← Index

io.github.mongodb-js/mongodb-mcp-server

io.github.mongodb-js/mongodb-mcp-serverv1.14.0Databases

MongoDB Model Context Protocol Server

In-path gate · all MCP tools

Using io.github.mongodb-js/mongodb-mcp-server in Claude, Cursor, Gemini CLI, Cline, or Zed?

MCP tool contracts can change remotely with no version bump. The mcpindex gate pins each contract and HOLDs the call when it drifts-before your agent acts. Zero credentials. This is not the package install for this server itself (use Install this server for that).

Install the mcpindex gate (one command)

Rewrites your MCP host config so each server launches behind the gate. Inspect first: curl -fsSL https://mcpindex.ai/install.sh | less

uv tool install mcpindex-gate && mcpindex-config-wire
Trust verdict · v1 advisory · method
REVIEWstatus: PARTIALfresh until 2026-08-09 05:01 UTC
screened 2026-07-10tier: scannedgranularity: description-levelsource: registry

Semantic screen found no manipulation pattern in the description. Conformance probe not yet run.

mcpindex.integrity.descriptionpassINFO

evidenceNo malicious instructions foundvia static_description

Limits of this verdict
  • - Semantic screen only - the deterministic conformance probe has not run on this server
  • - Confidence is reported but not yet calibrated (v1)
  • - Screen reads the tool description, not the live behavior
  • - advisory
  • - registry description only no input schema
  • - screen model 8b

Semantic screen: an LLM judge reads the tool description for hidden instructions (status PARTIAL). A pass means the description is not lying, not that the tool is safe: a high-capability tool with an honest description still warrants caution. The deterministic conformance probe has not been run on this server yet, so the screen here is semantic-only. Posture: advisory. Confidences are reported but not yet calibrated (calibrated=false at v1). Full verdict history is not shown on this page.

Own this server? Screen its description →

That verdict was true at screening time (snapshot 2026-07-31).

Contracts can change after screening, with no version bump. The gate pins io.github.mongodb-js/mongodb-mcp-server’s tool contracts on first sight and holds any silent change before your agent acts - the check that keeps being true on Tuesday.

See your first HOLD in 2 minutes →

Related: how to trust an MCP server · screen before install · silent contract drift

Embed this badge

A live verdict badge for your README or listing. It reflects the current screen, links back here, and updates when the verdict does.

Markdown
[![mcpindex](https://mcpindex.ai/api/v1/badge/io-github-mongodb-js-mongodb-mcp-server)](https://mcpindex.ai/server/io-github-mongodb-js-mongodb-mcp-server)
HTML
<a href="https://mcpindex.ai/server/io-github-mongodb-js-mongodb-mcp-server"><img src="https://mcpindex.ai/api/v1/badge/io-github-mongodb-js-mongodb-mcp-server" alt="mcpindex verdict" height="20" /></a>
Environment variables
MDB_MCP_ALLOW_REQUEST_OVERRIDES

When set to true, allows configuration values to be overridden via request headers and query parameters.

MDB_MCP_API_CLIENT_ID
secret

Atlas API client ID for authentication. Required for running Atlas tools.

MDB_MCP_API_CLIENT_SECRET
secret

Atlas API client secret for authentication. Required for running Atlas tools.

MDB_MCP_ASSISTANT_BASE_URL

Base URL for the MongoDB Assistant API.

MDB_MCP_ATLAS_TEMPORARY_DATABASE_USER_LIFETIME_MS

Time in milliseconds that temporary database users created when connecting to MongoDB Atlas clusters will remain active before being automatically deleted.

MDB_MCP_CONFIRMATION_REQUIRED_TOOLS

Comma separated values of tool names that require user confirmation before execution. Requires the client to support elicitation.

MDB_MCP_CONNECTION_STRING
secret

MongoDB connection string for direct database connections. Optional, if not set, you'll need to call the connect tool before interacting with MongoDB data.

MDB_MCP_DISABLE_SERVER_SIDE_JS

When set to true, disallows the use of server-side JavaScript operators (such as $where, $function, and $accumulator) in query filters and aggregation pipelines.

MDB_MCP_DISABLED_TOOLS

Comma separated values of tool names, operation types, and/or categories of tools that will be disabled.

MDB_MCP_DRY_RUN

When true, runs the server in dry mode: dumps configuration and enabled tools, then exits without starting the server.

MDB_MCP_EXPORT_CLEANUP_INTERVAL_MS

Time in milliseconds between export cleanup cycles that remove expired export files.

MDB_MCP_EXPORT_TIMEOUT_MS

Time in milliseconds after which an export is considered expired and eligible for cleanup.

MDB_MCP_EXPORTS_PATH

Folder to store exported data files.

MDB_MCP_EXTERNALLY_MANAGED_SESSIONS

When true, the HTTP transport allows requests with a session ID supplied externally through the 'mcp-session-id' header. When an external ID is supplied, the initialization request is optional.

MDB_MCP_HEALTH_CHECK_HOST

Deprecated. Use `monitoringServerHost` instead. Host address to bind the healthCheck HTTP server to (only used when transport is 'http'). If provided, `healthCheckPort` must also be set.

MDB_MCP_HEALTH_CHECK_PORT

Deprecated. Use `monitoringServerPort` instead. Port number for the healthCheck HTTP server (only used when transport is 'http'). If provided, `healthCheckHost` must also be set.

MDB_MCP_HTTP_BODY_LIMIT

Maximum size of the HTTP request body in bytes (only used when transport is 'http'). This value is passed as the optional limit parameter to the Express.js json() middleware.

MDB_MCP_HTTP_HEADERS

Header that the HTTP server will validate when making requests (only used when transport is 'http').

MDB_MCP_HTTP_HOST

Host address to bind the HTTP server to (only used when transport is 'http').

MDB_MCP_HTTP_PORT

Port number for the HTTP server (only used when transport is 'http'). Use 0 for a random port.

MDB_MCP_HTTP_RESPONSE_TYPE

The HTTP response type for tool responses: 'sse' for Server-Sent Events, 'json' for standard JSON responses.

MDB_MCP_IDLE_TIMEOUT_MS

Idle timeout for a client to disconnect (only applies to http transport).

MDB_MCP_INDEX_CHECK

When set to true, enforces that query operations must use an index, rejecting queries that perform a collection scan.

MDB_MCP_LOG_PATH

Folder to store logs.

MDB_MCP_LOGGERS

Comma separated values of logger types.

MDB_MCP_MAX_BYTES_PER_QUERY

The maximum size in bytes for results from a find or aggregate tool call. This serves as an upper bound for the responseBytesLimit parameter in those tools.

MDB_MCP_MAX_DOCUMENTS_PER_QUERY

The maximum number of documents that can be returned by a find or aggregate tool call. For the find tool, the effective limit will be the smaller of this value and the tool's limit parameter.

MDB_MCP_MAX_SESSIONS

Maximum number of concurrent sessions the HTTP transport will hold in memory (only used when transport is 'http'). Each session holds a full server instance, transport, and timers, so choose a value based on your deployment's available memory; the default is a conservative safety net rather than a recommended production value.

MDB_MCP_MAX_TIME_M_S

The maximum time in milliseconds that operations are allowed to run on the MongoDB server. When set, this value is passed as the maxTimeMS option to read operations such as find, aggregate, and count.

MDB_MCP_MCP_CLIENT_LOG_LEVEL

Minimum severity level for log messages forwarded to the MCP client.

MDB_MCP_MONITORING_SERVER_FEATURES

Features to expose on the monitoring server (only used when transport is 'http' and monitoringServerHost/monitoringServerPort are set).

MDB_MCP_MONITORING_SERVER_HOST

Host address to bind the monitoring HTTP server to (only used when transport is 'http'). If provided, `monitoringServerPort` must also be set.

MDB_MCP_MONITORING_SERVER_PORT

Port number for the monitoring HTTP server (only used when transport is 'http'). If provided, `monitoringServerHost` must also be set.

MDB_MCP_NOTIFICATION_TIMEOUT_MS

Notification timeout for a client to be aware of disconnect (only applies to http transport).

MDB_MCP_PREVIEW_FEATURES

Comma separated values of preview features that are enabled.

MDB_MCP_READ_ONLY

When set to true, only allows read, connect, and metadata operation types, disabling create/update/delete operations.

MDB_MCP_TELEMETRY

When set to disabled, disables telemetry collection.

MDB_MCP_TRANSPORT

Either 'stdio' or 'http'.

MDB_MCP_VOYAGE_API_KEY
secret

API key for Voyage AI embeddings service (required for creating Atlas Local deployments with auto-embed vector search capabilities).

MDB_MCP_ALLOW_REQUEST_OVERRIDES

When set to true, allows configuration values to be overridden via request headers and query parameters.

MDB_MCP_API_CLIENT_ID
secret

Atlas API client ID for authentication. Required for running Atlas tools.

MDB_MCP_API_CLIENT_SECRET
secret

Atlas API client secret for authentication. Required for running Atlas tools.

MDB_MCP_ASSISTANT_BASE_URL

Base URL for the MongoDB Assistant API.

MDB_MCP_ATLAS_TEMPORARY_DATABASE_USER_LIFETIME_MS

Time in milliseconds that temporary database users created when connecting to MongoDB Atlas clusters will remain active before being automatically deleted.

MDB_MCP_CONFIRMATION_REQUIRED_TOOLS

Comma separated values of tool names that require user confirmation before execution. Requires the client to support elicitation.

MDB_MCP_CONNECTION_STRING
secret

MongoDB connection string for direct database connections. Optional, if not set, you'll need to call the connect tool before interacting with MongoDB data.

MDB_MCP_DISABLE_SERVER_SIDE_JS

When set to true, disallows the use of server-side JavaScript operators (such as $where, $function, and $accumulator) in query filters and aggregation pipelines.

MDB_MCP_DISABLED_TOOLS

Comma separated values of tool names, operation types, and/or categories of tools that will be disabled.

MDB_MCP_DRY_RUN

When true, runs the server in dry mode: dumps configuration and enabled tools, then exits without starting the server.

MDB_MCP_EXPORT_CLEANUP_INTERVAL_MS

Time in milliseconds between export cleanup cycles that remove expired export files.

MDB_MCP_EXPORT_TIMEOUT_MS

Time in milliseconds after which an export is considered expired and eligible for cleanup.

MDB_MCP_EXPORTS_PATH

Folder to store exported data files.

MDB_MCP_EXTERNALLY_MANAGED_SESSIONS

When true, the HTTP transport allows requests with a session ID supplied externally through the 'mcp-session-id' header. When an external ID is supplied, the initialization request is optional.

MDB_MCP_HEALTH_CHECK_HOST

Deprecated. Use `monitoringServerHost` instead. Host address to bind the healthCheck HTTP server to (only used when transport is 'http'). If provided, `healthCheckPort` must also be set.

MDB_MCP_HEALTH_CHECK_PORT

Deprecated. Use `monitoringServerPort` instead. Port number for the healthCheck HTTP server (only used when transport is 'http'). If provided, `healthCheckHost` must also be set.

MDB_MCP_HTTP_BODY_LIMIT

Maximum size of the HTTP request body in bytes (only used when transport is 'http'). This value is passed as the optional limit parameter to the Express.js json() middleware.

MDB_MCP_HTTP_HEADERS

Header that the HTTP server will validate when making requests (only used when transport is 'http').

MDB_MCP_HTTP_HOST

Host address to bind the HTTP server to (only used when transport is 'http').

MDB_MCP_HTTP_PORT

Port number for the HTTP server (only used when transport is 'http'). Use 0 for a random port.

MDB_MCP_HTTP_RESPONSE_TYPE

The HTTP response type for tool responses: 'sse' for Server-Sent Events, 'json' for standard JSON responses.

MDB_MCP_IDLE_TIMEOUT_MS

Idle timeout for a client to disconnect (only applies to http transport).

MDB_MCP_INDEX_CHECK

When set to true, enforces that query operations must use an index, rejecting queries that perform a collection scan.

MDB_MCP_LOG_PATH

Folder to store logs.

MDB_MCP_LOGGERS

Comma separated values of logger types.

MDB_MCP_MAX_BYTES_PER_QUERY

The maximum size in bytes for results from a find or aggregate tool call. This serves as an upper bound for the responseBytesLimit parameter in those tools.

MDB_MCP_MAX_DOCUMENTS_PER_QUERY

The maximum number of documents that can be returned by a find or aggregate tool call. For the find tool, the effective limit will be the smaller of this value and the tool's limit parameter.

MDB_MCP_MAX_SESSIONS

Maximum number of concurrent sessions the HTTP transport will hold in memory (only used when transport is 'http'). Each session holds a full server instance, transport, and timers, so choose a value based on your deployment's available memory; the default is a conservative safety net rather than a recommended production value.

MDB_MCP_MAX_TIME_M_S

The maximum time in milliseconds that operations are allowed to run on the MongoDB server. When set, this value is passed as the maxTimeMS option to read operations such as find, aggregate, and count.

MDB_MCP_MCP_CLIENT_LOG_LEVEL

Minimum severity level for log messages forwarded to the MCP client.

MDB_MCP_MONITORING_SERVER_FEATURES

Features to expose on the monitoring server (only used when transport is 'http' and monitoringServerHost/monitoringServerPort are set).

MDB_MCP_MONITORING_SERVER_HOST

Host address to bind the monitoring HTTP server to (only used when transport is 'http'). If provided, `monitoringServerPort` must also be set.

MDB_MCP_MONITORING_SERVER_PORT

Port number for the monitoring HTTP server (only used when transport is 'http'). If provided, `monitoringServerHost` must also be set.

MDB_MCP_NOTIFICATION_TIMEOUT_MS

Notification timeout for a client to be aware of disconnect (only applies to http transport).

MDB_MCP_PREVIEW_FEATURES

Comma separated values of preview features that are enabled.

MDB_MCP_READ_ONLY

When set to true, only allows read, connect, and metadata operation types, disabling create/update/delete operations.

MDB_MCP_TELEMETRY

When set to disabled, disables telemetry collection.

MDB_MCP_TRANSPORT

Either 'stdio' or 'http'.

MDB_MCP_VOYAGE_API_KEY
secret

API key for Voyage AI embeddings service (required for creating Atlas Local deployments with auto-embed vector search capabilities).

MCP quality score · maturity, not trust · methodology
freshness
25
completeness
5
installability
25
documentation
15
stability
10
Alternatives in Databases