Let AI agents touch
production SQLite — safely.
SQLite now runs in production on D1, Turso, and LiteFS — and AI agents are writing to it. Litescope is the safety layer: every write is dry-run by default with the exact blast radius, and one call away from undo — a local snapshot or a Cloudflare D1 Time Travel bookmark, captured automatically before the write. Diagnose before it, rewind after it — all as MCP tools Claude can call directly. One binary.
"It's just a file."
Not anymore.
That was true when SQLite was a dev toy. Now D1, Turso, and LiteFS run it in production — per-tenant, globally distributed, thousands of instances. But the tooling stayed in the toy era: no way to observe a fleet, no bisect, no salvage, no pg_stat equivalent. sqlite3 assumes one database; production assumes thousands.
And now AI agents write to it directly. Litescope is the safety layer that makes that safe — dry-run blast radius before every write, one-call undo after — on top of the ops layer SQLite never had: fleet health, file-level superpowers, and lock & WAL diagnostics a generic DB client structurally can't do.
Every operation, one binary
A pure-Go CLI with zero dependencies. Works on local files and remote databases through the same commands.
One command, one verdict
Point it at a database and get a single checkup — integrity, health, index advice, and schema lint — with a shareable, self-contained HTML report.
Fix "database is locked"
Diagnose SQLITE_BUSY — the #1 SQLite production failure. Inspects journal mode, busy_timeout, and WAL bloat with the exact PRAGMA fix; --live finds the process holding the lock right now.
Point-in-time backups
Consistent VACUUM INTO snapshots for local and Turso SQLite, with retention and an integrity-checked restore — the same "did you back up?" safety net D1 gets from Time Travel.
Self-driving DBA
ANALYZE, PRAGMA optimize, auto-add missing foreign-key indexes, and (with --aggressive) VACUUM and redundant-index cleanup — each explained in plain language. Dry-run by default, auto-snapshot before applying.
See what changed
Human-readable schema and data diff between any two databases. JSON, Markdown, and HTML output for CI and PR comments.
Catch schema smells
Flags SQLite design anti-patterns — no primary key, untyped columns, non-STRICT tables, AUTOINCREMENT, non-integer PKs — in CI, before they ship.
Fix slow queries
Catch the performance bugs AI-generated schemas ship: foreign keys with no index, redundant indexes, and full table scans. Get runnable CREATE INDEX fixes.
Inspect & diagram
Inspect tables, columns, and indexes on local, Turso, or D1 — or emit a Mermaid ERD with --erd to paste straight into a GitHub README.
Portable SQL export
Export schema + data to portable SQL with sqlite3 .dump parity — blob/NULL/quote-safe and round-trip verified. Schema-only or per-table too.
Spreadsheet to SQLite
Turn a CSV, TSV, or JSON file into a real, typed SQLite database in one command — header-aware, type-inferred. Or just run litescope yourfile.csv and it imports itself. Fix it, then export it back out.
Scrape it into Grafana
Render fleet health and schema-drift as Prometheus / OpenMetrics text — one-shot for a textfile collector, or --serve a /metrics endpoint. Drops straight into Grafana and Alertmanager.
Spot faults early
One command flags corruption, WAL bloat from a starved checkpoint, and fragmentation — the faults that silently break production SQLite.
Lock your schema in CI
Snapshot a known-good schema and fail the build when an unplanned change sneaks in. Migration locking for your pipeline.
Browse your data
Visual table explorer with row-level queries and a SQL console. Get oriented fast without leaving the app.
Let your AI drive it
A full MCP server — tools, prompts, and resources. Claude inspects, queries, and (with --allow-writes) mutates safely: writes are dry-run by default, report exact rows affected, and auto-snapshot before applying. Canned prompts like diagnose_locked_database chain the tools into a safe plan.
See the blast radius first
Diff → runnable SQL with every op classified Safe / Risky / Destructive, plus declarative plan (with a CI drift gate) and versioned authoring (new / status) — Atlas-grade. Apply safely with apply/up: auto-backup, single transaction, FK verification, and rollback.
Catch drift over time
Baseline a known-good schema and check for drift on demand (cron/CI), or watch continuously with webhook alerts to Slack and Discord.
Trust your backups
Batch PRAGMA integrity checks plus schema and row-count comparison against a reference. Catch a bad backup before you need it.
Operate hundreds at once
Read-only shock diagnosis — fingerprint + health across a Turso org or D1 account — and the full lifecycle: converge drift to canonical, recover corrupt databases, staged canary rollouts. A fleet of any size.
Your fleet in a browser
One command — litescope serve — opens a local web dashboard: topology map colored by health, worst-first faults, a schema-drift fingerprint, and an interactive ERD. Browse and query tables, drag-drop a CSV to import, and use the visual diff panel to review schema and row-count changes between any two databases before you apply. Runs on your machine — no cloud, no account, no telemetry.
Three steps to production safety
Baseline
Snapshot your known-good schema. Takes one command and outputs a versioned JSON file you commit to your repo.
Watch
Run drift detection on a schedule or continuously. Get instant alerts when something changes unexpectedly.
Operate
Validate backups, generate safe migrations, and roll them out across your entire fleet with one command.
One database is fine.
A thousand is a different job.
Turso and Cloudflare D1 made one-database-per-tenant the norm — hundreds or thousands of SQLite files, each its own production system. That's exactly where the old tools assume "one database" and fall apart. Three moments turn a quiet fleet into a 3 a.m. page.
"I thought I ran one schema."
A per-tenant migration half-fails and your fleet quietly splits into many shapes — and you don't know it happened. The next migration is the one that breaks. sqlite3 can't tell you this; fleet fingerprint shows exactly how many schemas you really run.
"How do I roll this out safely?"
DDL locks the entire SQLite file. A migration across 500 tenants is 500 downtime rolls of the dice. migrate apply wraps each in backup → transaction → FK verify → auto-rollback; fleet migrate --canary proves it on a few before the rest.
"Which ones broke, and how bad?"
The first command to run when the pager fires. fleet health triages every database worst-first, fleet recover restores from verified backups, and blast-radius flags the at-risk neighbors in the same group.
Run the shock diagnosis, see your own drift, and fix the whole fleet — free and open source, on a fleet of any size.
Diagnose, then treat —
schema and faults.
Per-tenant SQLite is exploding, and they don't drift into one shape — they fracture into many. Litescope runs the fleet the way an SRE runs a service.
-
fingerprint Cluster every database by schema. You think you run one — see how many you actually run, and exactly how each drifted.
-
health Parallel fault triage: corruption, WAL bloat from a starved checkpoint, fragmentation, unreachable. Sorted worst-first.
-
converge Auto-generate and stage the migration that brings every drifted database back to canonical — canary, halt-on-failure, rollback.
-
recover Restore corrupt databases from verified backups; quarantine the unrecoverable so they're excluded from future ops.
Claude speaks D1
natively.
Litescope is the MCP server built for Cloudflare D1. One config line and Claude can inspect, query, migrate, and rewind any D1 database — no API code, no dashboard. Speaks the current 2026-07-28 spec, and still serves older clients on 2025-06-18.
-
Read-only by default
litescope mcp— health, schema, diff, query, fleet fingerprint. Safe to give to any agent. -
Opt-in writes, guarded
litescope mcp --allow-writesunlocksquery_write,migrate_apply,autopilot,snapshot/restore, and D1 lifecycle tools. Writes are dry-run by default — they report exact rows affected and auto-snapshot before applying. -
Prompts & resources Canned workflows (diagnose_locked_database, review_migration) and readable schema + data-dictionary resources, so the agent gets context without spending a tool call.
-
One command in Claude Code Install the plugin and you get the server plus five skills — lock doctor, safe writes, migration review, fleet sweep, corruption recovery — so the agent knows what to do when a database is actually broken.
/plugin marketplace add croc100/Litescope, then/plugin install litescope@litescope. -
Panels, not walls of JSON Four tools answer with an interactive view rendered inside the conversation (MCP Apps): the lock doctor, a health panel, a write's blast radius, and the fleet grid. They fetch nothing, and they never write — an apply or undo button hands the request back to the chat.
-
Time Travel from chat Ask Claude to rewind a D1 database to any point in the last 30 days — no API call needed from your side.
Every D1 operation
you actually need.
Beyond the dashboard. Litescope fills the gaps that wrangler d1 leaves open.
-
Pull to local
litescope d1 pull d1://DB_UUID ./local.db— full schema + data in one command. Inspect, diff, or restore offline. -
Push from local
litescope d1 push ./seed.db d1://DB_UUID— seed a fresh D1 or restore from a local snapshot. -
Schema diff → migration
litescope migrate ./local.db d1://proddiffs any two sources and generates ready-to-apply SQL. -
Time Travel
litescope rewind d1://DB_UUID --to "2h ago"— any point in 30 days, with human-readable durations. -
Bisect
litescope bisect d1://DB_UUID --good "3d ago" --bad now --check "SELECT COUNT(*) FROM users" --expect "gt:0"— binary-search Time Travel to pinpoint the breaking change.
The whole toolchain is free.
Forever.
Litescope is open source under the GNU AGPL-3.0. Every command — diff, migrate, monitor, the entire fleet lifecycle, and the local web dashboard — is unlocked for everyone, on a fleet of any size. No license key, no tiers, nothing to unlock. The line is simple: the software and every feature is free and self-hostable forever — you pay only if you want us to host and operate the dashboard for you.
One thing we'll host for you
The only paid offering runs beside the open-source tool, never
gating it. The CLI you already use becomes the agent — litescope push
streams health and schema metadata (never your data) to a hosted dashboard
that shows your entire fleet, thousands of instances, on one screen, with
time-series drift history and alerts when something breaks. It runs on a
metadata-only edge stack (Cloudflare Workers + D1) — and you only need it if
you'd rather not self-host: litescope serve gives you the same
dashboard locally, free.
- ✓Up to 25 databases
- ✓Multi-user, time-series drift history
- ✓Fault & drift alerts
- ✓Metadata only — never your data
- ✓Up to 250 databases
- ✓Everything in Hosted
- ✓Self-host option (your cloud / on-prem)
- ✓Priority support
Pick your tier at checkout. The CLI, local dashboard, and self-hosting stay free forever. Questions? Email us or see the roadmap.
Run this locally today with litescope serve — free. The hosted version is the multi-user, always-on cloud edition.
Up and running in seconds
One pure-Go binary. No runtime, no dependencies.
Operational power, without surveillance
Litescope is part of CRODE — a family of secure, privacy-respecting tools built on one principle: give you full power over your systems without watching what you do with it. Every Litescope action is verifiable and data-minimal by design.
The hosted dashboard streams schema and health metadata — never your rows. Your data stays in your database.
Every write previews its exact blast radius — rows affected, auto-snapshot first. Nothing changes until you say so.
Open source under AGPL, audit the --dry-run payload yourself. Trust the tool because you can check it.