mcp-mongo-server 3.0.2 → 3.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +37 -4
- package/build/index.js +2038 -1524
- package/package.json +3 -1
package/README.md
CHANGED
|
@@ -14,7 +14,7 @@ A Model Context Protocol (MCP) server that lets AI assistants work with your Mon
|
|
|
14
14
|
## Why use it
|
|
15
15
|
|
|
16
16
|
- **Talk to your database in plain language** — the assistant discovers your collections and their shape automatically.
|
|
17
|
-
- **
|
|
17
|
+
- **Read-only mode** — restrict write operations globally or per connection.
|
|
18
18
|
- **Works everywhere** — connects to standalone, replica set, sharded, and Atlas deployments, over plain or TLS connections.
|
|
19
19
|
|
|
20
20
|
## Key Features
|
|
@@ -91,6 +91,10 @@ npx -y mcp-mongo-server "mongodb://..." --transport http --port 3001 --allowed-o
|
|
|
91
91
|
| Variable | Description |
|
|
92
92
|
|----------|-------------|
|
|
93
93
|
| `MCP_MONGODB_URI` | MongoDB connection URI (alternative to the argument) |
|
|
94
|
+
| `MCP_MONGODB_CONNECTIONS` | JSON object of named MongoDB connections and their database permissions |
|
|
95
|
+
| `MCP_MONGODB_MAX_RESULT_DOCUMENTS` | Optional document cap for `query` and `aggregate` |
|
|
96
|
+
| `MCP_MONGODB_MAX_RESULT_BYTES` | Optional UTF-8 byte cap for the compact JSON results array, minimum 2 |
|
|
97
|
+
| `MCP_MONGODB_QUERY_TIMEOUT_MS` | Optional MongoDB operation timeout in milliseconds for `query`, `aggregate`, `listIndexes`, and query count and explain operations |
|
|
94
98
|
| `MCP_MONGODB_READONLY` | Enable read-only mode (`"true"`) |
|
|
95
99
|
| `MCP_MONGODB_ALLOW_CROSS_DB` | Allow cross-database aggregation stages (`"true"`) |
|
|
96
100
|
| `MCP_MONGODB_ALLOW_SERVER_JS` | Allow server-side JavaScript operators (`"true"`) |
|
|
@@ -99,13 +103,42 @@ npx -y mcp-mongo-server "mongodb://..." --transport http --port 3001 --allowed-o
|
|
|
99
103
|
| `MCP_HTTP_JSON_LIMIT` | Max HTTP request body size (default `10mb`) |
|
|
100
104
|
| `MCP_HTTP_AUTH_TOKEN` | Bearer token required to access the HTTP endpoint |
|
|
101
105
|
|
|
106
|
+
### Named connections
|
|
107
|
+
|
|
108
|
+
Set `MCP_MONGODB_CONNECTIONS` to a JSON string. This MCP client configuration
|
|
109
|
+
uses a local build and the two [Docker test databases](docs/development.md#local-mongodb-test-environment).
|
|
110
|
+
|
|
111
|
+
```json
|
|
112
|
+
{
|
|
113
|
+
"mcpServers": {
|
|
114
|
+
"mongodb": {
|
|
115
|
+
"command": "node",
|
|
116
|
+
"args": [
|
|
117
|
+
"/absolute/path/to/mcp-mongo-server/build/index.js"
|
|
118
|
+
],
|
|
119
|
+
"env": {
|
|
120
|
+
"MCP_MONGODB_CONNECTIONS": "{\"default\":{\"uri\":\"mongodb://127.0.0.1:37017/mcp_test\"},\"analytics\":{\"uri\":\"mongodb://127.0.0.1:37018/mcp_test?directConnection=true\",\"databases\":[\"mcp_test\",\"mcp_test_secondary\"],\"readOnly\":true}}"
|
|
121
|
+
}
|
|
122
|
+
}
|
|
123
|
+
}
|
|
124
|
+
}
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
- Discover targets with `listConnections` and `listDatabases`. Pass `connectionId` and `database` to database tools and the collection analysis prompt. Omitted selectors use the `default` connection and its URI database.
|
|
128
|
+
- Omit `databases` to allow only the URI database. If supplied, the list must include the URI database. Global read-only mode applies to every connection.
|
|
129
|
+
- Write tools appear in tool discovery when at least one connection is writable. Use `listConnections` to choose a writable target.
|
|
130
|
+
- A positional URI or `MCP_MONGODB_URI` can supply `default` when the JSON contains only secondary connections. Named connections default to a 5-second server selection timeout. Set `serverSelectionTimeoutMS` in the URI to override it.
|
|
131
|
+
- If a connection is offline, `resources/list` reports its ID and fails. Tools targeting other connections remain usable.
|
|
132
|
+
|
|
102
133
|
## Security
|
|
103
134
|
|
|
104
|
-
**Database scope.** The server operates on the database
|
|
105
|
-
|
|
135
|
+
**Database scope.** The server operates on the selected database.
|
|
136
|
+
Named connections restrict selection to their configured databases.
|
|
137
|
+
Aggregation stages that reach another database (`$out`, `$merge`,
|
|
106
138
|
`$lookup` with an explicit `db`) are rejected by default, so a pipeline can't
|
|
107
139
|
quietly read from or write to databases you didn't point it at. Enable them
|
|
108
|
-
with `--allow-cross-db` if you need them.
|
|
140
|
+
with `--allow-cross-db` if you need them. Named connections still enforce their
|
|
141
|
+
database allowlist.
|
|
109
142
|
|
|
110
143
|
**Server-side JavaScript.** The operators `$function`, `$where`, and
|
|
111
144
|
`$accumulator` are blocked by default in aggregation pipelines and in the
|