Secure SQLite Model Context Protocol (MCP) Server for AI - n8n Workflow

Users running self-hosted n8n instances who need to expose local data to AI agents.
Automation specialists looking for robust n8n templates for database interaction.
Developers building AI tools that require secure, structured access to a SQLite backend.
Organizations prioritizing security by preventing AI agents from generating raw SQL statements.

Integrating Large Language Models (LLMs) with private data sources requires careful security considerations. This specific n8n workflow addresses the significant risk of SQL injection that arises when giving an AI agent the freedom to generate arbitrary database queries.

This n8n template provides a structure where the AI agent is only allowed to provide parameters (like table name, column values, and WHERE clauses), which are then sanitized and compiled into secure, parameterized SQL statements within the n8n environment itself. This advanced n8n workflow acts as a centralized SQLite MCP server, offering operations such as listing tables, describing schemas, reading records, inserting data, and updating rows. It utilizes multiple n8n node types—including the specialized MCP trigger and internal execution nodes—to ensure reliable and secure database management, making it an essential n8n template for production environments.

This automation operates using a recursive, tool-based architecture centered around the Model Context Protocol (MCP) framework.

1. Triggering the Workflow: The process starts with the SQLite MCP Server n8n trigger. This n8n node awaits requests from compatible AI agents (e.g., Claude Desktop).


2. Tool Execution: The AI agent selects one of the five available tools defined in this n8n workflow: ListTables, DescribeTables, ReadRows, CreateRecords, or UpdateRows.


3. Read-Only Operations: Simple, safe operations (ListTables, DescribeTables) are handled directly by Tool Code nodes using the SQLite3 library to fetch schema or table names.


4. CRUD Operations (Secure Path): For ReadRows, CreateRecords, and UpdateRows, the flow uses Tool Workflow n8n nodes. These nodes enforce a strict, pre-defined input schema (limiting the input to operation, tableName, values, and where objects).


5. Internal Execution: The Tool Workflow n8n node calls back into the same n8n workflow instance using the When Executed by Another Workflow n8n trigger, passing the structured parameters.


6. Routing: A Switch n8n node (Operation) analyzes the incoming operation parameter ('read', 'insert', or 'update') to route the request to the correct handler.


7. Database Action: Dedicated Code n8n node handlers (ReadRecords, CreateRecord, UpdateRecord) use the structured inputs to construct parameterized SQL queries, executing the final action securely against the /home/node/test.db file before returning the results back through the MCP Server n8n trigger.

To deploy this powerful n8n workflow, follow these steps. Please note that this n8n template is designed exclusively for self-hosted n8n instances as it requires access to local file storage for SQLite database operations.

1. Import the n8n workflow: Copy the provided JSON data and paste it into your self-hosted n8n instance via the 'New' menu > 'Import from JSON'.


2. Install Dependencies: Ensure your n8n environment has the sqlite3 library installed, as the Code n8n nodes rely on it. This usually requires running npm install sqlite3 within your n8n container or environment.


3. Database Configuration: Modify the database path (/home/node/test.db) in all Code n8n nodes (ReadRecords, CreateRecord, UpdateRecord, ListTables, DescribeTables). Change this to the absolute path where your SQLite database resides on the n8n host system.


4. Security Setup: Before enabling the n8n workflow, configure authentication on the SQLite MCP Server n8n node trigger for production safety.


5. Activation: Activate the n8n workflow. The MCP Server URL can now be connected to an MCP Client (like Claude Desktop) to enable AI interaction with your database.

SQLite MCP Server (MCP Trigger n8n trigger):
Function: The primary n8n trigger, exposing the workflow as a Model Context Protocol server endpoint.
Key Configuration: Configured with a unique webhook ID to listen for AI agent requests. This n8n node integrates all subsequent tool nodes.
ListTables & DescribeTables (Tool Code n8n node):
Function: Read-only tools that execute custom JavaScript code to query the SQLite schema information (sqlitemaster and PRAGMA tableinfo).
Key Configuration: Contains the necessary Node.js code to initialize sqlite3 and perform non-destructive database queries.
ReadRows, CreateRecords, UpdateRows (Tool Workflow n8n node):
Function: Securely defines the input schema for database modifications (CRUD), ensuring the AI only provides structured parameters, not raw SQL. This n8n node initiates a recursive call to the internal execution trigger.
Key Configuration: workflowInputs are strictly defined for tableName, operation, values, and where, enhancing security within the overall n8n workflow.
When Executed by Another Workflow (n8n trigger):
Function: Receives the internal call initiated by the Tool Workflow n8n node, acting as the starting point for the database manipulation sub-flow.
Key Configuration: Defines expected inputs: operation, tableName, values, where.
Operation (Switch n8n node):
Function: Routes the incoming request payload to the appropriate handling Code n8n node based on the value of operation ('read', 'insert', 'update').
ReadRecords, CreateRecord, UpdateRecord (Code n8n node):
Function: The core database handlers. They dynamically build and execute safe, parameterized SQL statements using the provided inputs, preventing SQL injection issues often associated with direct AI query generation. This specialized functionality within the n8n node is crucial for data integrity.