dynoxideBLOCK
A DynamoDB emulator in Rust, backed by SQLite. Starts in milliseconds as a single static binary, and is verified against real AWS by a public conformance suite. Runs as an HTTP server, an MCP server for coding agents, an embeddable library, or in the browser via WebAssembly.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://crates.io/crates/dynoxide-rs) [](https://docs.rs/dynoxide-rs) [](https://github.com/nubo-db/dynoxide/actions/workflows/ci.yml) [](https://paritysuite.org) [](#license)
A DynamoDB emulator in Rust, backed by SQLite. Runs as an HTTP server or an MCP server for coding agents, embeds into Rust and iOS applications as a library, and compiles to WebAssembly for the browser.
The crates.io badge above shows the crate version, which covers the Rust library alone. Everything you install rather than depend on carries a separate product version: the binary, the npm packages, the container images, the browser engine and the Action. That is the number dynoxide --version prints and the one to quote in a bug report. Why there are two.Why Dynoxide?
I built Dynoxide because DynamoDB Local is slow, heavy, and can't embed. It needs a JVM, and the typical Docker-based setups adds ~3 seconds of cold-start, ~209 MB of memory at idle, and a ~225MB Docker image (~473 MB on disk) before you've done anything useful. If you're running integration tests, that's Docker starting, the JVM warming up, and your pipeline waiting.
Dynoxide is a native binary. It starts in milliseconds, idles at ~7.2 MB, and ships as a ~3 MB download. Point any
0122aa075ba5OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add dynoxide -- npx -y [email protected] mcp
claude mcp add dynoxide:0.0.0-development -- docker run -i --rm ghcr.io/nubo-db/dynoxide:0.0.0-development:None mcp
Trust audit
BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
let err = validate_key("-----BEGIN PRIVATE KEY-----\nfoo").unwrap_err();# test whose endpoint is `http://127.0.0.1`. See tests/aws_sdk_integration.rs.
option-a-encrypted.db
option-a-unencrypted.db
.kos
await exec(handle, "CREATE TABLE t (pk TEXT, sk TEXT, n INTEGER)", []);
await exec(handle, "INSERT INTO t (pk, sk, n) VALUES (?, ?, ?)", ["u#1", "a", 10]);
await exec(handle, "INSERT INTO t (pk, sk, n) VALUES (?, ?, ?)", ["u#1", "b", 20]);
await exec(handle, "CREATE TABLE t (pk TEXT, sk TEXT)", []);
await exec(handle, "INSERT INTO t (pk, sk) VALUES (?, ?)", [pk, sk]);
tar czf ../../../dynoxide-${{ matrix.target }}.tar.gz dynoxidecd ../../..
tar czf ../../../dynoxide-${{ matrix.target }}.tar.gz dynoxidecd ../../..
values["ci_commit_link_root"] = "[`{}`](../../commit/{})".format(short_sha, sha)if curl -fsS http://127.0.0.1:8000/ | grep -q 'healthy'; then
resp=$(curl -fsS -X POST http://127.0.0.1:19280/mcp \
code=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:19280/mcp \- **Validates the `Origin` header** when present, against `http://localhost`, `http://127.0.0.1`, and any added hosts; anything else returns `403`. Native MCP clients (Claude Code, Cursor, the dynoxid
@playwright/test, @sqlite.org/sqlite-wasm, esbuild
- A PartiQL `SELECT` is served from the index its `FROM` clause names ([#179](https://github.com/nubo-db/dynoxide/issues/179)). `SELECT * FROM "table"."index"` used to discard the index and scan the b
- Hardened the wasm engine preview ahead of a stable `@dynoxide/wasm-engine` publish. A body-less operation such as `ListTables` now round-trips instead of failing as a `SerializationException` ([#65]
- **MCP over HTTP now requires a bearer token.** Existing HTTP-transport clients break until they send an `Authorization: Bearer <token>` header. A loopback bind generates and persists a token on firs
Point an HTTP-transport MCP client at the endpoint and send the token in an
Gates applied: critical_finding, no_behavioural_pass.
0122aa075ba5full audit observations/trust-audit/mcp-server/nubo-db__dynoxide.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 0122aa075ba5 | BLOCK | D | 62 | first audit |
Questions
What is the dynoxide MCP server?
A DynamoDB emulator in Rust, backed by SQLite. Starts in milliseconds as a single static binary, and is verified against real AWS by a public conformance suite. Runs as an HTTP server, an MCP server for coding agents, an embeddable library, or in the browser via WebAssembly.
Is dynoxide safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (62/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does dynoxide need?
No credential environment variables were found in its source, so it appears to need none.
How does dynoxide run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as dynoxide-wasm at 0.0.0.
How current is this page?
The grade is for one exact copy of the source (0122aa075ba5), read on 2026-10-12. The repository is watched and re-audited when it changes.