
Product
PHP and Composer Support Is Now in Beta
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.
spreadsheet-db-mcp
Advanced tools
stdio MCP server exposing a SQLite-authoritative entity database with an async Google Sheets projection to AI agents.
A Model Context Protocol (MCP) server that lets AI agents (Claude Desktop, Cursor, Windsurf, …) work with entities managed by Hikoutei — a typed repository where local SQLite is the authority and Google Sheets is an asynchronous, human-facing projection.
Agents read and write SQLite through the same entity-lifecycle API an application would use. Sheet delivery happens in the background via Hikoutei's durable outbox, so an agent never fights the Sheets API quota, and a human editing the Sheet never gets silently overwritten: their edits surface as conflicts that need a human decision.
Status: v0.1.0 — published to npm as
spreadsheet-db-mcp. Releases are taggedmcp-vX.Y.Z; themcp-publishworkflow patches the manifest, verifies a bare consumer install, and publishes with provenance.
Direct Sheets-API MCP servers hit three walls quickly: quota errors (429), schema-less cells (anything lands anywhere), and silent clobbering of concurrent human edits. Hikoutei's model avoids all three by design:
flush() is fast and offline.User_Input projection are detected,
recorded, and never auto-overwritten. v1 exposes them read-only via list_conflicts.npx -y spreadsheet-db-mcp
The server needs (1) an entity declaration file and (2) the same environment variables the library uses.
hikoutei.config.jsonSearch order: --config <path> flag → HIKOUTEI_MCP_CONFIG env var →
./hikoutei.config.json in the working directory.
{
"entities": [
{
"name": "users",
"tableName": "users",
"properties": {
"id": { "type": "string", "primary": true },
"name": { "type": "string" },
"age": { "type": "number", "nullable": true },
"createdAt": { "type": "date" }
}
}
]
}
type is one of string, number, boolean, date (ISO 8601 strings cross the tool boundary).primary: true; it is immutable after create.| Variable | Meaning |
|---|---|
HIKOUTEI_SYNC_SPREADSHEET_URL | Spreadsheet URL; absent ⇒ local-only mode (no Google contact) |
GOOGLE_APPLICATION_CREDENTIALS | Service-account key file path (from hikoutei setup) |
HIKOUTEI_DB_PATH | SQLite path; default ./hikoutei.sqlite |
The server loads .env (or --env <path>) into gaps in the environment before startup, so the
.env written by hikoutei setup can be reused as-is. Variables already set in the process
always win.
{
"mcpServers": {
"hikoutei": {
"command": "npx",
"args": ["-y", "spreadsheet-db-mcp"],
"env": {
"HIKOUTEI_SYNC_SPREADSHEET_URL": "https://docs.google.com/spreadsheets/d/<ID>/edit",
"GOOGLE_APPLICATION_CREDENTIALS": "~/.gcp/hikoutei-service-account.json"
}
}
}
}
For a local (unpublished) build, point command at node with
<repo>/packages/mcp/dist/index.js as the argument and set the working directory where
hikoutei.config.json lives.
| Tool | Input | Behavior |
|---|---|---|
list_entities | — | Entities with fields, types, primary keys |
create_record | entity, data | Validate → insert into SQLite → return stored row |
find_records | entity, where?, limit?, offset?, orderBy? | Filtered read; limit default 50, max 500 |
get_record | entity, id | Single read by primary key |
update_record | entity, id, data | Partial update; primary key immutable |
delete_record | entity, id | Delete by primary key |
get_sync_status | — | Mode, bound spreadsheet ID, outbox counts, unresolved conflict counts |
list_conflicts | limit? | Unresolved human-edit conflicts (read-only) |
where maps a field to a value (equality) or an operator object:
eq, ne, gt, gte, lt, lte, in, nin, like.
npm run build # root build builds ikisaki → root dist → this package
mkdir -p /tmp/spreadsheet-db-mcp-demo && cd /tmp/hikoutei-mcp-demo
# write hikoutei.config.json (see above; no env needed for local-only mode)
npx @modelcontextprotocol/inspector /path/to/Hikoutei/packages/mcp/dist/index.js
In the Inspector: connect → list tools → call list_entities, create_record,
get_sync_status (expect {"mode": "local"}). No credentials are required for this smoke test.
resolve_conflict yet. Conflicts are listed read-only; resolution tooling is planned.hikoutei.config.json; defining entities
at call time is not supported.spreadsheet-db-mcp processes against the
same SQLite file concurrently is not supported.get_sync_status / list_conflicts read the internal sync tables through the unstable
hikoutei/internal/sync-status subpath, which is reserved for first-party tooling.npm run build -w spreadsheet-db-mcp # after the root build
npm run typecheck:test # includes packages/mcp
npm test # vitest includes packages/mcp/test
License: MIT (same as the repository).
FAQs
stdio MCP server exposing a SQLite-authoritative entity database with an async Google Sheets projection to AI agents.
We found that spreadsheet-db-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.

Research
/Security News
Three compromised Rust crates pulled in a malicious dependency that downloaded and executed cross-platform malware during Cargo builds.