Build my server

Guides

MongoDB MCP Server: Setup, Read-Only Mode and Security (Oct 2026)

By Team TrustedMCP

On this page
MongoDB MCP Server: Setup, Read-Only Mode and Security (Oct 2026)

The MongoDB MCP server is MongoDB's own official server. It lets an agent query collections, inspect schemas and manage Atlas clusters. TrustedMCP grades it A. Our lead advice: run it in read-only mode, connected as a dedicated database user that can only read one database.

The source is open at mongodb-js/mongodb-mcp-server. You can run it yourself with npx or Docker, or use MongoDB's hosted Atlas server at https://mcp.mongodb.com.

What it connects

  • Database tools: find, aggregate, count, schema and index info, plus write tools such as insert-many, update-many, delete-many, drop-collection and drop-database.
  • Atlas tools: list and create clusters, projects, database users and IP access list entries. These load only when you give it Atlas API credentials.
  • Atlas Local tools: create and delete local Atlas deployments in Docker.

Set it up safely

These settings come from the README and MongoDB's security best practices.

  • Turn on read-only mode. Add --readOnly, or set MDB_MCP_READ_ONLY=true. It is off by default. With it on, create, update and delete tools are not registered at all.
  • Use a dedicated read-only database user. Give it the built-in read role on one database only. See MongoDB's built-in roles. MongoDB's docs say: "Never use database write credentials with the MCP Server."
  • Why both? MongoDB warns that aggregate, aggregate-db and export are labeled as read tools, yet a pipeline with $out or $merge writes data. Read-only mode keeps those tools. A read-only database role makes the write fail.
  • Keep the connection string in an env var. Use MDB_MCP_CONNECTION_STRING, not the --connectionString argument. The README says command-line arguments can show up in process lists and logs.
  • Stay off the production primary. Point it at a copy, a staging cluster or a secondary. MongoDB's read preference docs cover readPreference=secondary in the connection string. Reads from secondaries can be slightly stale.
  • Keep HTTP mode on localhost. The default transport is stdio. In HTTP mode the server binds to 127.0.0.1 and refuses to start on any other host unless you set MDB_MCP_DANGEROUS_HOST_BINDING=true. Don't. The README says the server "ships with no built-in authentication".
  • Scope Atlas credentials. For Atlas tools you create an Atlas service account. The README says to grant the minimum, prefer project-level roles, and avoid Organization Owner. Project Read Only is enough to view clusters.
  • Disable what you don't need. MDB_MCP_DISABLED_TOOLS (or --disabledTools) takes tool names, operation types (create, update, delete, read, metadata, connect) and categories (atlas, mongodb).

Setup

Snippets come from the README and MongoDB's get started guide. You need Node.js 22.13 or later. Replace <connection-string> with your read-only user's URI. Never commit it.

Claude Code. MongoDB's guide uses its plugin. In a Claude Code session, run the following, then run the /mongodb:mongodb-mcp-setup skill and answer Y to read-only mode:

/plugin install mongodb@claude-plugins-official

Or run MongoDB's setup script in any terminal. It asks for read-only mode and your connection string, then writes the client config:

npx -y mongodb-mcp-server@latest setup

Cursor (.cursor/mcp.json in your project or home folder):

{ "mcpServers": { "MongoDB": {
  "command": "npx",
  "args": ["-y", "mongodb-mcp-server@latest", "--readOnly"],
  "env": { "MDB_MCP_CONNECTION_STRING": "<connection-string>" } } } }

VS Code (.vscode/mcp.json). This matches the README's install button. VS Code asks for the connection string, so it stays out of the file:

{ "inputs": [{ "id": "connection_string", "type": "promptString",
    "description": "MongoDB connection string" }],
  "servers": { "mongodb": {
    "command": "npx",
    "args": ["-y", "mongodb-mcp-server", "--readOnly"],
    "env": { "MDB_MCP_CONNECTION_STRING": "${input:connection_string}" } } } }

Hosted Atlas server or local?

The hosted server at mcp.mongodb.com signs you in with OAuth 2.1 in the browser. You never handle a connection string or secret. MongoDB recommends it for Atlas users and ships it as the mongodb-atlas plugin for Claude Code, Cursor and VS Code. An organization owner must first enable AI client access.

The catch: the agent acts with your full Atlas role. MongoDB's docs say "You cannot delegate a subset of your permissions." An organization owner can set the access mode to read-only for everyone. Access ends after 7 days idle or 30 days total.

Choose the local server for self-managed MongoDB, or when you want a narrow database user instead of your own Atlas identity.

Security notes

Prompt injection lives in your documents. Any field the agent reads, such as a support ticket or a product review, can hold text that tries to give it orders. By default the server wraps results in delimiters with a prompt-injection warning. Leave MDB_MCP_DISABLE_UNTRUSTED_DATA_WARNING unset. The warning helps but is not a guarantee. Read-only access limits the damage.

Confirmation prompts need client support. By default the server asks before drop-database, drop-collection, delete-many and a few Atlas tools. That only works if your client supports elicitation. Otherwise the tool runs without asking.

Don't share one server. MongoDB says the CLI server is for single-user, localhost use and is "not meant to serve multiple users".

More in MCP security best practices and is it safe to install an MCP server.

Why it grades A

  • Maintenance, 25 of 25. Very active. 17 people committed in the last 90 days, in MongoDB's own GitHub org.
  • Known CVEs, 25 of 25. No published advisories.
  • Transport, 20 of 20. HTTP mode binds to 127.0.0.1 and refuses other hosts unless you override it on purpose.
  • Authentication, 18 of 30. The only deduction. The self-run server has no login of its own. Access is exactly what the database user or service account allows, so safety depends on what you hand it. The hosted server adds OAuth.

Full breakdown on the MongoDB MCP listing. The method is in how TrustedMCP scores servers. Similar servers are under databases.

FAQs

How do I install the MongoDB MCP server in Claude Code, Cursor or VS Code? Use the snippets above. In Claude Code, install the mongodb plugin and run its setup skill, or run npx -y mongodb-mcp-server@latest setup. In Cursor and VS Code, add the JSON config and restart.

Connection string or Atlas service account? A connection string gives database tools only. Service account credentials (MDB_MCP_API_CLIENT_ID and MDB_MCP_API_CLIENT_SECRET) add the Atlas tools. Use a connection string unless you need to manage clusters.

Can I make it read-only? Yes. Add --readOnly or set MDB_MCP_READ_ONLY=true. Pair it with a database user that only has the read role.

Can it delete data? Is it safe on production? Without read-only mode, yes. It has delete-many and drop-database. MongoDB recommends read-only access for production. We'd go further: use a copy or a secondary, never the primary.

Does it use a lot of context? Every registered tool's description loads into context. Read-only mode drops the write tools. MDB_MCP_DISABLED_TOOLS="atlas,create,update,delete" trims more. Query results count too. MDB_MCP_MAX_DOCUMENTS_PER_QUERY defaults to 100. See why MCP servers eat your context window.