mcp-mongo-server 2.0.2 → 2.1.1

package/README.md

@@ -4,8 +4,6 @@
 ![NPM Version](https://img.shields.io/npm/v/mcp-mongo-server)
 ![NPM Downloads](https://img.shields.io/npm/dm/mcp-mongo-server)
 ![NPM License](https://img.shields.io/npm/l/mcp-mongo-server)
-[![smithery badge](https://smithery.ai/badge/mcp-mongo-server)](https://smithery.ai/server/mcp-mongo-server)
-[![Verified on MseeP](https://mseep.ai/badge.svg)](https://mseep.ai/app/e274a3dd-7fe6-4440-8c43-043bae668251)
 
 A Model Context Protocol server that enables LLMs to interact with MongoDB databases. This server provides capabilities for inspecting collection schemas and executing MongoDB operations through a standardized interface.
 

package/build/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
 
 // src/mongo.ts
 import { MongoClient, ReadPreference } from "mongodb";
@@ -32,6 +32,10 @@ async function connectToMongoDB(url, readOnly) {
 }
 
 // src/server.ts
+import {
+  InMemoryTaskMessageQueue,
+  InMemoryTaskStore
+} from "@modelcontextprotocol/sdk/experimental/tasks";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import {
   CallToolRequestSchema,
@@ -46,6 +50,10 @@ import {
 } from "@modelcontextprotocol/sdk/types.js";
 
 // src/schemas/call.ts
+import {
+  ErrorCode,
+  McpError
+} from "@modelcontextprotocol/sdk/types.js";
 import { ObjectId } from "mongodb";
 var COLLECTION_OPERATIONS = [
   "query",
@@ -56,11 +64,40 @@ var COLLECTION_OPERATIONS = [
   "count"
 ];
 var WRITE_OPERATIONS = ["update", "insert", "createIndex"];
+var READONLY_FORBIDDEN_AGG_OPERATORS = /* @__PURE__ */ new Set([
+  "$out",
+  "$merge",
+  "$function",
+  "$accumulator",
+  "$where"
+]);
+function findForbiddenAggOperator(value) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const found = findForbiddenAggOperator(item);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (value && typeof value === "object") {
+    for (const [key, nested] of Object.entries(value)) {
+      if (READONLY_FORBIDDEN_AGG_OPERATORS.has(key)) {
+        return key;
+      }
+      const found = findForbiddenAggOperator(nested);
+      if (found) return found;
+    }
+  }
+  return null;
+}
 async function handleCallToolRequest({
   request,
   client,
   db,
-  isReadOnlyMode
+  isReadOnlyMode,
+  signal,
+  taskStore,
+  taskTtl
 }) {
   const { name, arguments: args = {} } = request.params;
   const operation = name;
@@ -76,37 +113,93 @@ async function handleCallToolRequest({
   }
   Object.assign(args, filteredArgs);
   validateOperation(operation);
-  checkReadOnlyMode(operation, isReadOnlyMode);
-  let collection = null;
-  if (COLLECTION_OPERATIONS.includes(operation)) {
-    const collectionName = args.collection;
-    if (!collectionName) {
-      throw new Error(
-        `Collection name is required for '${operation}' operation`
-      );
+  try {
+    checkReadOnlyMode(operation, isReadOnlyMode);
+    let collection = null;
+    if (COLLECTION_OPERATIONS.includes(operation)) {
+      const collectionName = args.collection;
+      if (!collectionName) {
+        throw new Error(
+          `Collection name is required for '${operation}' operation`
+        );
+      }
+      collection = db.collection(collectionName);
+      validateCollection(collection);
+    }
+    signal?.throwIfAborted();
+    if (taskStore) {
+      const task = await taskStore.createTask({
+        ttl: taskTtl ?? void 0
+      });
+      (async () => {
+        try {
+          const result = await executeOperation(
+            operation,
+            collection,
+            db,
+            isReadOnlyMode,
+            args,
+            objectIdMode,
+            signal
+          );
+          await taskStore.storeTaskResult(task.taskId, "completed", result);
+        } catch (error) {
+          try {
+            const message = error instanceof Error ? error.message : "Unknown error";
+            await taskStore.storeTaskResult(task.taskId, "failed", {
+              content: [{ type: "text", text: message }],
+              isError: true
+            });
+          } catch {
+          }
+        }
+      })();
+      return { task };
+    }
+    return await executeOperation(
+      operation,
+      collection,
+      db,
+      isReadOnlyMode,
+      args,
+      objectIdMode,
+      signal
+    );
+  } catch (error) {
+    if (error instanceof McpError || signal?.aborted) {
+      throw error;
     }
-    collection = db.collection(collectionName);
-    validateCollection(collection);
+    return toolExecutionError(
+      error instanceof Error ? error.message : "Unknown error"
+    );
   }
+}
+async function executeOperation(operation, collection, db, isReadOnlyMode, args, objectIdMode, signal) {
   switch (operation) {
     case "query":
-      return handleQuery(collection, args, objectIdMode);
+      return handleQuery(collection, args, objectIdMode, signal);
     case "aggregate":
-      return handleAggregate(collection, args, objectIdMode);
+      return handleAggregate(
+        collection,
+        args,
+        objectIdMode,
+        isReadOnlyMode,
+        signal
+      );
     case "update":
-      return handleUpdate(collection, args, objectIdMode);
+      return handleUpdate(collection, args, objectIdMode, signal);
     case "serverInfo":
-      return handleServerInfo(db, isReadOnlyMode, args);
+      return handleServerInfo(db, isReadOnlyMode, args, signal);
     case "insert":
-      return handleInsert(collection, args, objectIdMode);
+      return handleInsert(collection, args, objectIdMode, signal);
     case "createIndex":
-      return handleCreateIndex(collection, args, objectIdMode);
+      return handleCreateIndex(collection, args, objectIdMode, signal);
     case "count":
-      return handleCount(collection, args, objectIdMode);
+      return handleCount(collection, args, objectIdMode, signal);
     case "listCollections":
-      return handleListCollections(db, args, objectIdMode);
+      return handleListCollections(db, args, objectIdMode, signal);
     default:
-      throw new Error(`Unknown operation: ${operation}`);
+      throw new McpError(ErrorCode.InvalidParams, `Unknown tool: ${operation}`);
   }
 }
 function validateOperation(operation) {
@@ -121,7 +214,7 @@ function validateOperation(operation) {
     "listCollections"
   ];
   if (!validOperations.includes(operation)) {
-    throw new Error(`Unknown operation: ${operation}`);
+    throw new McpError(ErrorCode.InvalidParams, `Unknown tool: ${operation}`);
   }
 }
 function validateCollection(collection) {
@@ -269,40 +362,64 @@ function formatResponse(data) {
     ]
   };
 }
+function toolExecutionError(message) {
+  return {
+    content: [{ type: "text", text: message }],
+    isError: true
+  };
+}
 function handleError(error, operation, collectionName) {
-  const context = collectionName ? `collection ${collectionName}` : "operation";
-  if (error instanceof Error) {
-    throw new Error(`Failed to ${operation} ${context}: ${error.message}`);
+  if (error instanceof Error && error.name === "AbortError") {
+    throw error;
   }
-  throw new Error(`Failed to ${operation} ${context}: Unknown error`);
+  const context = collectionName ? `collection ${collectionName}` : "operation";
+  const message = error instanceof Error ? error.message : "Unknown error";
+  return toolExecutionError(`Failed to ${operation} ${context}: ${message}`);
 }
-async function handleQuery(collection, args, objectIdMode = "auto") {
+async function handleQuery(collection, args, objectIdMode = "auto", signal) {
   if (!collection) {
     throw new Error("Collection is required for query operation");
   }
-  const { filter, projection, limit, explain, sort } = args;
+  const { filter, projection, explain, sort } = args;
+  const limit = args.limit || 10;
+  const skip = args.skip || 0;
   const queryFilter = parseFilter(filter, objectIdMode);
   try {
     if (explain) {
+      signal?.throwIfAborted();
       const explainResult = await collection.find(queryFilter, {
         projection,
-        limit: limit || 100,
+        limit,
+        skip,
         sort
       }).explain(explain);
       return formatResponse(explainResult);
     }
-    const cursor = collection.find(queryFilter, {
-      projection,
-      limit: limit || 100,
-      sort
+    signal?.throwIfAborted();
+    const [total, results] = await Promise.all([
+      collection.countDocuments(queryFilter),
+      collection.find(queryFilter, {
+        projection,
+        limit,
+        skip,
+        sort
+      }).toArray()
+    ]);
+    return formatResponse({
+      results,
+      metadata: {
+        total,
+        returned: results.length,
+        skip,
+        limit,
+        hasMore: skip + results.length < total
+      }
     });
-    const results = await cursor.toArray();
-    return formatResponse(results);
   } catch (error) {
     return handleError(error, "query", collection.collectionName);
   }
 }
-async function handleAggregate(collection, args, objectIdMode = "auto") {
+async function handleAggregate(collection, args, objectIdMode = "auto", isReadOnlyMode = false, signal) {
   if (!collection) {
     throw new Error("Collection is required for aggregate operation");
   }
@@ -310,6 +427,14 @@ async function handleAggregate(collection, args, objectIdMode = "auto") {
   if (!Array.isArray(pipeline)) {
     throw new Error("Pipeline must be an array");
   }
+  if (isReadOnlyMode) {
+    const forbidden = findForbiddenAggOperator(pipeline);
+    if (forbidden) {
+      throw new Error(
+        `ReadonlyError: Aggregation operator '${forbidden}' is not allowed in read-only mode`
+      );
+    }
+  }
   const processedPipeline = pipeline.map((stage) => {
     if (typeof stage === "object" && stage !== null) {
       return processObjectIdInFilter(
@@ -321,6 +446,7 @@ async function handleAggregate(collection, args, objectIdMode = "auto") {
   });
   try {
     if (explain) {
+      signal?.throwIfAborted();
       const explainResult = await collection.aggregate(processedPipeline, {
         explain: {
           verbosity: explain
@@ -328,13 +454,19 @@ async function handleAggregate(collection, args, objectIdMode = "auto") {
       }).toArray();
       return formatResponse(explainResult);
     }
+    signal?.throwIfAborted();
     const results = await collection.aggregate(processedPipeline).toArray();
-    return formatResponse(results);
+    return formatResponse({
+      results,
+      metadata: {
+        returned: results.length
+      }
+    });
   } catch (error) {
     return handleError(error, "aggregate", collection.collectionName);
   }
 }
-async function handleUpdate(collection, args, objectIdMode = "auto") {
+async function handleUpdate(collection, args, objectIdMode = "auto", signal) {
   if (!collection) {
     throw new Error("Collection is required for update operation");
   }
@@ -375,6 +507,7 @@ async function handleUpdate(collection, args, objectIdMode = "auto") {
       multi: !!multi
     };
     const updateMethod = options.multi ? "updateMany" : "updateOne";
+    signal?.throwIfAborted();
     const result = await collection[updateMethod](
       queryFilter,
       processedUpdate,
@@ -390,35 +523,33 @@ async function handleUpdate(collection, args, objectIdMode = "auto") {
     return handleError(error, "update", collection.collectionName);
   }
 }
-async function handleServerInfo(db, isReadOnlyMode, args) {
+async function handleServerInfo(db, isReadOnlyMode, args, signal) {
   const { includeDebugInfo } = args;
   try {
+    signal?.throwIfAborted();
     const buildInfo = await db.command({ buildInfo: 1 });
-    let serverStatus = null;
-    if (includeDebugInfo) {
-      serverStatus = await db.command({ serverStatus: 1 });
-    }
     const serverInfo = {
       version: buildInfo.version,
       gitVersion: buildInfo.gitVersion,
-      modules: buildInfo.modules,
-      allocator: buildInfo.allocator,
-      javascriptEngine: buildInfo.javascriptEngine,
-      sysInfo: buildInfo.sysInfo,
       storageEngines: buildInfo.storageEngines,
-      debug: buildInfo.debug,
       maxBsonObjectSize: buildInfo.maxBsonObjectSize,
-      openssl: buildInfo.openssl,
-      buildEnvironment: buildInfo.buildEnvironment,
       bits: buildInfo.bits,
       ok: buildInfo.ok,
-      status: {},
       connectionInfo: {
         readOnlyMode: isReadOnlyMode,
         readPreference: isReadOnlyMode ? "secondary" : "primary"
       }
     };
-    if (serverStatus) {
+    if (includeDebugInfo) {
+      signal?.throwIfAborted();
+      const serverStatus = await db.command({ serverStatus: 1 });
+      serverInfo.modules = buildInfo.modules;
+      serverInfo.allocator = buildInfo.allocator;
+      serverInfo.javascriptEngine = buildInfo.javascriptEngine;
+      serverInfo.sysInfo = buildInfo.sysInfo;
+      serverInfo.debug = buildInfo.debug;
+      serverInfo.openssl = buildInfo.openssl;
+      serverInfo.buildEnvironment = buildInfo.buildEnvironment;
       serverInfo.status = {
         host: serverStatus.host,
         version: serverStatus.version,
@@ -440,7 +571,7 @@ async function handleServerInfo(db, isReadOnlyMode, args) {
     return handleError(error, "get server information");
   }
 }
-async function handleInsert(collection, args, objectIdMode = "auto") {
+async function handleInsert(collection, args, objectIdMode = "auto", signal) {
   if (!collection) {
     throw new Error("Collection is required for insert operation");
   }
@@ -466,6 +597,7 @@ async function handleInsert(collection, args, objectIdMode = "auto") {
       writeConcern,
       bypassDocumentValidation
     };
+    signal?.throwIfAborted();
     const result = await collection.insertMany(
       processedDocuments,
       options
@@ -488,7 +620,7 @@ async function handleInsert(collection, args, objectIdMode = "auto") {
     return handleError(error, "insert", collection.collectionName);
   }
 }
-async function handleCreateIndex(collection, args, objectIdMode = "auto") {
+async function handleCreateIndex(collection, args, objectIdMode = "auto", signal) {
   if (!collection) {
     throw new Error("Collection is required for createIndex operation");
   }
@@ -517,6 +649,7 @@ async function handleCreateIndex(collection, args, objectIdMode = "auto") {
     const indexOptions = {
       commitQuorum: typeof commitQuorum === "number" ? commitQuorum : void 0
     };
+    signal?.throwIfAborted();
     const result = await collection.createIndexes(
       processedIndexes,
       indexOptions
@@ -531,7 +664,7 @@ async function handleCreateIndex(collection, args, objectIdMode = "auto") {
     return handleError(error, "create indexes", collection.collectionName);
   }
 }
-async function handleCount(collection, args, objectIdMode = "auto") {
+async function handleCount(collection, args, objectIdMode = "auto", signal) {
   if (!collection) {
     throw new Error("Collection is required for count operation");
   }
@@ -551,6 +684,7 @@ async function handleCount(collection, args, objectIdMode = "auto") {
         delete options[key];
       }
     }
+    signal?.throwIfAborted();
     const count = await collection.countDocuments(countQuery, options);
     return formatResponse({
       count,
@@ -560,8 +694,10 @@ async function handleCount(collection, args, objectIdMode = "auto") {
     return handleError(error, "count documents", collection.collectionName);
   }
 }
-async function handleListCollections(db, args, objectIdMode = "auto") {
+async function handleListCollections(db, args, objectIdMode = "auto", signal) {
   const { nameOnly, filter } = args;
+  const skip = args.skip || 0;
+  const limit = args.limit || 20;
   let processedFilter = filter;
   if (filter && typeof filter === "object") {
     processedFilter = processObjectIdInFilter(
@@ -571,20 +707,58 @@ async function handleListCollections(db, args, objectIdMode = "auto") {
   }
   try {
     const options = processedFilter ? { filter: processedFilter } : {};
+    signal?.throwIfAborted();
     const collections = await db.listCollections(options).toArray();
-    const result = nameOnly ? collections.map((collection) => collection.name) : collections;
-    return formatResponse(result);
+    const allResults = nameOnly ? collections.map((collection) => collection.name) : collections;
+    const total = allResults.length;
+    const paged = allResults.slice(skip, skip + limit);
+    return formatResponse({
+      results: paged,
+      metadata: {
+        total,
+        returned: paged.length,
+        skip,
+        limit,
+        hasMore: skip + paged.length < total
+      }
+    });
   } catch (error) {
     return handleError(error, "list collections");
   }
 }
 
+// src/utils/pagination.ts
+var DEFAULT_PAGE_SIZE = 20;
+function encodeCursor(offset) {
+  const data = { offset };
+  return Buffer.from(JSON.stringify(data)).toString("base64");
+}
+function decodeCursor(cursor) {
+  if (!cursor) return 0;
+  try {
+    const data = JSON.parse(
+      Buffer.from(cursor, "base64").toString("utf-8")
+    );
+    return typeof data.offset === "number" && data.offset >= 0 ? data.offset : 0;
+  } catch {
+    return 0;
+  }
+}
+function paginate(items, cursor, pageSize = DEFAULT_PAGE_SIZE) {
+  const offset = decodeCursor(cursor);
+  const page = items.slice(offset, offset + pageSize);
+  const nextOffset = offset + pageSize;
+  const nextCursor = nextOffset < items.length ? encodeCursor(nextOffset) : void 0;
+  return { items: page, nextCursor };
+}
+
 // src/schemas/completion.ts
 async function handleCompletionRequest({
   request,
   client,
   db,
-  isReadOnlyMode
+  isReadOnlyMode,
+  signal
 }) {
   const { ref, argument } = request.params;
   if (ref.type === "ref/prompt") {
@@ -593,7 +767,8 @@ async function handleCompletionRequest({
       db,
       isReadOnlyMode,
       ref.name,
-      argument
+      argument,
+      signal
     );
   }
   if (ref.type === "ref/resource") {
@@ -602,34 +777,46 @@ async function handleCompletionRequest({
       db,
       isReadOnlyMode,
       ref.uri,
-      argument
+      argument,
+      signal
     );
   }
   return emptyCompletionResult();
 }
-async function handlePromptCompletion(client, db, isReadOnlyMode, promptName, argument) {
+async function handlePromptCompletion(client, db, isReadOnlyMode, promptName, argument, signal) {
   if (!promptName) {
     return emptyCompletionResult();
   }
   if (argument.name === "collection") {
-    return await completeCollectionNames(argument.value, db, isReadOnlyMode);
+    return await completeCollectionNames(
+      argument.value,
+      db,
+      isReadOnlyMode,
+      signal
+    );
   }
   return emptyCompletionResult();
 }
-async function handleResourceCompletion(client, db, isReadOnlyMode, promptName, argument) {
+async function handleResourceCompletion(client, db, isReadOnlyMode, promptName, argument, signal) {
   if (!promptName) {
     return emptyCompletionResult();
   }
   if (argument.name === "collection") {
-    return await completeCollectionNames(argument.value, db, isReadOnlyMode);
+    return await completeCollectionNames(
+      argument.value,
+      db,
+      isReadOnlyMode,
+      signal
+    );
   }
   return emptyCompletionResult();
 }
-async function completeCollectionNames(partialValue, db, isReadOnlyMode) {
+async function completeCollectionNames(partialValue, db, isReadOnlyMode, signal) {
   try {
     console.warn(
       `Completing collection names with partial value: ${partialValue}`
     );
+    signal?.throwIfAborted();
     const collections = await db.listCollections().toArray();
     const matchingCollections = collections.map(
       (c) => c.name
@@ -641,14 +828,17 @@ async function completeCollectionNames(partialValue, db, isReadOnlyMode) {
       )
     ).sort();
     console.warn(`Found ${matchingCollections.length} matching collections`);
-    const MAX_ITEMS = 100;
-    const limitedResults = matchingCollections.slice(0, MAX_ITEMS);
-    const hasMore = matchingCollections.length > MAX_ITEMS;
+    const PAGE_SIZE = 100;
+    const { items: limitedResults, nextCursor } = paginate(
+      matchingCollections,
+      void 0,
+      PAGE_SIZE
+    );
     return {
       completion: {
         values: limitedResults,
         total: matchingCollections.length,
-        hasMore
+        hasMore: !!nextCursor
       }
     };
   } catch (error) {
@@ -671,12 +861,14 @@ async function handlePingRequest({
   request,
   client,
   db,
-  isReadOnlyMode
+  isReadOnlyMode,
+  signal
 }) {
   try {
     if (!client) {
       throw new Error("MongoDB connection is not available");
     }
+    signal?.throwIfAborted();
     const pong = await db.command({ ping: 1 });
     if (pong.ok !== 1) {
       throw new Error(`MongoDB ping failed: ${pong.errmsg}`);
@@ -695,7 +887,8 @@ async function handleListPromptsRequest({
   request,
   client,
   db,
-  isReadOnlyMode
+  isReadOnlyMode,
+  signal
 }) {
   return {
     prompts: [
@@ -717,7 +910,9 @@ async function handleGetPromptRequest({
   request,
   client,
   db,
-  isReadOnlyMode
+  isReadOnlyMode,
+  signal,
+  sendProgress
 }) {
   const { name, arguments: args = {} } = request.params;
   if (name !== "analyze_collection") {
@@ -732,8 +927,14 @@ async function handleGetPromptRequest({
     if (collection.collectionName.startsWith("system.")) {
       throw new Error("Access to system collections is not allowed");
     }
+    await sendProgress?.(1, 3, "Getting schema");
+    signal?.throwIfAborted();
     const schemaSample = await collection.findOne({});
+    await sendProgress?.(2, 3, "Getting stats");
+    signal?.throwIfAborted();
     const stats = await collection.aggregate([{ $collStats: { count: {} } }]).toArray();
+    await sendProgress?.(3, 3, "Fetching samples");
+    signal?.throwIfAborted();
     const sampleDocs = await collection.find({}).limit(5).toArray();
     const documentCount = stats[0]?.count ?? "unknown";
     return {
@@ -864,7 +1065,9 @@ async function handleReadResourceRequest({
   request,
   client,
   db,
-  isReadOnlyMode
+  isReadOnlyMode,
+  signal,
+  sendProgress
 }) {
   const url = new URL(request.params.uri);
   const collectionName = url.pathname.replace(/^\//, "");
@@ -872,18 +1075,25 @@ async function handleReadResourceRequest({
     const collection = db.collection(collectionName);
     const sampleSize = 100;
     let sampleDocuments = [];
+    await sendProgress?.(1, 4, "Sampling documents");
     try {
+      signal?.throwIfAborted();
       sampleDocuments = await collection.aggregate([{ $sample: { size: sampleSize } }]).toArray();
     } catch (sampleError) {
       console.warn(
         `$sample aggregation failed for ${collectionName}, falling back to sequential scan: ${sampleError}`
       );
+      signal?.throwIfAborted();
       sampleDocuments = await collection.find({}).limit(sampleSize).toArray();
     }
+    await sendProgress?.(2, 4, "Getting indexes");
+    signal?.throwIfAborted();
     const indexes = await collection.indexes();
     const inferredSchema = inferSchemaFromSamples(sampleDocuments);
+    await sendProgress?.(3, 4, "Counting documents");
     let documentCount = null;
     try {
+      signal?.throwIfAborted();
       documentCount = await Promise.race([
         collection.countDocuments(),
         new Promise(
@@ -898,12 +1108,14 @@ async function handleReadResourceRequest({
         `Count operation failed or timed out for ${collectionName}: ${countError}`
       );
       try {
+        signal?.throwIfAborted();
         const stats = await db.command({ collStats: collectionName });
         documentCount = stats.count;
       } catch {
         documentCount = "unknown (count operation timed out)";
       }
     }
+    await sendProgress?.(4, 4, "Done");
     const schema = {
       type: "collection",
       name: collectionName,
@@ -940,17 +1152,23 @@ async function handleListResourcesRequest({
   request,
   client,
   db,
-  isReadOnlyMode
+  isReadOnlyMode,
+  signal
 }) {
   try {
+    signal?.throwIfAborted();
     const collections = await db.listCollections().toArray();
+    const allResources = collections.map((collection) => ({
+      uri: `mongodb:///${collection.name}`,
+      mimeType: "application/json",
+      name: collection.name,
+      description: `MongoDB collection: ${collection.name}`
+    }));
+    const cursor = request.params?.cursor;
+    const { items, nextCursor } = paginate(allResources, cursor);
     return {
-      resources: collections.map((collection) => ({
-        uri: `mongodb:///${collection.name}`,
-        mimeType: "application/json",
-        name: collection.name,
-        description: `MongoDB collection: ${collection.name}`
-      }))
+      resources: items,
+      ...nextCursor ? { nextCursor } : {}
     };
   } catch (error) {
     if (error instanceof Error) {
@@ -965,7 +1183,8 @@ async function handleListResourceTemplatesRequest({
   request,
   client,
   db,
-  isReadOnlyMode
+  isReadOnlyMode,
+  signal
 }) {
   return {
     resourceTemplates: [
@@ -1011,13 +1230,15 @@ async function handleListToolsRequest({
   request,
   client,
   db,
-  isReadOnlyMode
+  isReadOnlyMode,
+  signal
 }) {
   return {
     tools: [
       {
         name: "query",
         description: "Execute a MongoDB query with optional execution plan analysis",
+        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1038,6 +1259,11 @@ async function handleListToolsRequest({
               description: "Maximum number of documents to return",
               default: 10
             },
+            skip: {
+              type: "number",
+              description: "Number of documents to skip before returning results",
+              default: 0
+            },
             explain: {
               type: "string",
               description: "Optional: Get query execution information",
@@ -1056,6 +1282,7 @@ async function handleListToolsRequest({
       {
         name: "aggregate",
         description: "Execute a MongoDB aggregation pipeline with optional execution plan analysis",
+        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1088,6 +1315,7 @@ async function handleListToolsRequest({
       {
         name: "update",
         description: "Update documents in a MongoDB collection",
+        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1124,6 +1352,7 @@ async function handleListToolsRequest({
       {
         name: "serverInfo",
         description: "Get MongoDB server information including version, storage engine, and other details",
+        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1137,6 +1366,7 @@ async function handleListToolsRequest({
       {
         name: "insert",
         description: "Insert one or more documents into a MongoDB collection",
+        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1174,6 +1404,7 @@ async function handleListToolsRequest({
       {
         name: "createIndex",
         description: "Create one or more indexes on a MongoDB collection",
+        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1240,6 +1471,7 @@ async function handleListToolsRequest({
       {
         name: "count",
         description: "Count documents in a collection matching a query",
+        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1270,6 +1502,7 @@ async function handleListToolsRequest({
       {
         name: "listCollections",
         description: "List all collections in the MongoDB database",
+        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1281,6 +1514,16 @@ async function handleListToolsRequest({
               type: "object",
               description: "Filter for collections"
             },
+            skip: {
+              type: "number",
+              description: "Number of collections to skip before returning results",
+              default: 0
+            },
+            limit: {
+              type: "number",
+              description: "Maximum number of collections to return",
+              default: 20
+            },
             objectIdMode: {
               type: "string",
               description: "Control how 24-character hex strings are handled",
@@ -1295,11 +1538,24 @@ async function handleListToolsRequest({
 }
 
 // src/server.ts
+function createSendProgress(extra) {
+  const progressToken = extra._meta?.progressToken;
+  if (progressToken === void 0) return void 0;
+  return (progress, total, message) => extra.sendNotification({
+    method: "notifications/progress",
+    params: { progressToken, progress, total, message }
+  });
+}
 function createServer(client, db, isReadOnlyMode = false, options = {}) {
+  const taskStore = new InMemoryTaskStore();
+  const taskMessageQueue = new InMemoryTaskMessageQueue();
   const server = new Server(
     {
       name: "mongodb",
-      version: "2.0.2",
+      title: "MongoDB MCP Server",
+      version: "2.1.1",
+      description: "MCP server for MongoDB: query, aggregate, and manage collections with read-only mode, progress notifications, cancellation, and task support",
+      websiteUrl: "https://github.com/kiliczsh/mcp-mongo-server",
       ...options
     },
     {
@@ -1307,46 +1563,111 @@ function createServer(client, db, isReadOnlyMode = false, options = {}) {
         completions: {},
         resources: {},
         tools: {},
-        prompts: {}
+        prompts: {},
+        tasks: {
+          list: {},
+          cancel: {},
+          requests: { tools: { call: {} } }
+        }
       },
+      taskStore,
+      taskMessageQueue,
       ...options
     }
   );
   server.setRequestHandler(
     PingRequestSchema,
-    (request) => handlePingRequest({ request, client, db, isReadOnlyMode })
+    (request, extra) => handlePingRequest({
+      request,
+      client,
+      db,
+      isReadOnlyMode,
+      signal: extra.signal
+    })
   );
   server.setRequestHandler(
     ListResourcesRequestSchema,
-    (request) => handleListResourcesRequest({ request, client, db, isReadOnlyMode })
+    (request, extra) => handleListResourcesRequest({
+      request,
+      client,
+      db,
+      isReadOnlyMode,
+      signal: extra.signal
+    })
   );
   server.setRequestHandler(
     ReadResourceRequestSchema,
-    (request) => handleReadResourceRequest({ request, client, db, isReadOnlyMode })
+    (request, extra) => handleReadResourceRequest({
+      request,
+      client,
+      db,
+      isReadOnlyMode,
+      signal: extra.signal,
+      sendProgress: createSendProgress(extra)
+    })
   );
   server.setRequestHandler(
     ListToolsRequestSchema,
-    (request) => handleListToolsRequest({ request, client, db, isReadOnlyMode })
-  );
-  server.setRequestHandler(
-    CallToolRequestSchema,
-    (request) => handleCallToolRequest({ request, client, db, isReadOnlyMode })
+    (request, extra) => handleListToolsRequest({
+      request,
+      client,
+      db,
+      isReadOnlyMode,
+      signal: extra.signal
+    })
   );
+  server.setRequestHandler(CallToolRequestSchema, (request, extra) => {
+    const hasTaskParams = !!request.params.task;
+    return handleCallToolRequest({
+      request,
+      client,
+      db,
+      isReadOnlyMode,
+      signal: extra.signal,
+      taskStore: hasTaskParams ? extra.taskStore : void 0,
+      taskTtl: hasTaskParams ? extra.taskRequestedTtl : void 0
+    });
+  });
   server.setRequestHandler(
     ListPromptsRequestSchema,
-    (request) => handleListPromptsRequest({ request, client, db, isReadOnlyMode })
+    (request, extra) => handleListPromptsRequest({
+      request,
+      client,
+      db,
+      isReadOnlyMode,
+      signal: extra.signal
+    })
   );
   server.setRequestHandler(
     GetPromptRequestSchema,
-    (request) => handleGetPromptRequest({ request, client, db, isReadOnlyMode })
+    (request, extra) => handleGetPromptRequest({
+      request,
+      client,
+      db,
+      isReadOnlyMode,
+      signal: extra.signal,
+      sendProgress: createSendProgress(extra)
+    })
   );
   server.setRequestHandler(
     ListResourceTemplatesRequestSchema,
-    (request) => handleListResourceTemplatesRequest({ request, client, db, isReadOnlyMode })
+    (request, extra) => handleListResourceTemplatesRequest({
+      request,
+      client,
+      db,
+      isReadOnlyMode,
+      signal: extra.signal
+    })
   );
   server.setRequestHandler(
     CompleteRequestSchema,
-    (request) => handleCompletionRequest({ request, client, db, isReadOnlyMode })
+    (request, extra) => handleCompletionRequest({
+      request,
+      client,
+      db,
+      isReadOnlyMode,
+      signal: extra.signal
+    })
   );
   return server;
 }
@@ -1359,6 +1680,7 @@ async function main() {
   let readOnlyMode = process.env.MCP_MONGODB_READONLY === "true" || false;
   let transportMode = "stdio";
   let port = Number(process.env.MCP_PORT) || 3001;
+  const allowedOrigins = (process.env.MCP_HTTP_ALLOWED_ORIGINS || "").split(",").map((origin) => origin.trim()).filter(Boolean);
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--read-only" || args[i] === "-r") {
       readOnlyMode = true;
@@ -1375,6 +1697,10 @@ async function main() {
         console.error("Invalid port number.");
         process.exit(1);
       }
+    } else if (args[i] === "--allowed-origins") {
+      allowedOrigins.push(
+        ...(args[++i] || "").split(",").map((origin) => origin.trim()).filter(Boolean)
+      );
     } else if (!connectionUrl) {
       connectionUrl = args[i];
     }
@@ -1411,7 +1737,7 @@ async function main() {
       process.exit(1);
     }
     if (transportMode === "http") {
-      await startHttpServer(client, db, isReadOnlyMode, port);
+      await startHttpServer(client, db, isReadOnlyMode, port, allowedOrigins);
     } else {
       await startStdioServer(client, db, isReadOnlyMode);
     }
@@ -1429,7 +1755,21 @@ async function startStdioServer(client, db, isReadOnlyMode) {
   await server.connect(transport);
   console.warn("Server connected successfully via stdio");
 }
-async function startHttpServer(client, db, isReadOnlyMode, port) {
+function isOriginAllowed(origin, allowedOrigins) {
+  if (!origin) {
+    return true;
+  }
+  if (allowedOrigins.includes(origin)) {
+    return true;
+  }
+  try {
+    const { hostname } = new URL(origin);
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+  } catch {
+    return false;
+  }
+}
+async function startHttpServer(client, db, isReadOnlyMode, port, allowedOrigins) {
   const app = createMcpExpressApp({ host: "0.0.0.0" });
   app.use((req, res, next) => {
     const start = Date.now();
@@ -1448,6 +1788,21 @@ async function startHttpServer(client, db, isReadOnlyMode, port) {
     });
     next();
   });
+  app.use((req, res, next) => {
+    const origin = req.headers.origin;
+    if (!isOriginAllowed(origin, allowedOrigins)) {
+      res.status(403).json({
+        jsonrpc: "2.0",
+        error: {
+          code: -32603,
+          message: "Forbidden: origin not allowed"
+        },
+        id: null
+      });
+      return;
+    }
+    next();
+  });
   app.post("/mcp", async (req, res) => {
     const server = createServer(client, db, isReadOnlyMode);
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-mongo-server",
-  "version": "2.0.2",
+  "version": "2.1.1",
   "description": "A Model Context Protocol server for MongoDB connections",
   "private": false,
   "type": "module",
@@ -23,14 +23,14 @@
     "inspector": "mcp-inspector --config inspector-config.json --server mongodb"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
-    "mongodb": "^7.1.0",
-    "zod": "^3.25.76"
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "mongodb": "^7.5.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.3.14",
-    "@modelcontextprotocol/inspector": "^0.19.0",
-    "@types/node": "^25.2.1",
+    "@biomejs/biome": "^2.5.5",
+    "@modelcontextprotocol/inspector": "^1.0.0",
+    "@types/node": "^26.1.1",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"
   },
@@ -56,5 +56,21 @@
     "type": "git",
     "url": "https://github.com/kiliczsh/mcp-mongo-server"
   },
-  "homepage": "https://github.com/kiliczsh/mcp-mongo-server"
+  "homepage": "https://github.com/kiliczsh/mcp-mongo-server",
+  "overrides": {
+    "qs": "^6.15.2",
+    "hono": "^4.12.18",
+    "@hono/node-server": "^1.19.10",
+    "express-rate-limit": "^8.2.2",
+    "fast-uri": "^3.1.2",
+    "ws": "^8.21.1",
+    "shell-quote": "^1.10.0",
+    "minimatch": "^3.1.3",
+    "brace-expansion": "^1.1.13",
+    "rollup": "^4.59.0",
+    "picomatch": "^4.0.4",
+    "body-parser": "^2.3.0",
+    "ip-address": "^10.2.0",
+    "esbuild": "^0.28.1"
+  }
 }