mongodb-mcp-server 0.3.0 → 1.0.0-prerelease.1

package/README.md

@@ -47,7 +47,9 @@ node -v
 
 ### Quick Start
 
-**Note:** When using Atlas API credentials, be sure to assign only the minimum required permissions to your service account. See [Atlas API Permissions](#atlas-api-permissions) for details.
+> **🔒 Security Recommendation 1:** When using Atlas API credentials, be sure to assign only the minimum required permissions to your service account. See [Atlas API Permissions](#atlas-api-permissions) for details.
+
+> **🔒 Security Recommendation 2:** For enhanced security, we strongly recommend using environment variables to pass sensitive configuration such as connection strings and API credentials instead of command line arguments. Command line arguments can be visible in process lists and logged in various system locations, potentially exposing your secrets. Environment variables provide a more secure way to handle sensitive information.
 
 Most MCP clients require a configuration file to be created or modified to add the MCP server.
 
@@ -60,22 +62,19 @@ Note: The configuration file syntax can be different across clients. Please refe
 
 > **Default Safety Notice:** All examples below include `--readOnly` by default to ensure safe, read-only access to your data. Remove `--readOnly` if you need to enable write operations.
 
-#### Option 1: Connection String args
+#### Option 1: Connection String
 
-You can pass your connection string via args, make sure to use a valid username and password.
+You can pass your connection string via environment variables, make sure to use a valid username and password.
 
 ```json
 {
   "mcpServers": {
     "MongoDB": {
       "command": "npx",
-      "args": [
-        "-y",
-        "mongodb-mcp-server",
-        "--connectionString",
-        "mongodb://localhost:27017/myDatabase",
-        "--readOnly"
-      ]
+      "args": ["-y", "mongodb-mcp-server@latest", "--readOnly"],
+      "env": {
+        "MDB_MCP_CONNECTION_STRING": "mongodb://localhost:27017/myDatabase"
+      }
     }
   }
 }
@@ -83,7 +82,7 @@ You can pass your connection string via args, make sure to use a valid username
 
 NOTE: The connection string can be configured to connect to any MongoDB cluster, whether it's a local instance or an Atlas cluster.
 
-#### Option 2: Atlas API credentials args
+#### Option 2: Atlas API Credentials
 
 Use your Atlas API Service Accounts credentials. Must follow all the steps in [Atlas API Access](#atlas-api-access) section.
 
@@ -92,43 +91,37 @@ Use your Atlas API Service Accounts credentials. Must follow all the steps in [A
   "mcpServers": {
     "MongoDB": {
       "command": "npx",
-      "args": [
-        "-y",
-        "mongodb-mcp-server",
-        "--apiClientId",
-        "your-atlas-service-accounts-client-id",
-        "--apiClientSecret",
-        "your-atlas-service-accounts-client-secret",
-        "--readOnly"
-      ]
+      "args": ["-y", "mongodb-mcp-server@latest", "--readOnly"],
+      "env": {
+        "MDB_MCP_API_CLIENT_ID": "your-atlas-service-accounts-client-id",
+        "MDB_MCP_API_CLIENT_SECRET": "your-atlas-service-accounts-client-secret"
+      }
     }
   }
 }
 ```
 
-#### Option 3: Standalone Service using command arguments
+#### Option 3: Standalone Service using environment variables and command line arguments
 
-Start Server using npx command:
+You can source environment variables defined in a config file or explicitly set them like we do in the example below and run the server via npx.
 
 ```shell
- npx -y mongodb-mcp-server@latest --apiClientId="your-atlas-service-accounts-client-id" --apiClientSecret="your-atlas-service-accounts-client-secret" --readOnly
-```
-
-- For a complete list of arguments see [Configuration Options](#configuration-options)
-- To configure your Atlas Service Accounts credentials please refer to [Atlas API Access](#atlas-api-access)
-
-#### Option 4: Standalone Service using environment variables
+# Set your credentials as environment variables first
+export MDB_MCP_API_CLIENT_ID="your-atlas-service-accounts-client-id"
+export MDB_MCP_API_CLIENT_SECRET="your-atlas-service-accounts-client-secret"
 
-```shell
- npx -y mongodb-mcp-server@latest --readOnly
+# Then start the server
+npx -y mongodb-mcp-server@latest --readOnly
 ```
 
-You can use environment variables in the config file or set them and run the server via npx.
+> **💡 Platform Note:** The examples above use Unix/Linux/macOS syntax. For Windows users, see [Environment Variables](#environment-variables) for platform-specific instructions.
 
+- For a complete list of configuration options see [Configuration Options](#configuration-options)
+- To configure your Atlas Service Accounts credentials please refer to [Atlas API Access](#atlas-api-access)
 - Connection String via environment variables in the MCP file [example](#connection-string-with-environment-variables)
 - Atlas API credentials via environment variables in the MCP file [example](#atlas-api-credentials-with-environment-variables)
 
-#### Option 5: Using Docker
+#### Option 4: Using Docker
 
 You can run the MongoDB MCP Server in a Docker container, which provides isolation and doesn't require a local Node.js installation.
 
@@ -146,22 +139,35 @@ docker run --rm -i \
 ##### Option B: With MongoDB connection string
 
 ```shell
+# Set your credentials as environment variables first
+export MDB_MCP_CONNECTION_STRING="mongodb+srv://username:password@cluster.mongodb.net/myDatabase"
+
+# Then start the docker container
 docker run --rm -i \
-  -e MDB_MCP_CONNECTION_STRING="mongodb+srv://username:password@cluster.mongodb.net/myDatabase" \
+  -e MDB_MCP_CONNECTION_STRING \
   -e MDB_MCP_READ_ONLY="true" \
   mongodb/mongodb-mcp-server:latest
 ```
 
+> **💡 Platform Note:** The examples above use Unix/Linux/macOS syntax. For Windows users, see [Environment Variables](#environment-variables) for platform-specific instructions.
+
 ##### Option C: With Atlas API credentials
 
 ```shell
+# Set your credentials as environment variables first
+export MDB_MCP_API_CLIENT_ID="your-atlas-service-accounts-client-id"
+export MDB_MCP_API_CLIENT_SECRET="your-atlas-service-accounts-client-secret"
+
+# Then start the docker container
 docker run --rm -i \
-  -e MDB_MCP_API_CLIENT_ID="your-atlas-service-accounts-client-id" \
-  -e MDB_MCP_API_CLIENT_SECRET="your-atlas-service-accounts-client-secret" \
+  -e MDB_MCP_API_CLIENT_ID \
+  -e MDB_MCP_API_CLIENT_SECRET \
   -e MDB_MCP_READ_ONLY="true" \
   mongodb/mongodb-mcp-server:latest
 ```
 
+> **💡 Platform Note:** The examples above use Unix/Linux/macOS syntax. For Windows users, see [Environment Variables](#environment-variables) for platform-specific instructions.
+
 ##### Docker in MCP Configuration File
 
 Without options:
@@ -196,11 +202,14 @@ With connection string:
         "--rm",
         "-i",
         "-e",
-        "MDB_MCP_CONNECTION_STRING=mongodb+srv://username:password@cluster.mongodb.net/myDatabase",
+        "MDB_MCP_CONNECTION_STRING",
         "-e",
         "MDB_MCP_READ_ONLY=true",
         "mongodb/mongodb-mcp-server:latest"
-      ]
+      ],
+      "env": {
+        "MDB_MCP_CONNECTION_STRING": "mongodb+srv://username:password@cluster.mongodb.net/myDatabase"
+      }
     }
   }
 }
@@ -220,17 +229,21 @@ With Atlas API credentials:
         "-e",
         "MDB_MCP_READ_ONLY=true",
         "-e",
-        "MDB_MCP_API_CLIENT_ID=your-atlas-service-accounts-client-id",
+        "MDB_MCP_API_CLIENT_ID",
         "-e",
-        "MDB_MCP_API_CLIENT_SECRET=your-atlas-service-accounts-client-secret",
+        "MDB_MCP_API_CLIENT_SECRET",
         "mongodb/mongodb-mcp-server:latest"
-      ]
+      ],
+      "env": {
+        "MDB_MCP_API_CLIENT_ID": "your-atlas-service-accounts-client-id",
+        "MDB_MCP_API_CLIENT_SECRET": "your-atlas-service-accounts-client-secret"
+      }
     }
   }
 }
 ```
 
-#### Option 6: Running as an HTTP Server
+#### Option 5: Running as an HTTP Server
 
 > **⚠️ Security Notice:** This server now supports Streamable HTTP transport for remote connections. **HTTP transport is NOT recommended for production use without implementing proper authentication and security measures.**
 
@@ -316,6 +329,8 @@ NOTE: atlas tools are only available when you set credentials on [configuration]
 
 ## Configuration
 
+> **🔒 Security Best Practice:** We strongly recommend using environment variables for sensitive configuration such as API credentials (`MDB_MCP_API_CLIENT_ID`, `MDB_MCP_API_CLIENT_SECRET`) and connection strings (`MDB_MCP_CONNECTION_STRING`) instead of command-line arguments. Environment variables are not visible in process lists and provide better security for your sensitive data.
+
 The MongoDB MCP Server can be configured using multiple methods, with the following precedence (highest to lowest):
 
 1. Command-line arguments
@@ -323,25 +338,27 @@ The MongoDB MCP Server can be configured using multiple methods, with the follow
 
 ### Configuration Options
 
-| CLI Option                | Environment Variable                 | Default    | Description                                                                                                                                                   |
-| ------------------------- | ------------------------------------ | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `apiClientId`             | `MDB_MCP_API_CLIENT_ID`              | <not set>  | Atlas API client ID for authentication. Required for running Atlas tools.                                                                                     |
-| `apiClientSecret`         | `MDB_MCP_API_CLIENT_SECRET`          | <not set>  | Atlas API client secret for authentication. Required for running Atlas tools.                                                                                 |
-| `connectionString`        | `MDB_MCP_CONNECTION_STRING`          | <not set>  | MongoDB connection string for direct database connections. Optional, if not set, you'll need to call the `connect` tool before interacting with MongoDB data. |
-| `loggers`                 | `MDB_MCP_LOGGERS`                    | disk,mcp   | Comma separated values, possible values are `mcp`, `disk` and `stderr`. See [Logger Options](#logger-options) for details.                                    |
-| `logPath`                 | `MDB_MCP_LOG_PATH`                   | see note\* | Folder to store logs.                                                                                                                                         |
-| `disabledTools`           | `MDB_MCP_DISABLED_TOOLS`             | <not set>  | An array of tool names, operation types, and/or categories of tools that will be disabled.                                                                    |
-| `readOnly`                | `MDB_MCP_READ_ONLY`                  | false      | When set to true, only allows read, connect, and metadata operation types, disabling create/update/delete operations.                                         |
-| `indexCheck`              | `MDB_MCP_INDEX_CHECK`                | false      | When set to true, enforces that query operations must use an index, rejecting queries that perform a collection scan.                                         |
-| `telemetry`               | `MDB_MCP_TELEMETRY`                  | enabled    | When set to disabled, disables telemetry collection.                                                                                                          |
-| `transport`               | `MDB_MCP_TRANSPORT`                  | stdio      | Either 'stdio' or 'http'.                                                                                                                                     |
-| `httpPort`                | `MDB_MCP_HTTP_PORT`                  | 3000       | Port number.                                                                                                                                                  |
-| `httpHost`                | `MDB_MCP_HTTP_HOST`                  | 127.0.0.1  | Host to bind the http server.                                                                                                                                 |
-| `idleTimeoutMs`           | `MDB_MCP_IDLE_TIMEOUT_MS`            | 600000     | Idle timeout for a client to disconnect (only applies to http transport).                                                                                     |
-| `notificationTimeoutMs`   | `MDB_MCP_NOTIFICATION_TIMEOUT_MS`    | 540000     | Notification timeout for a client to be aware of diconnect (only applies to http transport).                                                                  |
-| `exportsPath`             | `MDB_MCP_EXPORTS_PATH`               | see note\* | Folder to store exported data files.                                                                                                                          |
-| `exportTimeoutMs`         | `MDB_MCP_EXPORT_TIMEOUT_MS`          | 300000     | Time in milliseconds after which an export is considered expired and eligible for cleanup.                                                                    |
-| `exportCleanupIntervalMs` | `MDB_MCP_EXPORT_CLEANUP_INTERVAL_MS` | 120000     | Time in milliseconds between export cleanup cycles that remove expired export files.                                                                          |
+| CLI Option                             | Environment Variable                                | Default                                                                     | Description                                                                                                                                                                                       |
+| -------------------------------------- | --------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `apiClientId`                          | `MDB_MCP_API_CLIENT_ID`                             | <not set>                                                                   | Atlas API client ID for authentication. Required for running Atlas tools.                                                                                                                         |
+| `apiClientSecret`                      | `MDB_MCP_API_CLIENT_SECRET`                         | <not set>                                                                   | Atlas API client secret for authentication. Required for running Atlas tools.                                                                                                                     |
+| `connectionString`                     | `MDB_MCP_CONNECTION_STRING`                         | <not set>                                                                   | MongoDB connection string for direct database connections. Optional, if not set, you'll need to call the `connect` tool before interacting with MongoDB data.                                     |
+| `loggers`                              | `MDB_MCP_LOGGERS`                                   | disk,mcp                                                                    | Comma separated values, possible values are `mcp`, `disk` and `stderr`. See [Logger Options](#logger-options) for details.                                                                        |
+| `logPath`                              | `MDB_MCP_LOG_PATH`                                  | see note\*                                                                  | Folder to store logs.                                                                                                                                                                             |
+| `disabledTools`                        | `MDB_MCP_DISABLED_TOOLS`                            | <not set>                                                                   | An array of tool names, operation types, and/or categories of tools that will be disabled.                                                                                                        |
+| `confirmationRequiredTools`            | `MDB_MCP_CONFIRMATION_REQUIRED_TOOLS`               | create-access-list,create-db-user,drop-database,drop-collection,delete-many | An array of tool names that require user confirmation before execution. **Requires the client to support [elicitation](https://modelcontextprotocol.io/specification/draft/client/elicitation)**. |
+| `readOnly`                             | `MDB_MCP_READ_ONLY`                                 | false                                                                       | When set to true, only allows read, connect, and metadata operation types, disabling create/update/delete operations.                                                                             |
+| `indexCheck`                           | `MDB_MCP_INDEX_CHECK`                               | false                                                                       | When set to true, enforces that query operations must use an index, rejecting queries that perform a collection scan.                                                                             |
+| `telemetry`                            | `MDB_MCP_TELEMETRY`                                 | enabled                                                                     | When set to disabled, disables telemetry collection.                                                                                                                                              |
+| `transport`                            | `MDB_MCP_TRANSPORT`                                 | stdio                                                                       | Either 'stdio' or 'http'.                                                                                                                                                                         |
+| `httpPort`                             | `MDB_MCP_HTTP_PORT`                                 | 3000                                                                        | Port number.                                                                                                                                                                                      |
+| `httpHost`                             | `MDB_MCP_HTTP_HOST`                                 | 127.0.0.1                                                                   | Host to bind the http server.                                                                                                                                                                     |
+| `idleTimeoutMs`                        | `MDB_MCP_IDLE_TIMEOUT_MS`                           | 600000                                                                      | Idle timeout for a client to disconnect (only applies to http transport).                                                                                                                         |
+| `notificationTimeoutMs`                | `MDB_MCP_NOTIFICATION_TIMEOUT_MS`                   | 540000                                                                      | Notification timeout for a client to be aware of diconnect (only applies to http transport).                                                                                                      |
+| `exportsPath`                          | `MDB_MCP_EXPORTS_PATH`                              | see note\*                                                                  | Folder to store exported data files.                                                                                                                                                              |
+| `exportTimeoutMs`                      | `MDB_MCP_EXPORT_TIMEOUT_MS`                         | 300000                                                                      | Time in milliseconds after which an export is considered expired and eligible for cleanup.                                                                                                        |
+| `exportCleanupIntervalMs`              | `MDB_MCP_EXPORT_CLEANUP_INTERVAL_MS`                | 120000                                                                      | Time in milliseconds between export cleanup cycles that remove expired export files.                                                                                                              |
+| `atlasTemporaryDatabaseUserLifetimeMs` | `MDB_MCP_ATLAS_TEMPORARY_DATABASE_USER_LIFETIME_MS` | 14400000                                                                    | Time in milliseconds that temporary database users created when connecting to MongoDB Atlas clusters will remain active before being automatically deleted.                                       |
 
 #### Logger Options
 
@@ -361,6 +378,8 @@ You can combine multiple loggers, e.g. `--loggers disk stderr` or `export MDB_MC
 export MDB_MCP_LOGGERS="disk,stderr"
 ```
 
+> **💡 Platform Note:** For Windows users, see [Environment Variables](#environment-variables) for platform-specific instructions.
+
 ##### Example: Set logger via command-line argument
 
 ```shell
@@ -400,6 +419,14 @@ Operation types:
 - `metadata` - Tools that read metadata, such as list databases, list collections, collection schema, etc.
 - `connect` - Tools that allow you to connect or switch the connection to a MongoDB instance. If this is disabled, you will need to provide a connection string through the config when starting the server.
 
+#### Require Confirmation
+
+If your client supports [elicitation](https://modelcontextprotocol.io/specification/draft/client/elicitation), you can set the MongoDB MCP server to request user confirmation before executing certain tools.
+
+When a tool is marked as requiring confirmation, the server will send an elicitation request to the client. The client with elicitation support will then prompt the user for confirmation and send the response back to the server. If the client does not support elicitation, the tool will execute without confirmation.
+
+You can set the `confirmationRequiredTools` configuration option to specify the names of tools which require confirmation. By default, the following tools have this setting enabled: `drop-database`, `drop-collection`, `delete-many`, `atlas-create-db-user`, `atlas-create-access-list`.
+
 #### Read-Only Mode
 
 The `readOnly` configuration option allows you to restrict the MCP server to only use tools with "read", "connect", and "metadata" operation types. When enabled, all tools that have "create", "update" or "delete" operation types will not be registered with the server.
@@ -411,6 +438,8 @@ You can enable read-only mode using:
 - **Environment variable**: `export MDB_MCP_READ_ONLY=true`
 - **Command-line argument**: `--readOnly`
 
+> **💡 Platform Note:** For Windows users, see [Environment Variables](#environment-variables) for platform-specific instructions.
+
 When read-only mode is active, you'll see a message in the server logs indicating which tools were prevented from registering due to this restriction.
 
 #### Index Check Mode
@@ -424,6 +453,8 @@ You can enable index check mode using:
 - **Environment variable**: `export MDB_MCP_INDEX_CHECK=true`
 - **Command-line argument**: `--indexCheck`
 
+> **💡 Platform Note:** For Windows users, see [Environment Variables](#environment-variables) for platform-specific instructions.
+
 When index check mode is active, you'll see an error message if a query is rejected due to not using an index.
 
 #### Exports
@@ -447,6 +478,8 @@ You can disable telemetry using:
 - **Command-line argument**: `--telemetry disabled`
 - **DO_NOT_TRACK environment variable**: `export DO_NOT_TRACK=1`
 
+> **💡 Platform Note:** For Windows users, see [Environment Variables](#environment-variables) for platform-specific instructions.
+
 ### Atlas API Access
 
 To use the Atlas API tools, you'll need to create a service account in MongoDB Atlas:
@@ -500,7 +533,9 @@ For a full list of roles and their privileges, see the [Atlas User Roles documen
 
 Set environment variables with the prefix `MDB_MCP_` followed by the option name in uppercase with underscores:
 
-```shell
+**Linux/macOS (bash/zsh):**
+
+```bash
 # Set Atlas API credentials (via Service Accounts)
 export MDB_MCP_API_CLIENT_ID="your-atlas-service-accounts-client-id"
 export MDB_MCP_API_CLIENT_SECRET="your-atlas-service-accounts-client-secret"
@@ -508,8 +543,33 @@ export MDB_MCP_API_CLIENT_SECRET="your-atlas-service-accounts-client-secret"
 # Set a custom MongoDB connection string
 export MDB_MCP_CONNECTION_STRING="mongodb+srv://username:password@cluster.mongodb.net/myDatabase"
 
+# Set log path
 export MDB_MCP_LOG_PATH="/path/to/logs"
+```
+
+**Windows Command Prompt (cmd):**
+
+```cmd
+set "MDB_MCP_API_CLIENT_ID=your-atlas-service-accounts-client-id"
+set "MDB_MCP_API_CLIENT_SECRET=your-atlas-service-accounts-client-secret"
 
+set "MDB_MCP_CONNECTION_STRING=mongodb+srv://username:password@cluster.mongodb.net/myDatabase"
+
+set "MDB_MCP_LOG_PATH=C:\path\to\logs"
+```
+
+**Windows PowerShell:**
+
+```powershell
+# Set Atlas API credentials (via Service Accounts)
+$env:MDB_MCP_API_CLIENT_ID="your-atlas-service-accounts-client-id"
+$env:MDB_MCP_API_CLIENT_SECRET="your-atlas-service-accounts-client-secret"
+
+# Set a custom MongoDB connection string
+$env:MDB_MCP_CONNECTION_STRING="mongodb+srv://username:password@cluster.mongodb.net/myDatabase"
+
+# Set log path
+$env:MDB_MCP_LOG_PATH="C:\path\to\logs"
 ```
 
 #### MCP configuration file examples
@@ -551,14 +611,26 @@ export MDB_MCP_LOG_PATH="/path/to/logs"
 
 Pass configuration options as command-line arguments when starting the server:
 
+> **🔒 Security Note:** For sensitive configuration like API credentials and connection strings, use environment variables instead of command-line arguments.
+
 ```shell
-npx -y mongodb-mcp-server@latest --apiClientId="your-atlas-service-accounts-client-id" --apiClientSecret="your-atlas-service-accounts-client-secret" --connectionString="mongodb+srv://username:password@cluster.mongodb.net/myDatabase" --logPath=/path/to/logs --readOnly --indexCheck
+# Set sensitive data as environment variable
+export MDB_MCP_API_CLIENT_ID="your-atlas-service-accounts-client-id"
+export MDB_MCP_API_CLIENT_SECRET="your-atlas-service-accounts-client-secret"
+export MDB_MCP_CONNECTION_STRING="mongodb+srv://username:password@cluster.mongodb.net/myDatabase"
+
+# Start the server with command line arguments
+npx -y mongodb-mcp-server@latest --logPath=/path/to/logs --readOnly --indexCheck
 ```
 
+> **💡 Platform Note:** The examples above use Unix/Linux/macOS syntax. For Windows users, see [Environment Variables](#environment-variables) for platform-specific instructions.
+
 #### MCP configuration file examples
 
 ##### Connection String with command-line arguments
 
+> **🔒 Security Note:** We do not recommend passing connection string as command line argument. Connection string might contain credentials which can be visible in process lists and logged in various system locations, potentially exposing your credentials. Instead configure [connection string through environment variables](#connection-string-with-environment-variables)
+
 ```json
 {
   "mcpServers": {
@@ -578,6 +650,8 @@ npx -y mongodb-mcp-server@latest --apiClientId="your-atlas-service-accounts-clie
 
 ##### Atlas API credentials with command-line arguments
 
+> **🔒 Security Note:** We do not recommend passing Atlas API credentials as command line argument. The provided credentials can be visible in process lists and logged in various system locations, potentially exposing your credentials. Instead configure [Atlas API credentials through environment variables](#atlas-api-credentials-with-environment-variables)
+
 ```json
 {
   "mcpServers": {

package/dist/cjs/common/atlas/accessListUtils.d.ts

@@ -10,6 +10,7 @@ export declare function makeCurrentIpAccessListEntry(apiClient: ApiClient, proje
  * If the IP is already present, this is a no-op.
  * @param apiClient The Atlas API client instance
  * @param projectId The Atlas project ID
+ * @returns Promise<boolean> - true if a new IP access list entry was created, false if it already existed
  */
-export declare function ensureCurrentIpInAccessList(apiClient: ApiClient, projectId: string): Promise<void>;
+export declare function ensureCurrentIpInAccessList(apiClient: ApiClient, projectId: string): Promise<boolean>;
 //# sourceMappingURL=accessListUtils.d.ts.map

package/dist/cjs/common/atlas/accessListUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"accessListUtils.d.ts","sourceRoot":"","sources":["../../../../src/common/atlas/accessListUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,eAAO,MAAM,2BAA2B,sDAAsD,CAAC;AAE/F,wBAAsB,4BAA4B,CAC9C,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,MAAoC,GAC9C,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAOlE;AAED;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BxG"}
+{"version":3,"file":"accessListUtils.d.ts","sourceRoot":"","sources":["../../../../src/common/atlas/accessListUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAIhD,eAAO,MAAM,2BAA2B,sDAAsD,CAAC;AAE/F,wBAAsB,4BAA4B,CAC9C,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,MAAoC,GAC9C,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAOlE;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA8B3G"}

package/dist/cjs/common/atlas/accessListUtils.js

@@ -19,6 +19,7 @@ async function makeCurrentIpAccessListEntry(apiClient, projectId, comment = expo
  * If the IP is already present, this is a no-op.
  * @param apiClient The Atlas API client instance
  * @param projectId The Atlas project ID
+ * @returns Promise<boolean> - true if a new IP access list entry was created, false if it already existed
  */
 async function ensureCurrentIpInAccessList(apiClient, projectId) {
     const entry = await makeCurrentIpAccessListEntry(apiClient, projectId, exports.DEFAULT_ACCESS_LIST_COMMENT);
@@ -32,6 +33,7 @@ async function ensureCurrentIpInAccessList(apiClient, projectId) {
             context: "accessListUtils",
             message: `IP access list created: ${JSON.stringify(entry)}`,
         });
+        return true;
     }
     catch (err) {
         if (err instanceof apiClientError_js_1.ApiClientError && err.response?.status === 409) {
@@ -41,7 +43,7 @@ async function ensureCurrentIpInAccessList(apiClient, projectId) {
                 context: "accessListUtils",
                 message: `IP address ${entry.ipAddress} is already present in the access list for project ${projectId}.`,
             });
-            return;
+            return false;
         }
         apiClient.logger.warning({
             id: logger_js_1.LogId.atlasIpAccessListAddFailure,
@@ -49,5 +51,6 @@ async function ensureCurrentIpInAccessList(apiClient, projectId) {
             message: `Error adding IP access list: ${err instanceof Error ? err.message : String(err)}`,
         });
     }
+    return false;
 }
 //# sourceMappingURL=accessListUtils.js.map

package/dist/cjs/common/atlas/accessListUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessListUtils.js","sourceRoot":"","sources":["../../../../src/common/atlas/accessListUtils.ts"],"names":[],"mappings":";;;AAMA,oEAWC;AAQD,kEA4BC;AApDD,4CAAqC;AACrC,2DAAqD;AAExC,QAAA,2BAA2B,GAAG,mDAAmD,CAAC;AAExF,KAAK,UAAU,4BAA4B,CAC9C,SAAoB,EACpB,SAAiB,EACjB,UAAkB,mCAA2B;IAE7C,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;IAC3D,OAAO;QACH,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,kBAAkB;QAC7B,OAAO;KACV,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,2BAA2B,CAAC,SAAoB,EAAE,SAAiB;IACrF,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,SAAS,EAAE,SAAS,EAAE,mCAA2B,CAAC,CAAC;IACpG,IAAI,CAAC;QACD,MAAM,SAAS,CAAC,yBAAyB,CAAC;YACtC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE;YACxC,IAAI,EAAE,CAAC,KAAK,CAAC;SAChB,CAAC,CAAC;QACH,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YACnB,EAAE,EAAE,iBAAK,CAAC,sBAAsB;YAChC,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;SAC9D,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,kCAAc,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;YAChE,+CAA+C;YAC/C,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;gBACnB,EAAE,EAAE,iBAAK,CAAC,sBAAsB;gBAChC,OAAO,EAAE,iBAAiB;gBAC1B,OAAO,EAAE,cAAc,KAAK,CAAC,SAAS,sDAAsD,SAAS,GAAG;aAC3G,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,iBAAK,CAAC,2BAA2B;YACrC,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC9F,CAAC,CAAC;IACP,CAAC;AACL,CAAC"}
+{"version":3,"file":"accessListUtils.js","sourceRoot":"","sources":["../../../../src/common/atlas/accessListUtils.ts"],"names":[],"mappings":";;;AAMA,oEAWC;AASD,kEA8BC;AAvDD,4CAAqC;AACrC,2DAAqD;AAExC,QAAA,2BAA2B,GAAG,mDAAmD,CAAC;AAExF,KAAK,UAAU,4BAA4B,CAC9C,SAAoB,EACpB,SAAiB,EACjB,UAAkB,mCAA2B;IAE7C,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC;IAC3D,OAAO;QACH,OAAO,EAAE,SAAS;QAClB,SAAS,EAAE,kBAAkB;QAC7B,OAAO;KACV,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,2BAA2B,CAAC,SAAoB,EAAE,SAAiB;IACrF,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,SAAS,EAAE,SAAS,EAAE,mCAA2B,CAAC,CAAC;IACpG,IAAI,CAAC;QACD,MAAM,SAAS,CAAC,yBAAyB,CAAC;YACtC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE;YACxC,IAAI,EAAE,CAAC,KAAK,CAAC;SAChB,CAAC,CAAC;QACH,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YACnB,EAAE,EAAE,iBAAK,CAAC,sBAAsB;YAChC,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;SAC9D,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,GAAG,YAAY,kCAAc,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,EAAE,CAAC;YAChE,+CAA+C;YAC/C,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;gBACnB,EAAE,EAAE,iBAAK,CAAC,sBAAsB;gBAChC,OAAO,EAAE,iBAAiB;gBAC1B,OAAO,EAAE,cAAc,KAAK,CAAC,SAAS,sDAAsD,SAAS,GAAG;aAC3G,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,iBAAK,CAAC,2BAA2B;YACrC,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAC9F,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/dist/cjs/common/config.d.ts

@@ -1,4 +1,8 @@
 import type { CliOptions, ConnectionInfo } from "@mongosh/arg-parser";
+export declare function validateConfigKey(key: string): {
+    valid: boolean;
+    suggestion?: string;
+};
 export interface UserConfig extends CliOptions {
     apiBaseUrl: string;
     apiClientId?: string;
@@ -10,6 +14,7 @@ export interface UserConfig extends CliOptions {
     exportCleanupIntervalMs: number;
     connectionString?: string;
     disabledTools: Array<string>;
+    confirmationRequiredTools: Array<string>;
     readOnly?: boolean;
     indexCheck?: boolean;
     transport: "stdio" | "http";
@@ -19,12 +24,18 @@ export interface UserConfig extends CliOptions {
     loggers: Array<"stderr" | "disk" | "mcp">;
     idleTimeoutMs: number;
     notificationTimeoutMs: number;
+    atlasTemporaryDatabaseUserLifetimeMs: number;
 }
 export declare const defaultUserConfig: UserConfig;
 export declare const config: UserConfig;
 export type DriverOptions = ConnectionInfo["driverOptions"];
 export declare const defaultDriverOptions: DriverOptions;
 export declare const driverOptions: Omit<import("@mongosh/arg-parser").DevtoolsConnectOptions, "productName" | "productDocsLink">;
+export declare function warnAboutDeprecatedOrUnknownCliArgs(args: Record<string, unknown>, { warn, exit }: {
+    warn: (msg: string) => void;
+    exit: (status: number) => void | never;
+}): void;
+export declare function registerKnownSecretsInRootKeychain(userConfig: Partial<UserConfig>): void;
 export declare function setupUserConfig({ cli, env, defaults, }: {
     cli: string[];
     env: Record<string, unknown>;

package/dist/cjs/common/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/common/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmGtE,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;CACjC;AAED,eAAO,MAAM,iBAAiB,EAAE,UAiB/B,CAAC;AAEF,eAAO,MAAM,MAAM,YAIjB,CAAC;AAQH,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;AAC5D,eAAO,MAAM,oBAAoB,EAAE,aAWlC,CAAC;AAEF,eAAO,MAAM,aAAa,+FAGxB,CAAC;AAqHH,wBAAgB,eAAe,CAAC,EAC5B,GAAG,EACH,GAAG,EACH,QAAQ,GACX,EAAE;IACC,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CACjC,GAAG,UAAU,CA8Cb;AAED,wBAAgB,iBAAiB,CAAC,EAC9B,MAAM,EACN,QAAQ,GACX,EAAE;IACC,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;CACpC,GAAG,aAAa,CAMhB"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/common/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA2GtE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CA6BtF;AAaD,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC,CAAC;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oCAAoC,EAAE,MAAM,CAAC;CAChD;AAED,eAAO,MAAM,iBAAiB,EAAE,UAyB/B,CAAC;AAEF,eAAO,MAAM,MAAM,YAIjB,CAAC;AAQH,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;AAC5D,eAAO,MAAM,oBAAoB,EAAE,aAWlC,CAAC;AAEF,eAAO,MAAM,aAAa,+FAGxB,CAAC;AAkHH,wBAAgB,mCAAmC,CAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,KAAK,CAAA;CAAE,GACxF,IAAI,CAsCN;AAyBD,wBAAgB,kCAAkC,CAAC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAqBxF;AAED,wBAAgB,eAAe,CAAC,EAC5B,GAAG,EACH,GAAG,EACH,QAAQ,GACX,EAAE;IACC,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;CACjC,GAAG,UAAU,CAgDb;AAED,wBAAgB,iBAAiB,CAAC,EAC9B,MAAM,EACN,QAAQ,GACX,EAAE;IACC,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;CACpC,GAAG,aAAa,CAMhB"}