mcp-mongo-server 2.1.0 → 3.0.0

package/README.md

@@ -4,54 +4,131 @@
 ![NPM Version](https://img.shields.io/npm/v/mcp-mongo-server)
 ![NPM Downloads](https://img.shields.io/npm/dm/mcp-mongo-server)
 ![NPM License](https://img.shields.io/npm/l/mcp-mongo-server)
-[![smithery badge](https://smithery.ai/badge/mcp-mongo-server)](https://smithery.ai/server/mcp-mongo-server)
-[![Verified on MseeP](https://mseep.ai/badge.svg)](https://mseep.ai/app/e274a3dd-7fe6-4440-8c43-043bae668251)
 
-A Model Context Protocol server that enables LLMs to interact with MongoDB databases. This server provides capabilities for inspecting collection schemas and executing MongoDB operations through a standardized interface.
+A Model Context Protocol (MCP) server that lets AI assistants work with your MongoDB databases. It exposes your collections, infers their schemas, and runs queries, aggregations, and writes through a standard interface — so tools like Claude Desktop and Cursor can read and reason about your data.
 
 ## Demo
 
 [![MCP MongoDB Server Demo | Claude Desktop](https://img.youtube.com/vi/FI-oE_voCpA/0.jpg)](https://www.youtube.com/watch?v=FI-oE_voCpA)
 
+## Why use it
+
+- **Talk to your database in plain language** — the assistant discovers your collections and their shape automatically.
+- **Safe by default** — turn on read-only mode to let an assistant explore without any risk of changing data.
+- **Works everywhere** — connects to standalone, replica set, sharded, and Atlas deployments, over plain or TLS connections.
+
 ## Key Features
 
-- **Smart ObjectId Handling** - Configurable auto/none/force modes for string-to-ObjectId conversion
-- **Read-Only Mode** - Protection against write operations, uses secondary read preference
-- **Schema Inference** - Automatic collection schema detection from document samples
-- **Query & Aggregation** - Full MongoDB query and aggregation pipeline support with optional explain plans
-- **Write Operations** - Insert, update, and index creation (when not in read-only mode)
-- **Collection Completions** - Auto-complete collection names for LLM integration
+- **Read-Only Mode** — blocks every write path (insert, update, index creation, and aggregation stages like `$out`/`$merge` that could modify data).
+- **Smart ObjectId Handling** — configurable `auto`/`none`/`force` conversion of 24-character hex strings to ObjectIds.
+- **Schema Inference** — automatic collection schema detection from document samples.
+- **Query & Aggregation** — full query and aggregation pipeline support, with optional `explain` plans.
+- **Write Operations** — insert, update, and index creation (when read-only mode is off).
+- **Time Conversion** — a `convertTime` helper turns Unix timestamps and date strings into UTC/GMT/ISO, so date queries stay unambiguous across timezones.
+- **Progress & Cancellation** — long operations report progress and can be cancelled mid-flight.
+- **Two Transports** — run locally over stdio, or expose an HTTP endpoint for remote access.
+
+## Requirements
 
-## Installation
+- Node.js 20 or newer
+
+## Quick Start
+
+Point the server at your database — no install step needed:
 
 ```bash
-npx -y mcp-mongo-server mongodb://localhost:27017/database
+npx -y mcp-mongo-server mongodb://localhost:27017/mydatabase
+```
+
+Explore safely, without any chance of changing data:
+
+```bash
+npx -y mcp-mongo-server mongodb://localhost:27017/mydatabase --read-only
 ```
 
 ## Usage
 
+### Local (stdio)
+
+This is the default, used by Claude Desktop, Cursor, and other local clients:
+
 ```bash
-# Start server with MongoDB URI
-npx -y mcp-mongo-server mongodb://muhammed:kilic@localhost:27017/database
+npx -y mcp-mongo-server "mongodb://user:pass@localhost:27017/mydatabase"
+```
+
+### Remote (HTTP)
+
+Expose an HTTP endpoint at `/mcp` for remote or multi-client access:
+
+```bash
+npx -y mcp-mongo-server "mongodb://user:pass@localhost:27017/mydatabase" --transport http --port 3001
+```
+
+By default, only requests without a browser `Origin` (CLIs, IDEs) and requests
+from `localhost` are accepted; everything else is rejected with `403` to guard
+against DNS-rebinding attacks. Allow specific browser origins with
+`--allowed-origins`:
 
-# Connect in read-only mode
-npx -y mcp-mongo-server mongodb://muhammed:kilic@localhost:27017/database --read-only
+```bash
+npx -y mcp-mongo-server "mongodb://..." --transport http --port 3001 --allowed-origins "https://app.example.com"
 ```
 
+### Options
+
+| Flag | Description |
+|------|-------------|
+| `--read-only`, `-r` | Block all write operations |
+| `--allow-cross-db` | Allow aggregation `$out`/`$merge`/`$lookup` to target other databases (off by default) |
+| `--allow-server-js` | Allow server-side JavaScript operators `$function`/`$where`/`$accumulator` (off by default) |
+| `--transport`, `-t` | `stdio` (default) or `http` |
+| `--port`, `-p` | HTTP port (default `3001`) |
+| `--allowed-origins` | Comma-separated browser origins to allow in HTTP mode |
+| `--json-limit` | Max HTTP request body size (default `10mb`) |
+| `--auth-token` | Require `Authorization: Bearer <token>` on the HTTP endpoint |
+
 ### Environment Variables
 
 | Variable | Description |
 |----------|-------------|
-| `MCP_MONGODB_URI` | MongoDB connection URI |
+| `MCP_MONGODB_URI` | MongoDB connection URI (alternative to the argument) |
 | `MCP_MONGODB_READONLY` | Enable read-only mode (`"true"`) |
+| `MCP_MONGODB_ALLOW_CROSS_DB` | Allow cross-database aggregation stages (`"true"`) |
+| `MCP_MONGODB_ALLOW_SERVER_JS` | Allow server-side JavaScript operators (`"true"`) |
+| `MCP_PORT` | HTTP port |
+| `MCP_HTTP_ALLOWED_ORIGINS` | Comma-separated browser origins to allow in HTTP mode |
+| `MCP_HTTP_JSON_LIMIT` | Max HTTP request body size (default `10mb`) |
+| `MCP_HTTP_AUTH_TOKEN` | Bearer token required to access the HTTP endpoint |
+
+## Security
+
+**Database scope.** The server operates on the database in your connection
+string. Aggregation stages that reach another database (`$out`, `$merge`,
+`$lookup` with an explicit `db`) are rejected by default, so a pipeline can't
+quietly read from or write to databases you didn't point it at. Enable them
+with `--allow-cross-db` if you need them.
+
+**Server-side JavaScript.** The aggregation operators `$function`, `$where`,
+and `$accumulator` run arbitrary JavaScript on the MongoDB server. They are
+rejected by default; enable them with `--allow-server-js` if you trust the
+pipelines being run.
+
+**Read-only mode** blocks every write path, including aggregation stages that
+write or run server-side JavaScript (`$out`, `$merge`, `$function`, `$where`,
+`$accumulator`).
+
+**Least privilege.** Application-level checks only go so far — the strongest
+guarantee comes from the database. Connect with a MongoDB user scoped to just
+the database you need, with read-only permissions when the assistant only needs
+to explore. That way the database itself enforces the boundary, as defense in
+depth.
 
 ## Documentation
 
-- [Integration Guide](docs/integration.md) - Claude Desktop, Windsurf, Cursor, Docker
-- [Available Tools](docs/tools.md) - Query, aggregate, update, insert, and more
-- [Development](docs/development.md) - Setup, scripts, and debugging
+- [Integration Guide](docs/integration.md) — Claude Desktop, Windsurf, Cursor, Docker
+- [Available Tools](docs/tools.md) — query, aggregate, update, insert, and more
+- [Development](docs/development.md) — setup, scripts, and debugging
 - [Contributing](CONTRIBUTING.md)
 
 ## License
 
-MIT - see [LICENSE](LICENSE) for details.
+MIT — see [LICENSE](LICENSE) for details.

package/build/index.js

@@ -1,16 +1,17 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { timingSafeEqual } from "crypto";
+import { toNodeHandler } from "@modelcontextprotocol/node";
+import { createMcpHandler } from "@modelcontextprotocol/server";
+import { serveStdio } from "@modelcontextprotocol/server/stdio";
+import { createMcpExpressApp } from "@modelcontextprotocol/express";
 
 // src/mongo.ts
-import { MongoClient, ReadPreference } from "mongodb";
+import { MongoClient } from "mongodb";
 async function connectToMongoDB(url, readOnly) {
   try {
-    const options = readOnly ? { readPreference: ReadPreference.SECONDARY } : {};
-    const client = new MongoClient(url, options);
+    const client = new MongoClient(url);
     await client.connect();
     const db = client.db();
     console.warn(`Connected to MongoDB database: ${db.databaseName}`);
@@ -32,28 +33,10 @@ async function connectToMongoDB(url, readOnly) {
 }
 
 // src/server.ts
-import {
-  InMemoryTaskMessageQueue,
-  InMemoryTaskStore
-} from "@modelcontextprotocol/sdk/experimental/tasks";
-import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import {
-  CallToolRequestSchema,
-  CompleteRequestSchema,
-  GetPromptRequestSchema,
-  ListPromptsRequestSchema,
-  ListResourcesRequestSchema,
-  ListResourceTemplatesRequestSchema,
-  ListToolsRequestSchema,
-  PingRequestSchema,
-  ReadResourceRequestSchema
-} from "@modelcontextprotocol/sdk/types.js";
+import { Server } from "@modelcontextprotocol/server";
 
 // src/schemas/call.ts
-import {
-  ErrorCode,
-  McpError
-} from "@modelcontextprotocol/sdk/types.js";
+import { ProtocolError, ProtocolErrorCode } from "@modelcontextprotocol/server";
 import { ObjectId } from "mongodb";
 var COLLECTION_OPERATIONS = [
   "query",
@@ -64,14 +47,71 @@ var COLLECTION_OPERATIONS = [
   "count"
 ];
 var WRITE_OPERATIONS = ["update", "insert", "createIndex"];
+var MAX_OBJECT_DEPTH = 100;
+var WRITE_AGG_STAGES = /* @__PURE__ */ new Set(["$out", "$merge"]);
+var SERVER_JS_AGG_OPERATORS = /* @__PURE__ */ new Set([
+  "$function",
+  "$accumulator",
+  "$where"
+]);
+var READONLY_FORBIDDEN_AGG_OPERATORS = /* @__PURE__ */ new Set([
+  ...WRITE_AGG_STAGES,
+  ...SERVER_JS_AGG_OPERATORS
+]);
+function findAggOperator(value, operators, depth = 0) {
+  if (depth > MAX_OBJECT_DEPTH) {
+    throw new Error(
+      `Object nesting exceeds the maximum depth of ${MAX_OBJECT_DEPTH}`
+    );
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const found = findAggOperator(item, operators, depth + 1);
+      if (found) return found;
+    }
+    return null;
+  }
+  if (value && typeof value === "object") {
+    for (const [key, nested] of Object.entries(value)) {
+      if (operators.has(key)) {
+        return key;
+      }
+      const found = findAggOperator(nested, operators, depth + 1);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+function findCrossDbTarget(pipeline, connectedDb) {
+  const foreignDb = (target) => {
+    if (target && typeof target === "object" && "db" in target) {
+      const db = target.db;
+      if (typeof db === "string" && db && db !== connectedDb) return db;
+    }
+    return null;
+  };
+  for (const stage of pipeline) {
+    if (!stage || typeof stage !== "object") continue;
+    const s = stage;
+    const out = foreignDb(s.$out);
+    if (out) return out;
+    const merge = s.$merge;
+    const mergeInto = foreignDb(merge?.into ?? s.$merge);
+    if (mergeInto) return mergeInto;
+    const lookup = s.$lookup;
+    const lookupFrom = foreignDb(lookup?.from);
+    if (lookupFrom) return lookupFrom;
+  }
+  return null;
+}
 async function handleCallToolRequest({
   request,
   client,
   db,
   isReadOnlyMode,
-  signal,
-  taskStore,
-  taskTtl
+  allowCrossDb = false,
+  allowServerJs = false,
+  signal
 }) {
   const { name, arguments: args = {} } = request.params;
   const operation = name;
@@ -101,46 +141,19 @@ async function handleCallToolRequest({
       validateCollection(collection);
     }
     signal?.throwIfAborted();
-    if (taskStore) {
-      const task = await taskStore.createTask({
-        ttl: taskTtl ?? void 0
-      });
-      (async () => {
-        try {
-          const result = await executeOperation(
-            operation,
-            collection,
-            db,
-            isReadOnlyMode,
-            args,
-            objectIdMode,
-            signal
-          );
-          await taskStore.storeTaskResult(task.taskId, "completed", result);
-        } catch (error) {
-          try {
-            const message = error instanceof Error ? error.message : "Unknown error";
-            await taskStore.storeTaskResult(task.taskId, "failed", {
-              content: [{ type: "text", text: message }],
-              isError: true
-            });
-          } catch {
-          }
-        }
-      })();
-      return { task };
-    }
     return await executeOperation(
       operation,
       collection,
       db,
       isReadOnlyMode,
+      allowCrossDb,
+      allowServerJs,
       args,
       objectIdMode,
       signal
     );
   } catch (error) {
-    if (error instanceof McpError || signal?.aborted) {
+    if (error instanceof ProtocolError || signal?.aborted) {
       throw error;
     }
     return toolExecutionError(
@@ -148,12 +161,20 @@ async function handleCallToolRequest({
     );
   }
 }
-async function executeOperation(operation, collection, db, isReadOnlyMode, args, objectIdMode, signal) {
+async function executeOperation(operation, collection, db, isReadOnlyMode, allowCrossDb, allowServerJs, args, objectIdMode, signal) {
   switch (operation) {
     case "query":
       return handleQuery(collection, args, objectIdMode, signal);
     case "aggregate":
-      return handleAggregate(collection, args, objectIdMode, signal);
+      return handleAggregate(
+        collection,
+        args,
+        objectIdMode,
+        isReadOnlyMode,
+        allowCrossDb,
+        allowServerJs,
+        signal
+      );
     case "update":
       return handleUpdate(collection, args, objectIdMode, signal);
     case "serverInfo":
@@ -166,8 +187,10 @@ async function executeOperation(operation, collection, db, isReadOnlyMode, args,
       return handleCount(collection, args, objectIdMode, signal);
     case "listCollections":
       return handleListCollections(db, args, objectIdMode, signal);
+    case "convertTime":
+      return handleConvertTime(args);
     default:
-      throw new McpError(ErrorCode.InvalidParams, `Unknown tool: ${operation}`);
+      throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Unknown tool: ${operation}`);
   }
 }
 function validateOperation(operation) {
@@ -179,17 +202,18 @@ function validateOperation(operation) {
     "insert",
     "createIndex",
     "count",
-    "listCollections"
+    "listCollections",
+    "convertTime"
   ];
   if (!validOperations.includes(operation)) {
-    throw new McpError(ErrorCode.InvalidParams, `Unknown tool: ${operation}`);
+    throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Unknown tool: ${operation}`);
   }
 }
 function validateCollection(collection) {
   if (!collection.collectionName) {
     throw new Error("Collection name cannot be empty");
   }
-  if (collection.collectionName.startsWith("system.")) {
+  if (collection.collectionName.toLowerCase().startsWith("system.")) {
     throw new Error("Access to system collections is not allowed");
   }
 }
@@ -236,7 +260,12 @@ function isObjectIdField(fieldName) {
   const lowerFieldName = fieldName.toLowerCase();
   return lowerFieldName === "_id" || lowerFieldName === "id" || lowerFieldName.endsWith("id") || lowerFieldName.endsWith("_id");
 }
-function processObjectIdInFilter(filter, objectIdMode = "auto") {
+function processObjectIdInFilter(filter, objectIdMode = "auto", depth = 0) {
+  if (depth > MAX_OBJECT_DEPTH) {
+    throw new Error(
+      `Object nesting exceeds the maximum depth of ${MAX_OBJECT_DEPTH}`
+    );
+  }
   if (objectIdMode === "none") {
     const result2 = {};
     for (const [key, value] of Object.entries(filter)) {
@@ -263,7 +292,8 @@ function processObjectIdInFilter(filter, objectIdMode = "auto") {
         } else {
           result2[key] = processObjectIdInFilter(
             value,
-            "none"
+            "none",
+            depth + 1
           );
         }
       } else {
@@ -305,7 +335,8 @@ function processObjectIdInFilter(filter, objectIdMode = "auto") {
       } else {
         result[key] = processObjectIdInFilter(
           value,
-          objectIdMode
+          objectIdMode,
+          depth + 1
         );
       }
     } else {
@@ -318,7 +349,9 @@ function isObjectIdString(str) {
   return /^[0-9a-fA-F]{24}$/.test(str);
 }
 function isISODateString(str) {
-  return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/.test(str);
+  return /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?(Z|[+-]\d{2}:\d{2})$/.test(
+    str
+  );
 }
 function formatResponse(data) {
   return {
@@ -387,7 +420,7 @@ async function handleQuery(collection, args, objectIdMode = "auto", signal) {
     return handleError(error, "query", collection.collectionName);
   }
 }
-async function handleAggregate(collection, args, objectIdMode = "auto", signal) {
+async function handleAggregate(collection, args, objectIdMode = "auto", isReadOnlyMode = false, allowCrossDb = false, allowServerJs = false, signal) {
   if (!collection) {
     throw new Error("Collection is required for aggregate operation");
   }
@@ -395,6 +428,33 @@ async function handleAggregate(collection, args, objectIdMode = "auto", signal)
   if (!Array.isArray(pipeline)) {
     throw new Error("Pipeline must be an array");
   }
+  if (isReadOnlyMode) {
+    const forbidden = findAggOperator(
+      pipeline,
+      READONLY_FORBIDDEN_AGG_OPERATORS
+    );
+    if (forbidden) {
+      throw new Error(
+        `ReadonlyError: Aggregation operator '${forbidden}' is not allowed in read-only mode`
+      );
+    }
+  }
+  if (!allowServerJs) {
+    const js = findAggOperator(pipeline, SERVER_JS_AGG_OPERATORS);
+    if (js) {
+      throw new Error(
+        `Server-side JavaScript operator '${js}' is not allowed. Enable it with --allow-server-js or MCP_MONGODB_ALLOW_SERVER_JS=true.`
+      );
+    }
+  }
+  if (!allowCrossDb) {
+    const foreignDb = findCrossDbTarget(pipeline, collection.dbName);
+    if (foreignDb) {
+      throw new Error(
+        `Cross-database access to '${foreignDb}' is not allowed (connected database is '${collection.dbName}'). Enable it with --allow-cross-db or MCP_MONGODB_ALLOW_CROSS_DB=true.`
+      );
+    }
+  }
   const processedPipeline = pipeline.map((stage) => {
     if (typeof stage === "object" && stage !== null) {
       return processObjectIdInFilter(
@@ -488,32 +548,27 @@ async function handleServerInfo(db, isReadOnlyMode, args, signal) {
   try {
     signal?.throwIfAborted();
     const buildInfo = await db.command({ buildInfo: 1 });
-    let serverStatus = null;
-    if (includeDebugInfo) {
-      signal?.throwIfAborted();
-      serverStatus = await db.command({ serverStatus: 1 });
-    }
     const serverInfo = {
       version: buildInfo.version,
       gitVersion: buildInfo.gitVersion,
-      modules: buildInfo.modules,
-      allocator: buildInfo.allocator,
-      javascriptEngine: buildInfo.javascriptEngine,
-      sysInfo: buildInfo.sysInfo,
       storageEngines: buildInfo.storageEngines,
-      debug: buildInfo.debug,
       maxBsonObjectSize: buildInfo.maxBsonObjectSize,
-      openssl: buildInfo.openssl,
-      buildEnvironment: buildInfo.buildEnvironment,
       bits: buildInfo.bits,
       ok: buildInfo.ok,
-      status: {},
       connectionInfo: {
-        readOnlyMode: isReadOnlyMode,
-        readPreference: isReadOnlyMode ? "secondary" : "primary"
+        readOnlyMode: isReadOnlyMode
       }
     };
-    if (serverStatus) {
+    if (includeDebugInfo) {
+      signal?.throwIfAborted();
+      const serverStatus = await db.command({ serverStatus: 1 });
+      serverInfo.modules = buildInfo.modules;
+      serverInfo.allocator = buildInfo.allocator;
+      serverInfo.javascriptEngine = buildInfo.javascriptEngine;
+      serverInfo.sysInfo = buildInfo.sysInfo;
+      serverInfo.debug = buildInfo.debug;
+      serverInfo.openssl = buildInfo.openssl;
+      serverInfo.buildEnvironment = buildInfo.buildEnvironment;
       serverInfo.status = {
         host: serverStatus.host,
         version: serverStatus.version,
@@ -614,15 +669,14 @@ async function handleCreateIndex(collection, args, objectIdMode = "auto", signal
       commitQuorum: typeof commitQuorum === "number" ? commitQuorum : void 0
     };
     signal?.throwIfAborted();
-    const result = await collection.createIndexes(
+    const createdIndexes = await collection.createIndexes(
       processedIndexes,
       indexOptions
     );
     return formatResponse({
-      acknowledged: result.acknowledged,
-      createdIndexes: result.createdIndexes,
-      numIndexesBefore: result.numIndexesBefore,
-      numIndexesAfter: result.numIndexesAfter
+      acknowledged: true,
+      createdIndexes,
+      indexCount: createdIndexes.length
     });
   } catch (error) {
     return handleError(error, "create indexes", collection.collectionName);
@@ -658,6 +712,48 @@ async function handleCount(collection, args, objectIdMode = "auto", signal) {
     return handleError(error, "count documents", collection.collectionName);
   }
 }
+function handleConvertTime(args) {
+  const { input } = args;
+  let date;
+  if (input === void 0 || input === null || input === "") {
+    date = /* @__PURE__ */ new Date();
+  } else if (typeof input === "number") {
+    date = new Date(Math.abs(input) < 1e12 ? input * 1e3 : input);
+  } else if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (/^-?\d+$/.test(trimmed)) {
+      const n = Number(trimmed);
+      date = new Date(Math.abs(n) < 1e12 ? n * 1e3 : n);
+    } else {
+      date = new Date(trimmed);
+    }
+  } else {
+    throw new Error(
+      "convertTime 'input' must be a Unix timestamp (number) or a date string"
+    );
+  }
+  if (Number.isNaN(date.getTime())) {
+    throw new Error(
+      `Could not interpret '${String(input)}' as a date or Unix timestamp`
+    );
+  }
+  const offsetMinutes = -date.getTimezoneOffset();
+  const sign = offsetMinutes >= 0 ? "+" : "-";
+  const absMinutes = Math.abs(offsetMinutes);
+  const offsetLabel = `${sign}${String(Math.floor(absMinutes / 60)).padStart(
+    2,
+    "0"
+  )}:${String(absMinutes % 60).padStart(2, "0")}`;
+  return formatResponse({
+    iso: date.toISOString(),
+    utc: date.toUTCString(),
+    unixSeconds: Math.floor(date.getTime() / 1e3),
+    unixMillis: date.getTime(),
+    serverLocal: date.toString(),
+    serverTimeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+    serverUtcOffset: offsetLabel
+  });
+}
 async function handleListCollections(db, args, objectIdMode = "auto", signal) {
   const { nameOnly, filter } = args;
   const skip = args.skip || 0;
@@ -936,6 +1032,10 @@ ${JSON.stringify(sampleDocs, null, 2)}`
 }
 
 // src/schemas/resource.ts
+import {
+  ProtocolError as ProtocolError2,
+  ProtocolErrorCode as ProtocolErrorCode2
+} from "@modelcontextprotocol/server";
 import { ObjectId as ObjectId2 } from "mongodb";
 function detectMongoType(value) {
   if (value === null) return "null";
@@ -1033,8 +1133,35 @@ async function handleReadResourceRequest({
   signal,
   sendProgress
 }) {
-  const url = new URL(request.params.uri);
-  const collectionName = url.pathname.replace(/^\//, "");
+  let collectionName;
+  try {
+    const url = new URL(request.params.uri);
+    if (url.protocol !== "mongodb:") {
+      throw new ProtocolError2(
+        ProtocolErrorCode2.InvalidParams,
+        `Unsupported resource URI scheme '${url.protocol}': expected 'mongodb:'`
+      );
+    }
+    collectionName = url.pathname.replace(/^\//, "");
+  } catch (error) {
+    if (error instanceof ProtocolError2) throw error;
+    throw new ProtocolError2(
+      ProtocolErrorCode2.InvalidParams,
+      `Invalid resource URI: ${request.params.uri}`
+    );
+  }
+  if (!collectionName) {
+    throw new ProtocolError2(
+      ProtocolErrorCode2.InvalidParams,
+      "Resource URI is missing a collection name"
+    );
+  }
+  if (collectionName.startsWith("system.")) {
+    throw new ProtocolError2(
+      ProtocolErrorCode2.InvalidParams,
+      "Access to system collections is not allowed"
+    );
+  }
   try {
     const collection = db.collection(collectionName);
     const sampleSize = 100;
@@ -1202,7 +1329,6 @@ async function handleListToolsRequest({
       {
         name: "query",
         description: "Execute a MongoDB query with optional execution plan analysis",
-        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1228,6 +1354,10 @@ async function handleListToolsRequest({
               description: "Number of documents to skip before returning results",
               default: 0
             },
+            sort: {
+              type: "object",
+              description: "Sort order as a field-to-direction map, e.g. { orderDate: -1 } for descending or { name: 1 } for ascending"
+            },
             explain: {
               type: "string",
               description: "Optional: Get query execution information",
@@ -1246,7 +1376,6 @@ async function handleListToolsRequest({
       {
         name: "aggregate",
         description: "Execute a MongoDB aggregation pipeline with optional execution plan analysis",
-        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1279,7 +1408,6 @@ async function handleListToolsRequest({
       {
         name: "update",
         description: "Update documents in a MongoDB collection",
-        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1316,7 +1444,6 @@ async function handleListToolsRequest({
       {
         name: "serverInfo",
         description: "Get MongoDB server information including version, storage engine, and other details",
-        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1330,7 +1457,6 @@ async function handleListToolsRequest({
       {
         name: "insert",
         description: "Insert one or more documents into a MongoDB collection",
-        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1368,7 +1494,6 @@ async function handleListToolsRequest({
       {
         name: "createIndex",
         description: "Create one or more indexes on a MongoDB collection",
-        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1435,7 +1560,6 @@ async function handleListToolsRequest({
       {
         name: "count",
         description: "Count documents in a collection matching a query",
-        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1466,7 +1590,6 @@ async function handleListToolsRequest({
       {
         name: "listCollections",
         description: "List all collections in the MongoDB database",
-        execution: { taskSupport: "optional" },
         inputSchema: {
           type: "object",
           properties: {
@@ -1496,29 +1619,39 @@ async function handleListToolsRequest({
             }
           }
         }
+      },
+      {
+        name: "convertTime",
+        description: "Convert a Unix timestamp or date string to multiple formats (UTC ISO 8601, GMT, Unix seconds/milliseconds) and report the server's current time and timezone. Useful for building unambiguous date queries when the server and user are in different timezones. Omit 'input' to get the current time.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            input: {
+              type: "string",
+              description: "A Unix timestamp (seconds or milliseconds, as a number or numeric string) or a date string (ISO 8601, with or without a timezone offset). Omit to use the current server time."
+            }
+          }
+        }
       }
     ]
   };
 }
 
 // src/server.ts
-function createSendProgress(extra) {
-  const progressToken = extra._meta?.progressToken;
+function createSendProgress(progressToken, notify) {
   if (progressToken === void 0) return void 0;
-  return (progress, total, message) => extra.sendNotification({
+  return (progress, total, message) => notify({
     method: "notifications/progress",
     params: { progressToken, progress, total, message }
   });
 }
-function createServer(client, db, isReadOnlyMode = false, options = {}) {
-  const taskStore = new InMemoryTaskStore();
-  const taskMessageQueue = new InMemoryTaskMessageQueue();
+function createServer(client, db, isReadOnlyMode = false, allowCrossDb = false, allowServerJs = false, options = {}) {
   const server = new Server(
     {
       name: "mongodb",
       title: "MongoDB MCP Server",
-      version: "2.1.0",
-      description: "MCP server for MongoDB: query, aggregate, and manage collections with read-only mode, progress notifications, cancellation, and task support",
+      version: "3.0.0",
+      description: "MCP server for MongoDB: query, aggregate, and manage collections with read-only mode, progress notifications, and cancellation",
       websiteUrl: "https://github.com/kiliczsh/mcp-mongo-server",
       ...options
     },
@@ -1527,110 +1660,109 @@ function createServer(client, db, isReadOnlyMode = false, options = {}) {
         completions: {},
         resources: {},
         tools: {},
-        prompts: {},
-        tasks: {
-          list: {},
-          cancel: {},
-          requests: { tools: { call: {} } }
-        }
+        prompts: {}
       },
-      taskStore,
-      taskMessageQueue,
       ...options
     }
   );
   server.setRequestHandler(
-    PingRequestSchema,
-    (request, extra) => handlePingRequest({
+    "ping",
+    (request, ctx) => handlePingRequest({
       request,
       client,
       db,
       isReadOnlyMode,
-      signal: extra.signal
+      signal: ctx.mcpReq.signal
     })
   );
   server.setRequestHandler(
-    ListResourcesRequestSchema,
-    (request, extra) => handleListResourcesRequest({
+    "resources/list",
+    (request, ctx) => handleListResourcesRequest({
       request,
       client,
       db,
       isReadOnlyMode,
-      signal: extra.signal
+      signal: ctx.mcpReq.signal
     })
   );
   server.setRequestHandler(
-    ReadResourceRequestSchema,
-    (request, extra) => handleReadResourceRequest({
+    "resources/read",
+    (request, ctx) => handleReadResourceRequest({
       request,
       client,
       db,
       isReadOnlyMode,
-      signal: extra.signal,
-      sendProgress: createSendProgress(extra)
+      signal: ctx.mcpReq.signal,
+      sendProgress: createSendProgress(
+        request.params._meta?.progressToken,
+        ctx.mcpReq.notify
+      )
     })
   );
   server.setRequestHandler(
-    ListToolsRequestSchema,
-    (request, extra) => handleListToolsRequest({
+    "tools/list",
+    (request, ctx) => handleListToolsRequest({
       request,
       client,
       db,
       isReadOnlyMode,
-      signal: extra.signal
+      signal: ctx.mcpReq.signal
     })
   );
-  server.setRequestHandler(CallToolRequestSchema, (request, extra) => {
-    const hasTaskParams = !!request.params.task;
-    return handleCallToolRequest({
+  server.setRequestHandler(
+    "tools/call",
+    (request, ctx) => handleCallToolRequest({
       request,
       client,
       db,
       isReadOnlyMode,
-      signal: extra.signal,
-      taskStore: hasTaskParams ? extra.taskStore : void 0,
-      taskTtl: hasTaskParams ? extra.taskRequestedTtl : void 0
-    });
-  });
+      allowCrossDb,
+      allowServerJs,
+      signal: ctx.mcpReq.signal
+    })
+  );
   server.setRequestHandler(
-    ListPromptsRequestSchema,
-    (request, extra) => handleListPromptsRequest({
+    "prompts/list",
+    (request, ctx) => handleListPromptsRequest({
       request,
       client,
       db,
       isReadOnlyMode,
-      signal: extra.signal
+      signal: ctx.mcpReq.signal
     })
   );
   server.setRequestHandler(
-    GetPromptRequestSchema,
-    (request, extra) => handleGetPromptRequest({
+    "prompts/get",
+    (request, ctx) => handleGetPromptRequest({
       request,
       client,
       db,
       isReadOnlyMode,
-      signal: extra.signal,
-      sendProgress: createSendProgress(extra)
+      signal: ctx.mcpReq.signal,
+      sendProgress: createSendProgress(
+        request.params._meta?.progressToken,
+        ctx.mcpReq.notify
+      )
     })
   );
   server.setRequestHandler(
-    ListResourceTemplatesRequestSchema,
-    (request, extra) => handleListResourceTemplatesRequest({
+    "resources/templates/list",
+    (request, ctx) => handleListResourceTemplatesRequest({
       request,
       client,
       db,
       isReadOnlyMode,
-      signal: extra.signal
+      signal: ctx.mcpReq.signal
     })
   );
   server.setRequestHandler(
-    CompleteRequestSchema,
-    (request, extra) => handleCompletionRequest({
+    "completion/complete",
+    (request, ctx) => handleCompletionRequest({
       request,
       client,
       db,
       isReadOnlyMode,
-      signal: extra.signal
+      signal: ctx.mcpReq.signal
     })
   );
   return server;
@@ -1642,12 +1774,20 @@ async function main() {
   const args = process.argv.slice(2);
   let connectionUrl = "";
   let readOnlyMode = process.env.MCP_MONGODB_READONLY === "true" || false;
+  let allowCrossDb = process.env.MCP_MONGODB_ALLOW_CROSS_DB === "true" || false;
+  let allowServerJs = process.env.MCP_MONGODB_ALLOW_SERVER_JS === "true" || false;
   let transportMode = "stdio";
   let port = Number(process.env.MCP_PORT) || 3001;
   const allowedOrigins = (process.env.MCP_HTTP_ALLOWED_ORIGINS || "").split(",").map((origin) => origin.trim()).filter(Boolean);
+  let jsonLimit = process.env.MCP_HTTP_JSON_LIMIT || "10mb";
+  let authToken = process.env.MCP_HTTP_AUTH_TOKEN || "";
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--read-only" || args[i] === "-r") {
       readOnlyMode = true;
+    } else if (args[i] === "--allow-cross-db") {
+      allowCrossDb = true;
+    } else if (args[i] === "--allow-server-js") {
+      allowServerJs = true;
     } else if (args[i] === "--transport" || args[i] === "-t") {
       const value = args[++i];
       if (value !== "stdio" && value !== "http") {
@@ -1665,6 +1805,12 @@ async function main() {
       allowedOrigins.push(
         ...(args[++i] || "").split(",").map((origin) => origin.trim()).filter(Boolean)
       );
+    } else if (args[i] === "--json-limit") {
+      const value = args[++i];
+      if (value) jsonLimit = value;
+    } else if (args[i] === "--auth-token") {
+      const value = args[++i];
+      if (value) authToken = value;
     } else if (!connectionUrl) {
       connectionUrl = args[i];
     }
@@ -1701,9 +1847,25 @@ async function main() {
       process.exit(1);
     }
     if (transportMode === "http") {
-      await startHttpServer(client, db, isReadOnlyMode, port, allowedOrigins);
+      await startHttpServer(
+        client,
+        db,
+        isReadOnlyMode,
+        allowCrossDb,
+        allowServerJs,
+        port,
+        allowedOrigins,
+        jsonLimit,
+        authToken
+      );
     } else {
-      await startStdioServer(client, db, isReadOnlyMode);
+      await startStdioServer(
+        client,
+        db,
+        isReadOnlyMode,
+        allowCrossDb,
+        allowServerJs
+      );
     }
   } catch (error) {
     console.error("Failed to connect to MongoDB:", error);
@@ -1713,10 +1875,10 @@ async function main() {
     process.exit(1);
   }
 }
-async function startStdioServer(client, db, isReadOnlyMode) {
-  const server = createServer(client, db, isReadOnlyMode);
-  const transport = new StdioServerTransport();
-  await server.connect(transport);
+async function startStdioServer(client, db, isReadOnlyMode, allowCrossDb, allowServerJs) {
+  serveStdio(
+    () => createServer(client, db, isReadOnlyMode, allowCrossDb, allowServerJs)
+  );
   console.warn("Server connected successfully via stdio");
 }
 function isOriginAllowed(origin, allowedOrigins) {
@@ -1733,8 +1895,17 @@ function isOriginAllowed(origin, allowedOrigins) {
     return false;
   }
 }
-async function startHttpServer(client, db, isReadOnlyMode, port, allowedOrigins) {
-  const app = createMcpExpressApp({ host: "0.0.0.0" });
+function bearerTokenValid(authorization, expected) {
+  const prefix = "Bearer ";
+  if (!authorization?.startsWith(prefix)) {
+    return false;
+  }
+  const provided = Buffer.from(authorization.slice(prefix.length));
+  const wanted = Buffer.from(expected);
+  return provided.length === wanted.length && timingSafeEqual(provided, wanted);
+}
+async function startHttpServer(client, db, isReadOnlyMode, allowCrossDb, allowServerJs, port, allowedOrigins, jsonLimit, authToken) {
+  const app = createMcpExpressApp({ host: "0.0.0.0", jsonLimit });
   app.use((req, res, next) => {
     const start = Date.now();
     const ip = req.headers["x-forwarded-for"] || req.socket.remoteAddress;
@@ -1767,56 +1938,44 @@ async function startHttpServer(client, db, isReadOnlyMode, port, allowedOrigins)
     }
     next();
   });
-  app.post("/mcp", async (req, res) => {
-    const server = createServer(client, db, isReadOnlyMode);
-    try {
-      const transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: void 0
-      });
-      await server.connect(transport);
-      await transport.handleRequest(req, res, req.body);
-      res.on("close", () => {
-        transport.close();
-        server.close();
-      });
-    } catch (error) {
-      console.error("Error handling MCP request:", error);
-      if (!res.headersSent) {
-        res.status(500).json({
+  if (authToken) {
+    app.use((req, res, next) => {
+      if (!bearerTokenValid(req.headers.authorization, authToken)) {
+        res.status(401).set("WWW-Authenticate", 'Bearer realm="mcp", error="invalid_token"').json({
           jsonrpc: "2.0",
           error: {
-            code: -32603,
-            message: "Internal server error"
+            code: -32001,
+            message: "Unauthorized: missing or invalid bearer token"
           },
           id: null
         });
+        return;
       }
-    }
-  });
-  app.get("/mcp", async (_req, res) => {
-    res.writeHead(405).end(
-      JSON.stringify({
-        jsonrpc: "2.0",
-        error: {
-          code: -32e3,
-          message: "Method not allowed."
-        },
-        id: null
-      })
-    );
+      next();
+    });
+  }
+  const mcpHandler = createMcpHandler(
+    (_ctx) => createServer(client, db, isReadOnlyMode, allowCrossDb, allowServerJs)
+  );
+  const nodeHandler = toNodeHandler(mcpHandler, {
+    onerror: (error) => console.error("Error handling MCP request:", error)
   });
-  app.delete("/mcp", async (_req, res) => {
-    res.writeHead(405).end(
-      JSON.stringify({
+  app.all("/mcp", (req, res) => nodeHandler(req, res, req.body));
+  app.use(
+    (err, _req, res, next) => {
+      if (res.headersSent) return next(err);
+      const status = err.status ?? err.statusCode ?? 400;
+      const tooLarge = err.type === "entity.too.large" || status === 413;
+      res.status(tooLarge ? 413 : 400).json({
         jsonrpc: "2.0",
         error: {
-          code: -32e3,
-          message: "Method not allowed."
+          code: tooLarge ? -32600 : -32700,
+          message: tooLarge ? "Request body exceeds the configured size limit" : `Invalid request body: ${err.message ?? "parse error"}`
         },
         id: null
-      })
-    );
-  });
+      });
+    }
+  );
   app.listen(port, () => {
     console.log(`MCP MongoDB Streamable HTTP Server listening on port ${port}`);
     console.log(`Endpoint: http://localhost:${port}/mcp`);

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "mcp-mongo-server",
-  "version": "2.1.0",
+  "version": "3.0.0",
   "description": "A Model Context Protocol server for MongoDB connections",
   "private": false,
   "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
   "bin": {
     "mongodb": "./build/index.js"
   },
@@ -23,12 +26,14 @@
     "inspector": "mcp-inspector --config inspector-config.json --server mongodb"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "mongodb": "^7.5.0",
-    "zod": "^4.4.3"
+    "@modelcontextprotocol/express": "^2.0.0",
+    "@modelcontextprotocol/node": "^2.0.0",
+    "@modelcontextprotocol/server": "^2.0.0",
+    "mongodb": "^7.5.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.5",
+    "@modelcontextprotocol/client": "^2.0.0",
     "@modelcontextprotocol/inspector": "^1.0.0",
     "@types/node": "^26.1.1",
     "tsup": "^8.5.1",