mcp-mongo-server 2.1.0 → 2.1.1

package/README.md

@@ -4,8 +4,6 @@
 ![NPM Version](https://img.shields.io/npm/v/mcp-mongo-server)
 ![NPM Downloads](https://img.shields.io/npm/dm/mcp-mongo-server)
 ![NPM License](https://img.shields.io/npm/l/mcp-mongo-server)
-[![smithery badge](https://smithery.ai/badge/mcp-mongo-server)](https://smithery.ai/server/mcp-mongo-server)
-[![Verified on MseeP](https://mseep.ai/badge.svg)](https://mseep.ai/app/e274a3dd-7fe6-4440-8c43-043bae668251)
 
 A Model Context Protocol server that enables LLMs to interact with MongoDB databases. This server provides capabilities for inspecting collection schemas and executing MongoDB operations through a standardized interface.
 

package/build/index.js

@@ -64,6 +64,32 @@ var COLLECTION_OPERATIONS = [
   "count"
 ];
 var WRITE_OPERATIONS = ["update", "insert", "createIndex"];
+var READONLY_FORBIDDEN_AGG_OPERATORS = /* @__PURE__ */ new Set([
+  "$out",
+  "$merge",
+  "$function",
+  "$accumulator",
+  "$where"
+]);
+function findForbiddenAggOperator(value) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const found = findForbiddenAggOperator(item);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (value && typeof value === "object") {
+    for (const [key, nested] of Object.entries(value)) {
+      if (READONLY_FORBIDDEN_AGG_OPERATORS.has(key)) {
+        return key;
+      }
+      const found = findForbiddenAggOperator(nested);
+      if (found) return found;
+    }
+  }
+  return null;
+}
 async function handleCallToolRequest({
   request,
   client,
@@ -153,7 +179,13 @@ async function executeOperation(operation, collection, db, isReadOnlyMode, args,
     case "query":
       return handleQuery(collection, args, objectIdMode, signal);
     case "aggregate":
-      return handleAggregate(collection, args, objectIdMode, signal);
+      return handleAggregate(
+        collection,
+        args,
+        objectIdMode,
+        isReadOnlyMode,
+        signal
+      );
     case "update":
       return handleUpdate(collection, args, objectIdMode, signal);
     case "serverInfo":
@@ -387,7 +419,7 @@ async function handleQuery(collection, args, objectIdMode = "auto", signal) {
     return handleError(error, "query", collection.collectionName);
   }
 }
-async function handleAggregate(collection, args, objectIdMode = "auto", signal) {
+async function handleAggregate(collection, args, objectIdMode = "auto", isReadOnlyMode = false, signal) {
   if (!collection) {
     throw new Error("Collection is required for aggregate operation");
   }
@@ -395,6 +427,14 @@ async function handleAggregate(collection, args, objectIdMode = "auto", signal)
   if (!Array.isArray(pipeline)) {
     throw new Error("Pipeline must be an array");
   }
+  if (isReadOnlyMode) {
+    const forbidden = findForbiddenAggOperator(pipeline);
+    if (forbidden) {
+      throw new Error(
+        `ReadonlyError: Aggregation operator '${forbidden}' is not allowed in read-only mode`
+      );
+    }
+  }
   const processedPipeline = pipeline.map((stage) => {
     if (typeof stage === "object" && stage !== null) {
       return processObjectIdInFilter(
@@ -488,32 +528,28 @@ async function handleServerInfo(db, isReadOnlyMode, args, signal) {
   try {
     signal?.throwIfAborted();
     const buildInfo = await db.command({ buildInfo: 1 });
-    let serverStatus = null;
-    if (includeDebugInfo) {
-      signal?.throwIfAborted();
-      serverStatus = await db.command({ serverStatus: 1 });
-    }
     const serverInfo = {
       version: buildInfo.version,
       gitVersion: buildInfo.gitVersion,
-      modules: buildInfo.modules,
-      allocator: buildInfo.allocator,
-      javascriptEngine: buildInfo.javascriptEngine,
-      sysInfo: buildInfo.sysInfo,
       storageEngines: buildInfo.storageEngines,
-      debug: buildInfo.debug,
       maxBsonObjectSize: buildInfo.maxBsonObjectSize,
-      openssl: buildInfo.openssl,
-      buildEnvironment: buildInfo.buildEnvironment,
       bits: buildInfo.bits,
       ok: buildInfo.ok,
-      status: {},
       connectionInfo: {
         readOnlyMode: isReadOnlyMode,
         readPreference: isReadOnlyMode ? "secondary" : "primary"
       }
     };
-    if (serverStatus) {
+    if (includeDebugInfo) {
+      signal?.throwIfAborted();
+      const serverStatus = await db.command({ serverStatus: 1 });
+      serverInfo.modules = buildInfo.modules;
+      serverInfo.allocator = buildInfo.allocator;
+      serverInfo.javascriptEngine = buildInfo.javascriptEngine;
+      serverInfo.sysInfo = buildInfo.sysInfo;
+      serverInfo.debug = buildInfo.debug;
+      serverInfo.openssl = buildInfo.openssl;
+      serverInfo.buildEnvironment = buildInfo.buildEnvironment;
       serverInfo.status = {
         host: serverStatus.host,
         version: serverStatus.version,
@@ -1517,7 +1553,7 @@ function createServer(client, db, isReadOnlyMode = false, options = {}) {
     {
       name: "mongodb",
       title: "MongoDB MCP Server",
-      version: "2.1.0",
+      version: "2.1.1",
       description: "MCP server for MongoDB: query, aggregate, and manage collections with read-only mode, progress notifications, cancellation, and task support",
       websiteUrl: "https://github.com/kiliczsh/mcp-mongo-server",
       ...options

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-mongo-server",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "A Model Context Protocol server for MongoDB connections",
   "private": false,
   "type": "module",