Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 1
- 4 4
- 3 3
- 2 0
- 1 0
Trust in production
- Trust it - 50%
- With caveats - 38%
- Wouldn't - 13%
88% would recommend this server
How reviewers scored it
- Setup & docs 3.4
- Auth experience 3.1
- Reliability 4.0
- Maintainer responsiveness 4.3
Why it got an A
Official, very active (17 committers in the last 90 days) and no advisories on record. HTTP mode binds to localhost and refuses other hosts unless you explicitly override it. Keep the connection string in an env var, not a CLI argument, and use --readOnly unless you need writes; read-only mode still allows aggregate, which can write via $out/$merge, so also connect as a database user with only the read role. Biggest deduction: the self-run server has no login of its own, so access is only as narrow as the database user you give it. MongoDB's hosted server at mcp.mongodb.com adds OAuth.
How to connect
// ~/.cursor/mcp.json (README Manual Setup, Option 1: Connection String)
{
"mcpServers": {
"MongoDB": {
"command": "npx",
"args": ["-y", "mongodb-mcp-server@latest", "--readOnly"],
"env": {
"MDB_MCP_CONNECTION_STRING": "mongodb://localhost:27017/myDatabase"
}
}
}
}// .vscode/mcp.json (from the README's VS Code install config)
{ "inputs": [{ "id": "connection_string", "type": "promptString",
"description": "MongoDB connection string" }],
"servers": { "mongodb": { "command": "npx",
"args": ["-y", "mongodb-mcp-server", "--readOnly"],
"env": { "MDB_MCP_CONNECTION_STRING": "${input:connection_string}" } } } }# MongoDB's official Claude Code plugin (docs: mongodb.com/docs/mcp-server/get-started)
/plugin install mongodb@claude-plugins-officialIs MongoDB MCP Server safe?
Is MongoDB MCP Server safe to use?
MongoDB MCP Server grades A (strong public trust signals). Login is optional, so check that it is turned on in your setup.
Does MongoDB MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does MongoDB MCP Server support authentication?
Optionally. It can run with a login, but it does not require one, so turn it on.
Alternatives in Databases & Data Stores
- A Neon MCP ServerOfficial hosted Neon server to manage Postgres projects and branches, run SQL, and inspect schema.
- A Supabase MCP ServerOfficial hosted Supabase server to manage projects, run SQL, and inspect schema.
- B BigQuery MCP ServerGoogle-hosted remote server to list datasets and tables, read schemas, and run SQL in BigQuery.
- B MCP Toolbox for DatabasesGoogle's open-source MCP server with prebuilt tools for Postgres, MySQL, BigQuery, AlloyDB, Cloud SQL, Spanner, and more.
- B OMOPHub MCP ServerOfficial server to search, map and walk the hierarchy of 11M+ OHDSI OMOP medical concepts (SNOMED CT, ICD-10, RxNorm, LOINC) over stdio or a hosted HTTPS endpoint.
Embed this badge
[](https://trustedmcp.io/servers/mongodb-mcp-server)<a href="https://trustedmcp.io/servers/mongodb-mcp-server"><img src="https://trustedmcp.io/badge/mongodb-mcp-server.svg" alt="TrustedMCP grade A" height="80"></a>Community reviews
Does what it says, no drama
Hooked MongoDB MCP Server into Claude Code and it worked on the first try. Auth is optional, which is convenient locally. I turned it on before sharing it with the team. Nice to use something maintained by MongoDB rather than a random fork. Easy recommendation.
Used for Incident investigation
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Fine if you lock it to read-only and a replica
The connection string carries full credentials and it goes in as a CLI arg, so it lands in shell history unless you are careful. We point it at a read-only replica user and pass --readOnly. With those two things it has been reliable and genuinely useful.
Used for Read-only analytics questions over an Atlas replica
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Capable, but the credential handling makes me nervous
It does what it says. My hesitation is entirely about a broad-scope connection string sitting in a config file that an agent can read. Would not run this against a primary with write access.
Used for Schema exploration during a migration
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Handy for dev, careful in prod
Mostly reliable, with the odd timeout. The OAuth flow worked first time in Claude Code. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. I will check back in a few releases.
Used for Debugging data issues in staging
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Earned its place in the runbook
Scoped the user tightly, run it in a container with no other creds. Maintainers shipped a fix for a bug I reported within a week. Reliable under pressure.
Used for Incident debugging — querying collections during an outage
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 5/5
No complaints after a month
Replaced a homegrown script with MongoDB MCP Server and have not looked back. Out of the box it runs without sign-in, so remember to enable auth before exposing it anywhere. Good choice if you need MongoDB in your agent.
Used for Read-only analytics questions
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Promising, a bit raw
Some tools are great, a couple feel half finished. You can tell it is actively maintained, the rough edges keep getting fixed. I run it with auth enabled. Without it I would not let it near anything shared.
Used for Prototyping queries before writing code
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Solid and well behaved
Started with it as an experiment, now it is a fixture. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Happy to run it in production.
Used for Answering support questions from the database
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.