 const { createConnectionsRouter } = require("./routes/connections");
 const { createBackupsRouter } = require("./routes/backups");
 const { createOverviewRouter } = require("./routes/overview");
@@ -71,6 +73,7 @@ const tableDesignerService = new TableDesignerService({ connectionManager });
 const mediaTaggingService = new MediaTaggingService({ connectionManager, appStateStore });
 const apiTokenService = new ApiTokenService({ appStateStore });
 const databaseCommandService = new DatabaseCommandService({ appStateStore });
+const mcpServices = createMcpServices({ appStateStore, transport: "http" });
 
 connectionManager.initialize();
 
@@ -91,6 +94,16 @@ app.use(
     legacyHeaders: false,
   })
 );
+app.use("/mcp", localRequestSecurity);
+app.use(
+  "/mcp",
+  rateLimit({
+    windowMs: 60 * 1000,
+    max: 300,
+    standardHeaders: true,
+    legacyHeaders: false,
+  })
+);
 app.use(express.json({ limit: "10mb" }));
 app.use(express.urlencoded({ extended: false }));
 
@@ -143,6 +156,7 @@ app.use(
     appStateStore,
   })
 );
+app.use("/mcp", createMcpHttpRouter({ services: mcpServices }));
 
 // auth: public favicon response; it exposes no application data.
 app.get("/favicon.ico", (req, res) => {
@@ -254,6 +268,7 @@ module.exports = {
   apiTokenService,
   connectionManager,
   databaseCommandService,
+  mcpServices,
   DEFAULT_HOST,
   DEFAULT_PORT,
   parsePortArgument,