MongoDB MCP for your AI agent

Notes

MongoDB connects with the connection string of a database user, for example mongodb+srv://cogny_reader:<password>@cluster0.abcde.mongodb.net/shop from Atlas → Connect → Drivers, or a mongodb:// string for a self-hosted server. The database after the host (/shop) is the default for every tool; each tool also takes a database argument. Characters like @, : and / in the password must be percent-encoded (%40, %3A, %2F).

Create a user that can only read:

• Atlas: Security → Database & Network Access → Database Users → Add New Database User, Password authentication, built-in role "Only read any database" (or the read role on just the databases Cogny should see, under Specific Privileges).
• Self-hosted: db.createUser({user: "cogny_reader", pwd: "<strong password>", roles: [{role: "read", db: "<your database>"}]}).

get_server_info lists the user's roles and warns when one of them can write.

Every Cogny connection comes from 207.175.17.47. On Atlas, add it under Database & Network Access → IP Access List; on your own server, allow it in the firewall. The server must be reachable from the internet and use TLS with a certificate from a public certificate authority (Atlas does by default).

Filters, projections, sorts and pipelines are JSON in MongoDB Extended JSON, so an ObjectId is {"$oid": "…"} and a date is {"$date": "2026-10-01T00:00:00Z"}. describe_collection infers the fields from a random sample of up to 500 documents: a field that only a few documents have may not show up.

Every operation stops after 60 seconds. find_documents returns up to 1,000 documents per call (50 by default), run_aggregation up to 2,000 rows (200 by default) and get_distinct_values up to 5,000 values, and each says when a result was cut. Large documents are shortened: long strings, long arrays and deep nesting are trimmed, and a response stops at about 500,000 characters. Aggregate with run_aggregation rather than paging through raw documents.

Known gaps

• Read only. No tools insert, update or delete documents, or create collections, indexes or users.
• $out and $merge (which write), $where, $function and $accumulator (server-side JavaScript) and $changeStream are refused.
• Only username/password (SCRAM) users. X.509 certificates, AWS IAM, OIDC/workload identity and Kerberos/LDAP logins can't be connected.
• Connection-string options that turn off certificate checks, point at local certificate files or route through a proxy are refused, and so is tls=false.
• A MongoDB reachable only inside a private network (VPC peering, Private Endpoint, PrivateLink) can't be connected.
• No Atlas administration: clusters, backups, alerts, Atlas Search index management and the Atlas Data API are not covered.
• No change streams or live updates; each call reads the data as it is at that moment.