mcp-mongo-server 3.0.1 → 3.0.2

package/README.md

@@ -107,14 +107,14 @@ string. Aggregation stages that reach another database (`$out`, `$merge`,
 quietly read from or write to databases you didn't point it at. Enable them
 with `--allow-cross-db` if you need them.
 
-**Server-side JavaScript.** The aggregation operators `$function`, `$where`,
-and `$accumulator` run arbitrary JavaScript on the MongoDB server. They are
-rejected by default; enable them with `--allow-server-js` if you trust the
-pipelines being run.
-
-**Read-only mode** blocks every write path, including aggregation stages that
-write or run server-side JavaScript (`$out`, `$merge`, `$function`, `$where`,
-`$accumulator`).
+**Server-side JavaScript.** The operators `$function`, `$where`, and
+`$accumulator` are blocked by default in aggregation pipelines and in the
+filters for `query`, `count`, and `update`. In read-write mode,
+`--allow-server-js` enables these operators.
+
+**Read-only mode** blocks writes, including the `$out` and `$merge`
+aggregation stages. It also blocks server-side JavaScript even when
+`--allow-server-js` is set.
 
 **Least privilege.** Application-level checks only go so far — the strongest
 guarantee comes from the database. Connect with a MongoDB user scoped to just

package/build/index.js

@@ -82,6 +82,14 @@ function findAggOperator(value, operators, depth = 0) {
   }
   return null;
 }
+function assertNoServerJs(value) {
+  const operator = findAggOperator(value, SERVER_JS_AGG_OPERATORS);
+  if (operator) {
+    throw new Error(
+      `Server-side JavaScript operator '${operator}' is disabled by the current server policy.`
+    );
+  }
+}
 function findCrossDbTarget(pipeline, connectedDb) {
   const foreignDb = (target) => {
     if (target && typeof target === "object" && "db" in target) {
@@ -164,7 +172,13 @@ async function handleCallToolRequest({
 async function executeOperation(operation, collection, db, isReadOnlyMode, allowCrossDb, allowServerJs, args, objectIdMode, signal) {
   switch (operation) {
     case "query":
-      return handleQuery(collection, args, objectIdMode, signal);
+      return handleQuery(
+        collection,
+        args,
+        objectIdMode,
+        allowServerJs && !isReadOnlyMode,
+        signal
+      );
     case "aggregate":
       return handleAggregate(
         collection,
@@ -176,7 +190,7 @@ async function executeOperation(operation, collection, db, isReadOnlyMode, allow
         signal
       );
     case "update":
-      return handleUpdate(collection, args, objectIdMode, signal);
+      return handleUpdate(collection, args, objectIdMode, allowServerJs, signal);
     case "serverInfo":
       return handleServerInfo(db, isReadOnlyMode, args, signal);
     case "insert":
@@ -184,7 +198,13 @@ async function executeOperation(operation, collection, db, isReadOnlyMode, allow
     case "createIndex":
       return handleCreateIndex(collection, args, objectIdMode, signal);
     case "count":
-      return handleCount(collection, args, objectIdMode, signal);
+      return handleCount(
+        collection,
+        args,
+        objectIdMode,
+        allowServerJs && !isReadOnlyMode,
+        signal
+      );
     case "listCollections":
       return handleListCollections(db, args, objectIdMode, signal);
     case "convertTime":
@@ -377,7 +397,7 @@ function handleError(error, operation, collectionName) {
   const message = error instanceof Error ? error.message : "Unknown error";
   return toolExecutionError(`Failed to ${operation} ${context}: ${message}`);
 }
-async function handleQuery(collection, args, objectIdMode = "auto", signal) {
+async function handleQuery(collection, args, objectIdMode = "auto", allowServerJs = false, signal) {
   if (!collection) {
     throw new Error("Collection is required for query operation");
   }
@@ -385,6 +405,9 @@ async function handleQuery(collection, args, objectIdMode = "auto", signal) {
   const limit = args.limit || 10;
   const skip = args.skip || 0;
   const queryFilter = parseFilter(filter, objectIdMode);
+  if (!allowServerJs) {
+    assertNoServerJs(queryFilter);
+  }
   try {
     if (explain) {
       signal?.throwIfAborted();
@@ -440,12 +463,7 @@ async function handleAggregate(collection, args, objectIdMode = "auto", isReadOn
     }
   }
   if (!allowServerJs) {
-    const js = findAggOperator(pipeline, SERVER_JS_AGG_OPERATORS);
-    if (js) {
-      throw new Error(
-        `Server-side JavaScript operator '${js}' is not allowed. Enable it with --allow-server-js or MCP_MONGODB_ALLOW_SERVER_JS=true.`
-      );
-    }
+    assertNoServerJs(pipeline);
   }
   if (!allowCrossDb) {
     const foreignDb = findCrossDbTarget(pipeline, collection.dbName);
@@ -486,12 +504,15 @@ async function handleAggregate(collection, args, objectIdMode = "auto", isReadOn
     return handleError(error, "aggregate", collection.collectionName);
   }
 }
-async function handleUpdate(collection, args, objectIdMode = "auto", signal) {
+async function handleUpdate(collection, args, objectIdMode = "auto", allowServerJs = false, signal) {
   if (!collection) {
     throw new Error("Collection is required for update operation");
   }
   const { filter, update, upsert, multi } = args;
   const queryFilter = parseFilter(filter, objectIdMode);
+  if (!allowServerJs) {
+    assertNoServerJs(queryFilter);
+  }
   let processedUpdate = update;
   if (update && typeof update === "object" && !Array.isArray(update)) {
     processedUpdate = processObjectIdInFilter(
@@ -652,7 +673,7 @@ async function handleCreateIndex(collection, args, objectIdMode = "auto", signal
       "Write concern must be a valid MongoDB write concern object"
     );
   }
-  if (commitQuorum && typeof commitQuorum !== "string" && typeof commitQuorum !== "number") {
+  if (commitQuorum !== void 0 && typeof commitQuorum !== "string" && typeof commitQuorum !== "number") {
     throw new Error("Commit quorum must be a string or number");
   }
   const processedIndexes = indexes.map((index) => {
@@ -666,7 +687,7 @@ async function handleCreateIndex(collection, args, objectIdMode = "auto", signal
   });
   try {
     const indexOptions = {
-      commitQuorum: typeof commitQuorum === "number" ? commitQuorum : void 0
+      commitQuorum
     };
     signal?.throwIfAborted();
     const createdIndexes = await collection.createIndexes(
@@ -682,12 +703,15 @@ async function handleCreateIndex(collection, args, objectIdMode = "auto", signal
     return handleError(error, "create indexes", collection.collectionName);
   }
 }
-async function handleCount(collection, args, objectIdMode = "auto", signal) {
+async function handleCount(collection, args, objectIdMode = "auto", allowServerJs = false, signal) {
   if (!collection) {
     throw new Error("Collection is required for count operation");
   }
   const { query, limit, skip, hint, readConcern, maxTimeMS, collation } = args;
   const countQuery = parseFilter(query, objectIdMode);
+  if (!allowServerJs) {
+    assertNoServerJs(countQuery);
+  }
   try {
     const options = {
       limit: typeof limit === "number" ? limit : void 0,
@@ -758,17 +782,10 @@ async function handleListCollections(db, args, objectIdMode = "auto", signal) {
   const { nameOnly, filter } = args;
   const skip = args.skip || 0;
   const limit = args.limit || 20;
-  let processedFilter = filter;
-  if (filter && typeof filter === "object") {
-    processedFilter = processObjectIdInFilter(
-      filter,
-      objectIdMode
-    );
-  }
   try {
-    const options = processedFilter ? { filter: processedFilter } : {};
+    const processedFilter = parseFilter(filter, objectIdMode);
     signal?.throwIfAborted();
-    const collections = await db.listCollections(options).toArray();
+    const collections = await db.listCollections(processedFilter).toArray();
     const allResults = nameOnly ? collections.map((collection) => collection.name) : collections;
     const total = allResults.length;
     const paged = allResults.slice(skip, skip + limit);
@@ -1142,7 +1159,7 @@ async function handleReadResourceRequest({
         `Unsupported resource URI scheme '${url.protocol}': expected 'mongodb:'`
       );
     }
-    collectionName = url.pathname.replace(/^\//, "");
+    collectionName = decodeURIComponent(url.pathname.replace(/^\//, ""));
   } catch (error) {
     if (error instanceof ProtocolError2) throw error;
     throw new ProtocolError2(
@@ -1250,7 +1267,7 @@ async function handleListResourcesRequest({
     signal?.throwIfAborted();
     const collections = await db.listCollections().toArray();
     const allResources = collections.map((collection) => ({
-      uri: `mongodb:///${collection.name}`,
+      uri: `mongodb:///${encodeURIComponent(collection.name)}`,
       mimeType: "application/json",
       name: collection.name,
       description: `MongoDB collection: ${collection.name}`
@@ -1328,7 +1345,7 @@ async function handleListToolsRequest({
     tools: [
       {
         name: "query",
-        description: "Execute a MongoDB query with optional execution plan analysis",
+        description: "Find documents in one collection using a filter, projection, or sort. Use aggregate for grouping or joins. Request an execution plan to inspect the query.",
         inputSchema: {
           type: "object",
           properties: {
@@ -1375,7 +1392,7 @@ async function handleListToolsRequest({
       },
       {
         name: "aggregate",
-        description: "Execute a MongoDB aggregation pipeline with optional execution plan analysis",
+        description: "Run a MongoDB aggregation pipeline for grouping, joins, or multi-stage transformations. Request an execution plan to inspect the pipeline.",
         inputSchema: {
           type: "object",
           properties: {
@@ -1407,7 +1424,7 @@ async function handleListToolsRequest({
       },
       {
         name: "update",
-        description: "Update documents in a MongoDB collection",
+        description: "Modify matching documents using operators such as $set, $unset, or $inc. Enable multi to update all matches or upsert to create a document when the filter matches none.",
         inputSchema: {
           type: "object",
           properties: {
@@ -1443,7 +1460,7 @@ async function handleListToolsRequest({
       },
       {
         name: "serverInfo",
-        description: "Get MongoDB server information including version, storage engine, and other details",
+        description: "Inspect MongoDB server metadata such as version and storage engine. Enable includeDebugInfo for additional diagnostics.",
         inputSchema: {
           type: "object",
           properties: {
@@ -1456,7 +1473,7 @@ async function handleListToolsRequest({
       },
       {
         name: "insert",
-        description: "Insert one or more documents into a MongoDB collection",
+        description: "Insert new documents into a MongoDB collection. Use update to modify existing records.",
         inputSchema: {
           type: "object",
           properties: {
@@ -1493,7 +1510,7 @@ async function handleListToolsRequest({
       },
       {
         name: "createIndex",
-        description: "Create one or more indexes on a MongoDB collection",
+        description: "Create indexes to improve query performance, enforce uniqueness, or expire documents with a TTL index.",
         inputSchema: {
           type: "object",
           properties: {
@@ -1544,8 +1561,8 @@ async function handleListToolsRequest({
               description: "Write concern for index creation"
             },
             commitQuorum: {
-              type: "string",
-              description: "Number of members required to create the index"
+              type: ["string", "number"],
+              description: "Replica-set commit quorum as a member count or a mode such as majority"
             },
             objectIdMode: {
               type: "string",
@@ -1559,7 +1576,7 @@ async function handleListToolsRequest({
       },
       {
         name: "count",
-        description: "Count documents in a collection matching a query",
+        description: "Count documents matching a filter in one collection. Use aggregate for counts grouped by field.",
         inputSchema: {
           type: "object",
           properties: {
@@ -1589,7 +1606,7 @@ async function handleListToolsRequest({
       },
       {
         name: "listCollections",
-        description: "List all collections in the MongoDB database",
+        description: "List collections in the connected database. Filter by name or other collection properties and request names only for a compact result.",
         inputSchema: {
           type: "object",
           properties: {
@@ -1650,7 +1667,7 @@ function createServer(client, db, isReadOnlyMode = false, allowCrossDb = false,
     {
       name: "mongodb",
       title: "MongoDB MCP Server",
-      version: "3.0.1",
+      version: "3.0.2",
       description: "MCP server for MongoDB: query, aggregate, and manage collections with read-only mode, progress notifications, and cancellation",
       websiteUrl: "https://github.com/kiliczsh/mcp-mongo-server",
       ...options

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-mongo-server",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "A Model Context Protocol server for MongoDB connections",
   "private": false,
   "type": "module",
@@ -35,6 +35,7 @@
     "@biomejs/biome": "^2.5.5",
     "@modelcontextprotocol/client": "^2.0.0",
     "@modelcontextprotocol/inspector": "^1.0.0",
+    "@types/express": "5",
     "@types/node": "^26.1.1",
     "tsup": "^8.5.1",
     "typescript": "^5.9.3"