AgentArmorHQ
Sign in

mongodb-mcp-server

MCP server · npm · ★ 1.2k · graded 2026-10-21Source linked

A Model Context Protocol server to connect to MongoDB databases and MongoDB Atlas Clusters.

No outside reports on file

This tool opens a direct pipeline from an AI system to your databases, so only use it with strict access controls, isolated networks, and careful monitoring—treat it like giving someone a database admin key.

Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for Mongodb MCP Server helpful?

What it can access

  • Local filesNo local folder access notedLOW
  • Command executionNo shell command runner notedLOW
  • Network reachConnects to outside service APINOTED
  • CredentialsRequires API key or tokenREVIEW
  • Package sourcenpm (@mongodb-js/mcp-tools-mongodb)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y @mongodb-js/mcp-tools-mongodb

All setup options ↓

Check this skillWatch it in my stackCompareREADME badgeView project

Everything known

We found nothing about this project in the sources we read (last checked 2026-10-30). That does not mean it has no problems.

0 incidents · 0 advisories · 0 news articles · 8 community threads · checked 2026-10-30

Popularity grade: B (from public signals such as stars and downloads, not a code review). Graded 2026-10-21.

Showing all 8Showing 8 community threads of 8

  1. CommunityCan mongodb-mcp-server be hosted as a remote MCP server over HTTP?AgentArmorHQ community · 2026-10-26
  2. CommunityClaude Code: MongoDB MCP server tools fail with invalid outputSchema draft-07 dialectAgentArmorHQ community · 2026-10-26
  3. CommunityDoes mongodb-mcp-server provide a tool to query official MongDB documentation?AgentArmorHQ community · 2026-10-26
  4. CommunityHow do I export MongoDB query results to JSON in mongodb-mcp-server?AgentArmorHQ community · 2026-10-26
  5. Communitymongodb-mcp-server count tool ignores filter and returns total collection count in CursorAgentArmorHQ community · 2026-10-26
  6. Communitymongodb-mcp-server Docker container doesn't exit — fixed in v0.1.2?AgentArmorHQ community · 2026-10-26
  7. Communitymongodb-mcp-server fails to start with nvm in Claude, Cursor, or VS Code: how to fix?AgentArmorHQ community · 2026-10-26
  8. Communitymongodb-mcp-server in Docker: can't connect via HTTP to localhost:9091 — what transport does it use?AgentArmorHQ community · 2026-10-26

Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.

Check a specific version →

About Mongodb MCP Server

This tool lets AI assistants connect directly to MongoDB databases and MongoDB Atlas cloud clusters to read, query, and possibly modify data. It uses the Model Context Protocol (MCP) standard to bridge MongoDB with AI applications.

Who it’s for

Developers and teams who want AI assistants to help analyze, query, or work with data stored in MongoDB. It's for people comfortable giving AI systems direct database access.

Alternatives

  • Supabase PostgreSQL connector: Similar MCP tool for PostgreSQL databases with built-in row-level security.
  • SQLite MCP server: Simpler local database option with fewer permissions and network risks.
  • Manual data export + analysis: Upload a CSV or JSON snapshot of data to the AI instead of live database access.

Setup

Check these steps against the project’s own instructions before running anything.

Follow the project's README

Why this grade

BB — Some risk signals

Signal-based grade (4/7 points): well starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code review.

Popularity and upkeep

38/100
GitHub stars
1.2k
Listing last refreshed
2026-10-30

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Risks to watch for

  • Database access: The AI gains full or partial read/write access to your MongoDB databases, potentially exposing sensitive customer data, credentials, or business records.
  • Unfiltered queries: The AI might run expensive queries, delete data by mistake, or be tricked into accessing collections it shouldn't if permissions aren't carefully set.
  • Credential exposure: Connection strings with usernames and passwords could leak if the AI repeats them in logs or outputs, especially if the setup isn't secured properly.
  • Injection attacks: Untrusted data fed to the AI could be crafted to manipulate MongoDB queries (NoSQL injection) if the tool doesn't safely parameterize requests.
  • Lack of clear activity logs: Without proper monitoring, it may be hard to track what data the AI accessed or changed, making breaches harder to detect.

How to lower the risk

Least-privilege permissions

  • Create a MongoDB user with read-only access to only the collections the AI needs.
  • Use MongoDB Atlas role-based access control to limit the AI's database scope.

Network isolation

  • Run the MCP server on a private network that doesn't touch the public internet.
  • Restrict database connections to a single trusted IP address or VPN.

Monitoring

  • Log all queries the AI runs and review them regularly for suspicious activity.
  • Set up alerts for unusual data access patterns or failed authentication attempts.

Red flags to watch for

  • The AI suddenly asks for database credentials or connection strings.
  • Unexplained spikes in query volume or database CPU usage.
  • The tool making changes to data when it should only read.

Questions

How do I install Mongodb MCP Server?

Run npx -y @mongodb-js/mcp-tools-mongodb in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/mongodb-js/mongodb-mcp-server.

Are there security reports about Mongodb MCP Server?

No reports found for this package in our research (last checked 2026-10-30). Mongodb MCP Server currently holds Grade B (Some risk signals) based on public adoption and transparency signals. Key risk areas to watch include database access, unfiltered queries, credential exposure.

Is Mongodb MCP Server actively maintained?

Mongodb MCP Server has 1.2k GitHub stars. Our directory data was last refreshed on 2026-10-30. Check recent commit activity, release tags, and open issues at github.com/mongodb-js/mongodb-mcp-server before pinning it in production.

What are alternatives to Mongodb MCP Server?

Notable alternatives to Mongodb MCP Server include Supabase PostgreSQL connector (Similar MCP tool for PostgreSQL databases with built-in row-level security), SQLite MCP server (Simpler local database option with fewer permissions and network risks), Manual data export + analysis (Upload a CSV or JSON snapshot of data to the AI instead of live database access). You can also compare Mongodb MCP Server side by side with other MCP servers in the Related tools section on this page.

README badge and team notes

Maintain or use Mongodb MCP Server? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

AgentArmorHQ Risk Grade B for Mongodb MCP Server

GitHub README Markdown:

markdown
[![AgentArmorHQ Risk Grade for Mongodb MCP Server](https://agentarmorhq.com/api/badge/mongodb-js-mongodb-mcp-server)](https://agentarmorhq.com/skills/mongodb-js-mongodb-mcp-server)

HTML embed:

html
<a href="https://agentarmorhq.com/skills/mongodb-js-mongodb-mcp-server"><img src="https://agentarmorhq.com/api/badge/mongodb-js-mongodb-mcp-server" alt="AgentArmorHQ Risk Grade for Mongodb MCP Server" height="20" /></a>

Terminal check:

terminal
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "mongodb-js-mongodb-mcp-server"

Share with your security lead

Need sign-off to use mongodb-mcp-server? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: mongodb-mcp-server
- **Listing URL:** https://agentarmorhq.com/skills/mongodb-js-mongodb-mcp-server
- **Type:** App connector
- **Risk Grade:** Grade B (Some risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.2k GitHub stars

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Connects to outside service API
- **Credentials:** Requires API key or token
- **Package source:** npm (@mongodb-js/mcp-tools-mongodb)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts @mongodb-js/mcp-tools-mongodb`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 21, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type
App connector
Publisher
mongodb-js
Source code
github.com/mongodb-js/mongodb-mcp-server
Install command
npm install @mongodb-js/mcp-tools-mongodb
Est. context load
~1.4k tokens / turn (~8 tool schemas, 0.68% of 200k context)
Popularity
1.2k GitHub stars
Last updated
2026-10-30
Last graded
2026-10-21

Community

Discussions for Mongodb MCP Server

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for Mongodb MCP Server helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude