mongodb-mcp-server

mongodb-js/mongodb-mcp-server

This official MongoDB server allows AI agents to query and manage MongoDB databases, MongoDB Atlas cloud resources, local Docker deployments, and the MongoDB Assistant knowledge base. The biggest risk is that write and destructive actions are enabled by default—even if you choose read-only mode in the setup wizard due to a bug—allowing a tricked AI agent to modify databases, alter cloud settings, or leak credentials to outside servers without confirmation.

What it can reach

Network

Connects to MongoDB databases, MongoDB Atlas and Assistant APIs, Voyage AI, authentication providers, and telemetry servers, and can optionally listen on local or network HTTP ports.

Files

Reads configuration files and TLS certificates, and writes application logs, exported database data (under ~/.mongodb/mongodb-mcp or %LOCALAPPDATA%\\mongodb\\mongodb-mcp), and AI editor config files.

Secrets

Reads database connection strings and passwords, MongoDB Atlas API credentials, cloud provider keys (AWS, Azure, GCP), TLS keys, and Voyage AI API keys from environment variables, CLI arguments, or config files.

Shell commands

Runs npx commands to install agent skills and opens editor configuration files during the interactive setup wizard.

System

Creates, lists, and deletes local Docker containers for local Atlas deployments, and reads OS metadata and the computer's machine ID for telemetry.

Browser

Can open your local web browser to complete single sign-on (OIDC) authentication.

Findings

1. HighSetup wizard ignores read-only selection and configures server in read-write mode

   packages/setup/src/aiTool.ts:215

   When a user runs the interactive setup wizard (npx mongodb-mcp-server@latest setup) and answers Yes to "Install MCP server as Read-only?", AITool.buildMcpConfigEntry appends "--readOnly" to a local args variable but then returns a hardcoded args: ["-y", "mongodb-mcp-server@latest"] array that omits --readOnly. Because Cursor, VSCode, Windsurf, ClaudeDesktop, and ClaudeCode all inherit this base method (only OpenCode overrides it), users who explicitly request a read-only installation for those clients silently receive a full read-write server configuration.

   Fix: Return args instead of the hardcoded ["-y", "mongodb-mcp-server@latest"] array in AITool.buildMcpConfigEntry.

2. HighRuntime connect tool can connect to arbitrary hosts and leak global driver credentials

   packages/tools-mongodb/src/common/connectionManager.ts:446

   The connect tool is enabled by default (even when --readOnly is set) and accepts any connectionString chosen by the AI agent without user confirmation. When MCPConnectionManager.connect dials a connection without explicit driverOptions, it calls generateConnectionInfoFromCliArgs with this.driverConfig (the server's UserConfig) merged into the tool-supplied connectionString. If the user configured global credentials (such as username, password, or AWS IAM credentials) via environment variables or CLI flags, a prompt injection can pass an attacker-controlled MongoDB URI (mongodb://attacker.example.com:27017) to trigger an outbound connection (SSRF) that authenticates to the attacker's server using the user's configured credentials, or in read-write mode copy data from the user's database to the attacker's database.

   Fix: Do not merge global driverConfig credentials into runtime connect tool calls, and add connect to confirmationRequiredTools by default so the user must approve connecting to new hosts.

3. Mediumatlas-connect-cluster mutates project IP access list and creates database users in read-only mode

   packages/tools-atlas/src/tools/connect/connectCluster.ts:62

   ConnectClusterTool (atlas-connect-cluster) is classified with operationType: "connect", so it remains enabled when --readOnly is active and is not in confirmationRequiredTools by default. When called, it automatically adds the server's current public IPv4 address to the Atlas project's IP access list (which is never removed on disconnect) and creates a temporary database user in the Atlas project. A prompt injection can invoke this tool to modify Atlas network access settings and create database users even when the user enabled --readOnly to prevent infrastructure modifications.

   Fix: Require user confirmation before modifying the project IP access list or creating temporary database users, or skip automatic IP access list and user creation when readOnly is enabled.

4. Mediumatlas-streams-build can exfiltrate cluster data to external HTTPS endpoints and start processors without confirmation

   packages/tools-atlas/src/tools/streams/build.ts:939

   While atlas-streams-manage and atlas-streams-teardown require user confirmation by default (confirmationRequiredTools), atlas-streams-build does not. When Atlas credentials are configured and the server is not in read-only mode, a prompt-injected agent can call atlas-streams-build to create a Cluster connection (defaulting to readWriteAnyDatabase), create an Https connection pointing to an attacker-controlled webhook URL, and deploy a stream processor with autoStart: true that reads from the cluster and POSTs documents to the external URL—bypassing the confirmation prompt that atlas-streams-manage enforces on start-processor.

   Fix: Add atlas-streams-build to the default confirmationRequiredTools list, or require confirmation before creating connections or starting a processor via autoStart: true.

5. MediumWrite operations are enabled by default and execute without confirmation if the client lacks elicitation support

   README.md:532

   By default, readOnly mode is false, which registers tools that modify or delete database data (insert-many, update-many, delete-many, drop-collection, drop-database), provision or tear down Atlas cloud infrastructure (atlas-create-cluster, atlas-create-db-user, atlas-create-access-list, atlas-streams-teardown), and manage local Docker containers. Furthermore, if the user's MCP client does not support MCP elicitation, tools in confirmationRequiredTools proceed without any confirmation prompt, allowing a prompt injection in untrusted data to trigger destructive actions.

   Fix: Run the server with --readOnly (or MDB_MCP_READ_ONLY=true) unless write access is required, disable unneeded tool categories with --disabledTools, and use an MCP client that supports elicitation.

6. MediumDestructive tools execute without confirmation when client lacks elicitation support

   README.md:532

   By default, read-only mode is disabled (readOnly defaults to false) and destructive tools such as drop-database, drop-collection, delete-many, atlas-create-db-user, and atlas-create-access-list rely on MCP elicitation for user confirmation. However, if the user's MCP client does not support elicitation, the server falls back to executing these destructive operations without any confirmation, allowing a prompt injection attack to modify or delete data and cloud access controls.

   Fix: Start the server with --readOnly (or MDB_MCP_READ_ONLY=true) when write access is not needed, or explicitly disable destructive tools via --disabledTools when using an MCP client that does not support elicitation.

7. MediumWrite operations are enabled by default and confirmation-required tools execute without confirmation when client lacks elicitation

   README.md:532

   By default, readOnly mode is false (and several MCP configuration examples in the README omit --readOnly), enabling destructive database and cloud tools such as drop-database, drop-collection, delete-many, atlas-create-db-user, and atlas-create-access-list. In addition, when the connected MCP client does not support MCP elicitation, tools in confirmationRequiredTools silently bypass the confirmation prompt and execute immediately, allowing prompt injection from untrusted documents to trigger destructive actions without user approval.

   Fix: Enable readOnly mode by default unless the user explicitly opts into write access, and fail closed (refuse to run confirmationRequiredTools) when the MCP client does not support elicitation.

8. MediumAWS Dockerfile binds unauthenticated HTTP server to 0.0.0.0 with dangerousHostBinding enabled

   packages/mongodb-mcp-server/deploy/aws/Dockerfile:24

   The AWS deployment Dockerfile configures MDB_MCP_TRANSPORT=http, MDB_MCP_HTTP_HOST=0.0.0.0, MDB_MCP_DANGEROUS_HOST_BINDING=true, and MDB_MCP_EXTERNALLY_MANAGED_SESSIONS=true. Because the server has no built-in authentication, deploying this image to any network-reachable AWS environment (such as ECS, EKS, Fargate, or EC2) without an external authenticating gateway exposes all MongoDB and Atlas tools to unauthenticated network callers.

   Fix: Remove MDB_MCP_DANGEROUS_HOST_BINDING=true and MDB_MCP_HTTP_HOST=0.0.0.0 from the Dockerfile defaults so operators must explicitly set them at runtime after placing an authenticating reverse proxy or runtime in front of the container.

9. MediumAWS deployment Dockerfile binds unauthenticated HTTP server to 0.0.0.0

   packages/mongodb-mcp-server/deploy/aws/Dockerfile:24

   The AWS Dockerfile configures the MCP server to listen on 0.0.0.0:8000 over HTTP and sets MDB_MCP_DANGEROUS_HOST_BINDING=true and MDB_MCP_EXTERNALLY_MANAGED_SESSIONS=true. Because the server has no built-in authentication and defaults to read-write mode, deploying this image in any environment where port 8000 is reachable without an authenticating reverse proxy exposes full database and Atlas access to the network.

   Fix: Ensure the container is only deployed behind an authenticated runtime or proxy (such as Bedrock AgentCore with strict network isolation), and consider setting MDB_MCP_READ_ONLY=true by default in the image.

10. Lowexport tool bypasses indexCheck enforcement

    packages/tools-mongodb/src/tools/read/export.ts:71

    When --indexCheck (MDB_MCP_INDEX_CHECK=true) is enabled, tools such as find, aggregate, count, delete-many, and update-many run checkIndexUsage to reject queries that perform a collection scan (COLLSCAN). However, ExportTool executes find and aggregate cursors and streams the entire result set to disk without checking this.server.config.indexCheck, allowing the agent to trigger unbounded collection scans despite indexCheck being enabled.

    Fix: Check this.server.config.indexCheck and call checkIndexUsage in ExportTool.execute before opening the export cursor.

11. LowHTTP request overrides can disable untrusted data prompt-injection warnings

    packages/cli/src/config/userConfig.ts:68

    Other security-related boolean options in UserConfigSchema (readOnly, indexCheck, disableServerSideJs) use oneWayOverride(true) so that per-request HTTP headers or query parameters (when allowRequestOverrides is enabled) can only make the configuration stricter. In contrast, disableUntrustedDataWarning is registered with overrideBehavior: "override", allowing a request to set disableUntrustedDataWarning to true and strip the <untrusted-user-data> prompt-injection delimiters and warning from tool responses.

    Fix: Change overrideBehavior for disableUntrustedDataWarning to oneWayOverride(false) or "not-allowed".

12. LowAtlas IP lookup and telemetry requests bypass configured HTTP proxy

    packages/atlas-api-client/src/apiClient.ts:207

    ApiClient receives a proxy-aware options.httpClient.fetch and passes it to the OpenAPI client, but getIpInfo(), sendAuthEvents(), and sendUnauthEvents() call the global fetch function directly. When a user configures HTTPS_PROXY or ALL_PROXY, these calls bypass the proxy and connect directly to cloud.mongodb.com, exposing the machine's real IP address.

    Fix: Use the injected options.httpClient.fetch instead of the global fetch in getIpInfo(), sendAuthEvents(), and sendUnauthEvents().

13. LowAWS deployment Dockerfile binds unauthenticated HTTP server to 0.0.0.0 and installs unpinned latest package

    packages/mongodb-mcp-server/deploy/aws/Dockerfile:24

    The AWS Dockerfile sets MDB_MCP_HTTP_HOST=0.0.0.0, MDB_MCP_DANGEROUS_HOST_BINDING=true, and MDB_MCP_EXTERNALLY_MANAGED_SESSIONS=true, and installs mongodb-mcp-server@latest (ignoring the VERSION build argument). While intended to sit behind AWS Bedrock AgentCore, running this container image in any environment without an authenticating reverse proxy exposes an unauthenticated MCP server to the network.

    Fix: Pin the npm package installation to ${VERSION} in the Dockerfile and ensure the container is only deployed behind an authenticating gateway that strips or validates session headers.

14. LowUsage telemetry is enabled by default

    README.md:585

    Telemetry collection is enabled by default (MDB_MCP_TELEMETRY=enabled), which sends tool execution metadata, client information, and a device identifier to MongoDB servers.

    Fix: Set MDB_MCP_TELEMETRY=disabled, pass --telemetry disabled, or set DO_NOT_TRACK=1 in the environment to prevent telemetry data from leaving the machine.

15. LowAWS deployment Dockerfile binds HTTP server to 0.0.0.0 with dangerousHostBinding enabled and unpinned package version

    packages/mongodb-mcp-server/deploy/aws/Dockerfile:24

    The AWS deployment Dockerfile configures the server to listen on 0.0.0.0:8000 and sets MDB_MCP_DANGEROUS_HOST_BINDING=true, MDB_MCP_EXTERNALLY_MANAGED_SESSIONS=true, and installs mongodb-mcp-server@latest ignoring the VERSION build argument. If this container image is run outside of an authenticated gateway or with misconfigured network security groups, it exposes an unauthenticated MCP server with write capabilities to the network.

    Fix: Ensure the container is strictly isolated behind an authenticated runtime such as Bedrock AgentCore, pin the npm install command to mongodb-mcp-server@${VERSION}, and consider enabling MDB_MCP_READ_ONLY=true by default.

16. LowAzure Bicep template defaults to NOAUTH with external ingress and allows all tenant client apps when authAllowedClientApps is empty

    packages/mongodb-mcp-server/deploy/azure/bicep/main.bicep:50

    The Azure Container Apps Bicep template sets ingress.external to true and defaults authMode to NOAUTH. Additionally, when MicrosoftMIBasedAuth is enabled, authAllowedClientApps defaults to an empty array, which permits any client application in the Azure AD tenant to access the MCP server unless explicitly restricted.

    Fix: Default authMode to MicrosoftMIBasedAuth, require a non-empty authAllowedClientApps list, and restrict ingress or enable read-only mode unless write access is explicitly required.

17. LowAWS Dockerfile ignores VERSION build argument and installs unpinned @latest package

    packages/mongodb-mcp-server/deploy/aws/Dockerfile:11

    Although ARG VERSION=latest is declared at the top of the Dockerfile and used in the image label, the npm install command hardcodes mongodb-mcp-server@latest instead of using ${VERSION}. Builds that pass --build-arg VERSION=x.y.z will still pull whatever version is currently tagged latest on npm, breaking version pinning.

    Fix: Change the install command to RUN npm install -g mongodb-mcp-server@${VERSION} and pin ARG VERSION to a specific release version.

18. LowTelemetry is enabled by default and sends usage data to MongoDB

    README.md:585

    Telemetry (MDB_MCP_TELEMETRY) defaults to "enabled", causing the server to collect device/machine identifiers and tool usage events and transmit them to MongoDB servers unless the user explicitly disables it via --telemetry disabled, MDB_MCP_TELEMETRY=disabled, or DO_NOT_TRACK=1.

    Fix: Make telemetry opt-in (disabled by default) or prompt the user for consent during setup before sending telemetry data.

19. LowRequest overrides allow HTTP callers to disable prompt-injection untrusted data warnings

    packages/cli/src/config/configOverrides.test.ts:160

    When allowRequestOverrides is enabled on the HTTP server, disableUntrustedDataWarning uses unrestricted override behavior rather than a one-way stricter-only guard (unlike readOnly, indexCheck, and disableServerSideJs). An HTTP caller can send the x-mongodb-mcp-disable-untrusted-data-warning: true header to strip the <untrusted-user-data> prompt-injection warning wrappers from tool responses even when the server was configured with warnings enabled.

    Fix: Restrict disableUntrustedDataWarning so that request overrides cannot change it from false to true, or mark it as not-allowed for request overrides.

20. LowAWS deployment Dockerfile enables 0.0.0.0 binding and unpinned package installation

    packages/mongodb-mcp-server/deploy/aws/Dockerfile:24

    The AWS deployment Dockerfile sets MDB_MCP_HTTP_HOST=0.0.0.0, MDB_MCP_DANGEROUS_HOST_BINDING=true, and MDB_MCP_EXTERNALLY_MANAGED_SESSIONS=true, and installs an unpinned mongodb-mcp-server@latest (ignoring the VERSION build argument). If this image is deployed outside of an authenticated wrapper like AWS Bedrock AgentCore, it exposes an unauthenticated MCP HTTP endpoint on all network interfaces.

    Fix: Pin the npm install command to the ${VERSION} build argument and ensure network-level authentication is enforced before setting MDB_MCP_DANGEROUS_HOST_BINDING=true.

21. LowWrite and destructive operations are enabled by default and bypass confirmation if elicitation is unsupported

    README.md:461

    The server defaults to MDB_MCP_READ_ONLY=false, exposing database and Atlas write/delete tools unless the user passes --readOnly. Furthermore, while certain destructive tools request user confirmation via MCP elicitation, they execute without confirmation if the MCP client does not support elicitation, and tools such as update-many and rename-collection (with dropTarget: true) are not in confirmationRequiredTools by default.

    Fix: Run the server with --readOnly (or MDB_MCP_READ_ONLY=true) unless write access is explicitly needed, and add rename-collection and update-many to MDB_MCP_CONFIRMATION_REQUIRED_TOOLS when write access is enabled.

22. LowUnpinned npm package installation in AWS Dockerfile ignores VERSION build argument

    packages/mongodb-mcp-server/deploy/aws/Dockerfile:11

    Although the Dockerfile declares ARG VERSION=latest, the npm install command hardcodes mongodb-mcp-server@latest instead of using ${VERSION} or a pinned version/digest, making builds non-reproducible.

    Fix: Pin the package version and reference the build argument: RUN npm install -g mongodb-mcp-server@${VERSION}.

23. InfoTelemetry is enabled by default

    README.md:462

    The server enables telemetry collection by default (MDB_MCP_TELEMETRY="enabled"), periodically sending usage events, tool execution metadata, and hashed device/environment identifiers to MongoDB servers.

    Fix: Set MDB_MCP_TELEMETRY=disabled, pass --telemetry disabled, or set DO_NOT_TRACK=1 in the environment if you do not want usage telemetry sent to MongoDB.