diff --git a/src/sqlite/src/mcp_server_sqlite/server.py b/src/sqlite/src/mcp_server_sqlite/server.py index 44913c817f..9a2fb677e7 100644 --- a/src/sqlite/src/mcp_server_sqlite/server.py +++ b/src/sqlite/src/mcp_server_sqlite/server.py @@ -349,8 +349,10 @@ async def handle_call_tool( return [types.TextContent(type="text", text=str(results))] elif name == "write_query": - if arguments["query"].strip().upper().startswith("SELECT"): - raise ValueError("SELECT queries are not allowed for write_query") + query_upper = arguments["query"].strip().upper() + allowed_prefixes = ("INSERT", "UPDATE", "DELETE") + if not query_upper.startswith(allowed_prefixes): + raise ValueError("Only INSERT, UPDATE, or DELETE queries are allowed for write_query") results = db._execute_query(arguments["query"]) return [types.TextContent(type="text", text=str(results))]