Struct Cli 

pub struct Cli {
    pub database: String,
    pub init_sql: Vec<PathBuf>,
    pub preset: Preset,
    pub allow: Vec<AccessControlSelector>,
    pub deny: Vec<AccessControlSelector>,
    pub timeout_ms: Option<u64>,
}

An MCP server that exposes a SQLite database over MCP (Model Context Protocol), with fine-grained access control for every SQL operation SQLite can perform.

Access control is built on a preset system layered with explicit overrides. Start by choosing a –preset (defaults to read-only), then refine with –allow and –deny flags:

• Read all column reads
• Read(Students) reads on the Students table
• Read(*.ssn) reads on any ssn column
• Function(count) the count() SQL function

More specific selectors (more pinned fields) override less specific ones. When allow and deny conflict at the same specificity, deny wins.

Fields

database: String

The SQLite database URI. Defaults to a shared in-memory database. Use a file URI for persistence (e.g. file:./app.db). Query parameters like ?mode=ro and ?cache=shared are supported.

init_sql: Vec<PathBuf>

Paths to SQL files executed once when creating a new database. Skipped entirely if the database file already exists. Use this to set up schemas and seed data on first run. May be specified multiple times on the CLI or as a comma-separated list in the environment variable.

preset: Preset

The baseline permission preset that determines which SQL operations are allowed or denied before any –allow / –deny overrides are applied.

allow: Vec<AccessControlSelector>

Allow a specific SQL operation. Accepts a selector in the form Action or Action(field1.field2) where * is a wildcard. More specific rules override less specific ones. May be specified multiple times on the CLI or as a comma-separated list in the environment variable.

deny: Vec<AccessControlSelector>

Deny a specific SQL operation. Same selector syntax as –allow. When an allow and deny rule match at the same specificity level, deny wins. May be specified multiple times on the CLI or as a comma-separated list in the environment variable.

timeout_ms: Option<u64>

Maximum time in milliseconds that any single SQL operation is allowed to run before being interrupted. When set, a progress handler is installed on each connection that aborts queries exceeding this duration. Omit for no timeout.

Trait Implementations

impl Args for Cli

fn group_id() -> Option<Id>

Report the ArgGroup::id for this set of arguments

fn augment_args<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate Self via FromArgMatches::from_arg_matches_mut

fn augment_args_for_update<'b>(__clap_app: Command) -> Command

Append to Command so it can instantiate self via FromArgMatches::update_from_arg_matches_mut

impl CommandFactory for Cli

fn command<'b>() -> Command

Build a Command that can instantiate Self.

fn command_for_update<'b>() -> Command

Build a Command that can update self.

impl FromArgMatches for Cli

fn from_arg_matches(__clap_arg_matches: &ArgMatches) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn from_arg_matches_mut( __clap_arg_matches: &mut ArgMatches, ) -> Result<Self, Error>

Instantiate Self from ArgMatches, parsing the arguments as needed.

fn update_from_arg_matches( &mut self, __clap_arg_matches: &ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

fn update_from_arg_matches_mut( &mut self, __clap_arg_matches: &mut ArgMatches, ) -> Result<(), Error>

Assign values from ArgMatches to self.

impl Parser for Cli

fn parse() -> Self

Parse from std::env::args_os(), exit on error.

fn try_parse() -> Result<Self, Error>

Parse from std::env::args_os(), return Err on error.

fn parse_from<I, T>(itr: I) -> Self

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Parse from iterator, exit on error.

fn try_parse_from<I, T>(itr: I) -> Result<Self, Error>

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Parse from iterator, return Err on error.

fn update_from<I, T>(&mut self, itr: I)

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Update from iterator, exit on error.

fn try_update_from<I, T>(&mut self, itr: I) -> Result<(), Error>

where I: IntoIterator<Item = T>, T: Into<OsString> + Clone,

Update from iterator, return Err on error.