Mongodb MCP server

by mongodb-js·io.github.mongodb-js/mongodb-mcp-server·v3.2.1·1.1k stars

No reviews yet

MongoDB Model Context Protocol Server

A85/100grade A

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

A85/100

not scanned yet

Adoption

Established

1.1k stars101k downloads/wk

Reviews

Write one

Nobody has reviewed Mongodb yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Mongodb tools

No tool declarations could be read from the package source. They show once the server is installed.

Not scanned yet. New listings are scanned within a day or two of arriving.

How Mongodb compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 85/100; higher than 73% of 4,464 AI and agents servers
GitHub stars: 1,138; more than 95% of 2,697 AI and agents servers
Downloads a week: 100,562; more than 97% of 1,515 AI and agents servers with a package

Release history: 2 versions in the registry since 2026-08-10, latest 2026-10-28, typically one every 79 days.

Install Mongodb in Claude Code, Cursor or VS Code

Runs npx -y mongodb-mcp-server on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mongodb-mcp-server -- npx -y mongodb-mcp-server

Add to Cursor

What the publisher says

From the Mongodb repository's README, as published. We do not edit it. Read it on GitHub

MongoDB MCP Server

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Mongodb: common questions

Is Mongodb MCP server safe?: Yes, by our scan: it is graded A (85/100). Read the Mongodb safety report
How do I install Mongodb?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Mongodb need an API key?: Yes. The registry entry asks for MDB_MCP_API_CLIENT_ID, MDB_MCP_API_CLIENT_SECRET, MDB_MCP_CONNECTION_STRING, MDB_MCP_VOYAGE_API_KEY.
Is Mongodb maintained?: The last commit was 40 days ago (2026-09-23). The latest release is v3.2.1.
How does Mongodb compare with other AI and agents MCP servers?: safety score 85/100 (higher than 73% of 4,464 AI and agents servers); github stars 1,138 (more than 95% of 2,697 AI and agents servers); downloads a week 100,562 (more than 97% of 1,515 AI and agents servers with a package). Full comparison.

Run it through the gateway

Local package. It runs on your machine, not through the gateway.

Rating: —
Safety grade: A · 85/100
Stars: 1.1k
Downloads/wk: 101k
Price: Free
Licence: Apache-2.0
Transport: Local · mixed
Version: 3.2.1
Category: AI and agents
Last release: 2026-09-23

Credentials it needs

MDB_MCP_AGGREGATION_COUNT_MAX_TIME_MS_CAPDeprecated. Use `aggregationCountTimeoutMs` instead.
MDB_MCP_AGGREGATION_COUNT_TIMEOUT_MSThe maximum time in milliseconds for the count phase of aggregation operations. This is used to limit the time spent counting documents when determining if results were capped.
MDB_MCP_ALLOW_REQUEST_OVERRIDESWhen set to true, allows configuration values to be overridden via request headers and query parameters.
MDB_MCP_API_CLIENT_IDsecretAtlas API client ID for authentication. Required for running Atlas tools.
MDB_MCP_API_CLIENT_SECRETsecretAtlas API client secret for authentication. Required for running Atlas tools.
MDB_MCP_ASSISTANT_BASE_URLBase URL for the MongoDB Assistant API.
MDB_MCP_ATLAS_TEMPORARY_DATABASE_USER_LIFETIME_MSTime in milliseconds that temporary database users created when connecting to MongoDB Atlas clusters will remain active before being automatically deleted.
MDB_MCP_CONFIRMATION_REQUIRED_TOOLSComma separated values of tool names that require user confirmation before execution. Requires the client to support elicitation.
MDB_MCP_CONNECTION_IDLE_TIMEOUT_MSMilliseconds a MongoDB connection may stay unused (no tool call touching it) before it is closed to release the underlying connection pool and its server-side state. Applied per connection regardless of its connection scope; the preconfigured connection is excluded, and the reaper runs on this cadence. Set to 0 to disable reaping; must not be negative.
MDB_MCP_CONNECTION_SCOPEVisibility scope for MongoDB connections created at runtime. With 'session' (the default), each MCP session only sees the connections it created (plus the shared 'preconfigured' one) and they are closed when the session ends. With 'global', connections are shared across all sessions and survive session rotation. Deprecated: the MCP protocol is moving to sessionless, so this option will soon be removed and the connection scope will default to 'global'. For shared-server use cases, use the Atlas-Managed MCP server or build an authenticated library using the @mongodb-js/mcp-cli package. Note: on the sessionless (2026-07-28) HTTP path, a request without an mcp-session-id falls back to the shared ('global') scope so it can still persist connections across requests; the legacy sessionful path always carries a server-issued session.
MDB_MCP_CONNECTION_STRINGsecretMongoDB connection string for direct database connections. Optional, if not set, you'll need to call the connect tool before interacting with MongoDB data.
MDB_MCP_DANGEROUS_HOST_BINDINGWhen set to true, allows binding the HTTP server (and monitoring server) to a non-loopback host such as 0.0.0.0, a LAN IP, or an empty host (all interfaces). Binding to a non-loopback host exposes the server to the entire network and can allow unauthorized access. Off by default: the server refuses to start on a non-loopback host unless this is true.
MDB_MCP_DISABLE_SERVER_SIDE_JSWhen set to true, disallows the use of server-side JavaScript operators (such as $where, $function, and $accumulator) in query filters and aggregation pipelines.
MDB_MCP_DISABLE_UNTRUSTED_DATA_WARNINGWhen set to true, tool responses include potentially untrusted data (such as documents or query results) as-is, without wrapping it in delimiters and a prompt-injection warning.
MDB_MCP_DISABLED_TOOLSComma separated values of tool names, operation types, and/or categories of tools that will be disabled.
MDB_MCP_DRY_RUNWhen true, runs the server in dry mode: dumps configuration and enabled tools, then exits without starting the server.
MDB_MCP_ELICITATION_TIMEOUT_MSTime in milliseconds the user has to respond to an elicitation request (such as a tool confirmation prompt) before it fails.
MDB_MCP_EVICTION_IDLE_GRACE_M_SHow long a session must be idle before it becomes eligible for least-recently-used eviction when the HTTP transport is at its maxSessions cap (only used when transport is 'http'). Swept back to idleTimeoutMs when larger.
MDB_MCP_EXPORT_CLEANUP_INTERVAL_MSTime in milliseconds between export cleanup cycles that remove expired export files.
MDB_MCP_EXPORT_TIMEOUT_MSTime in milliseconds after which an export is considered expired and eligible for cleanup.
MDB_MCP_EXPORTS_PATHFolder to store exported data files.
MDB_MCP_EXTERNALLY_MANAGED_SESSIONSWhen true, the 2025-era HTTP transport accepts a session ID supplied externally through the 'mcp-session-id' header. When an external ID is supplied, the initialization request is optional, and an implicitly re-initialized session restores the client's previously negotiated capabilities from the session store.
MDB_MCP_HEALTH_CHECK_HOSTDeprecated. Use `monitoringServerHost` instead. Host address to bind the healthCheck HTTP server to (only used when transport is 'http'). If provided, `healthCheckPort` must also be set.
MDB_MCP_HEALTH_CHECK_PORTDeprecated. Use `monitoringServerPort` instead. Port number for the healthCheck HTTP server (only used when transport is 'http'). If provided, `healthCheckHost` must also be set.
MDB_MCP_HTTP_BODY_LIMITMaximum size of the HTTP request body in bytes (only used when transport is 'http'). This value is passed as the optional limit parameter to the Express.js json() middleware.
MDB_MCP_HTTP_HEADERSHeader that the HTTP server will validate when making requests (only used when transport is 'http').
MDB_MCP_HTTP_HOSTHost address to bind the HTTP server to (only used when transport is 'http').
MDB_MCP_HTTP_PORTPort number for the HTTP server (only used when transport is 'http'). Use 0 for a random port.
MDB_MCP_HTTP_RESPONSE_TYPEThe HTTP response type for tool responses: 'sse' for Server-Sent Events, 'json' for standard JSON responses.
MDB_MCP_IDLE_TIMEOUT_MSIdle timeout for a client to disconnect (only applies to http transport).
MDB_MCP_INDEX_CHECKWhen set to true, enforces that query operations must use an index, rejecting queries that perform a collection scan.
MDB_MCP_LOG_PATHFolder to store logs.
MDB_MCP_LOGGERSComma separated values of logger types.
MDB_MCP_MAX_ACTIVE_CONNECTIONSMaximum number of MongoDB connections a single scope (an MCP session by default, see connectionScope) can hold open. When exceeded, the scope's least-recently-used connection is closed and its connectionId revoked. The preconfigured connection does not count towards the limit.
MDB_MCP_MAX_BYTES_PER_QUERYThe maximum size in bytes for results from a find or aggregate tool call. This serves as an upper bound for the responseBytesLimit parameter in those tools.
MDB_MCP_MAX_DOCUMENTS_PER_QUERYThe maximum number of documents that can be returned by a find or aggregate tool call. For the find tool, the effective limit will be the smaller of this value and the tool's limit parameter.
MDB_MCP_MAX_SESSIONSMaximum number of concurrent sessions the HTTP transport will hold in memory (only used when transport is 'http'). Each session holds a full server instance, transport, and timers, so choose a value based on your deployment's available memory; the default is a conservative safety net rather than a recommended production value.
MDB_MCP_MAX_TIME_M_SDeprecated. Use `timeoutMs` instead. The maximum time in milliseconds that operations are allowed to run on the MongoDB server.
MDB_MCP_MCP_CLIENT_LOG_LEVELMinimum severity level for log messages forwarded to the MCP client.
MDB_MCP_MONITORING_SERVER_FEATURESFeatures to expose on the monitoring server (only used when transport is 'http' and monitoringServerHost/monitoringServerPort are set).
MDB_MCP_MONITORING_SERVER_HOSTHost address to bind the monitoring HTTP server to (only used when transport is 'http'). If provided, `monitoringServerPort` must also be set.
MDB_MCP_MONITORING_SERVER_PORTPort number for the monitoring HTTP server (only used when transport is 'http'). If provided, `monitoringServerHost` must also be set.
MDB_MCP_NOTIFICATION_TIMEOUT_MSNotification timeout for a client to be aware of disconnect (only applies to http transport).
MDB_MCP_PREVIEW_FEATURESComma separated values of preview features that are enabled.
MDB_MCP_QUERY_COUNT_MAX_TIME_MS_CAPDeprecated. Use `queryCountTimeoutMs` instead.
MDB_MCP_QUERY_COUNT_TIMEOUT_MSThe maximum time in milliseconds for the count phase of find operations. This is used to limit the time spent counting documents when determining if results were capped.
MDB_MCP_READ_ONLYWhen set to true, only allows read, connect, and metadata operation types, disabling create/update/delete operations.
MDB_MCP_TELEMETRYWhen set to disabled, disables telemetry collection.
MDB_MCP_TIMEOUT_MSThe maximum time in milliseconds that MongoDB operations are allowed to run, applied as the driver's timeoutMS (client-side operation timeout, CSOT) on each connection. It bounds the entire operation, including server selection and network round trips.
MDB_MCP_TRANSPORTEither 'stdio' or 'http'.
MDB_MCP_VOYAGE_API_KEYsecretAPI key for Voyage AI embeddings service (required for creating Atlas Local deployments with auto-embed vector search capabilities).
MDB_MCP_AGGREGATION_COUNT_MAX_TIME_MS_CAPDeprecated. Use `aggregationCountTimeoutMs` instead.
MDB_MCP_AGGREGATION_COUNT_TIMEOUT_MSThe maximum time in milliseconds for the count phase of aggregation operations. This is used to limit the time spent counting documents when determining if results were capped.
MDB_MCP_ALLOW_REQUEST_OVERRIDESWhen set to true, allows configuration values to be overridden via request headers and query parameters.
MDB_MCP_API_CLIENT_IDsecretAtlas API client ID for authentication. Required for running Atlas tools.
MDB_MCP_API_CLIENT_SECRETsecretAtlas API client secret for authentication. Required for running Atlas tools.
MDB_MCP_ASSISTANT_BASE_URLBase URL for the MongoDB Assistant API.
MDB_MCP_ATLAS_TEMPORARY_DATABASE_USER_LIFETIME_MSTime in milliseconds that temporary database users created when connecting to MongoDB Atlas clusters will remain active before being automatically deleted.
MDB_MCP_CONFIRMATION_REQUIRED_TOOLSComma separated values of tool names that require user confirmation before execution. Requires the client to support elicitation.
MDB_MCP_CONNECTION_IDLE_TIMEOUT_MSMilliseconds a MongoDB connection may stay unused (no tool call touching it) before it is closed to release the underlying connection pool and its server-side state. Applied per connection regardless of its connection scope; the preconfigured connection is excluded, and the reaper runs on this cadence. Set to 0 to disable reaping; must not be negative.
MDB_MCP_CONNECTION_SCOPEVisibility scope for MongoDB connections created at runtime. With 'session' (the default), each MCP session only sees the connections it created (plus the shared 'preconfigured' one) and they are closed when the session ends. With 'global', connections are shared across all sessions and survive session rotation. Deprecated: the MCP protocol is moving to sessionless, so this option will soon be removed and the connection scope will default to 'global'. For shared-server use cases, use the Atlas-Managed MCP server or build an authenticated library using the @mongodb-js/mcp-cli package. Note: on the sessionless (2026-07-28) HTTP path, a request without an mcp-session-id falls back to the shared ('global') scope so it can still persist connections across requests; the legacy sessionful path always carries a server-issued session.
MDB_MCP_CONNECTION_STRINGsecretMongoDB connection string for direct database connections. Optional, if not set, you'll need to call the connect tool before interacting with MongoDB data.
MDB_MCP_DANGEROUS_HOST_BINDINGWhen set to true, allows binding the HTTP server (and monitoring server) to a non-loopback host such as 0.0.0.0, a LAN IP, or an empty host (all interfaces). Binding to a non-loopback host exposes the server to the entire network and can allow unauthorized access. Off by default: the server refuses to start on a non-loopback host unless this is true.
MDB_MCP_DISABLE_SERVER_SIDE_JSWhen set to true, disallows the use of server-side JavaScript operators (such as $where, $function, and $accumulator) in query filters and aggregation pipelines.
MDB_MCP_DISABLE_UNTRUSTED_DATA_WARNINGWhen set to true, tool responses include potentially untrusted data (such as documents or query results) as-is, without wrapping it in delimiters and a prompt-injection warning.
MDB_MCP_DISABLED_TOOLSComma separated values of tool names, operation types, and/or categories of tools that will be disabled.
MDB_MCP_DRY_RUNWhen true, runs the server in dry mode: dumps configuration and enabled tools, then exits without starting the server.
MDB_MCP_ELICITATION_TIMEOUT_MSTime in milliseconds the user has to respond to an elicitation request (such as a tool confirmation prompt) before it fails.
MDB_MCP_EVICTION_IDLE_GRACE_M_SHow long a session must be idle before it becomes eligible for least-recently-used eviction when the HTTP transport is at its maxSessions cap (only used when transport is 'http'). Swept back to idleTimeoutMs when larger.
MDB_MCP_EXPORT_CLEANUP_INTERVAL_MSTime in milliseconds between export cleanup cycles that remove expired export files.
MDB_MCP_EXPORT_TIMEOUT_MSTime in milliseconds after which an export is considered expired and eligible for cleanup.
MDB_MCP_EXPORTS_PATHFolder to store exported data files.
MDB_MCP_EXTERNALLY_MANAGED_SESSIONSWhen true, the 2025-era HTTP transport accepts a session ID supplied externally through the 'mcp-session-id' header. When an external ID is supplied, the initialization request is optional, and an implicitly re-initialized session restores the client's previously negotiated capabilities from the session store.
MDB_MCP_HEALTH_CHECK_HOSTDeprecated. Use `monitoringServerHost` instead. Host address to bind the healthCheck HTTP server to (only used when transport is 'http'). If provided, `healthCheckPort` must also be set.
MDB_MCP_HEALTH_CHECK_PORTDeprecated. Use `monitoringServerPort` instead. Port number for the healthCheck HTTP server (only used when transport is 'http'). If provided, `healthCheckHost` must also be set.
MDB_MCP_HTTP_BODY_LIMITMaximum size of the HTTP request body in bytes (only used when transport is 'http'). This value is passed as the optional limit parameter to the Express.js json() middleware.
MDB_MCP_HTTP_HEADERSHeader that the HTTP server will validate when making requests (only used when transport is 'http').
MDB_MCP_HTTP_HOSTHost address to bind the HTTP server to (only used when transport is 'http').
MDB_MCP_HTTP_PORTPort number for the HTTP server (only used when transport is 'http'). Use 0 for a random port.
MDB_MCP_HTTP_RESPONSE_TYPEThe HTTP response type for tool responses: 'sse' for Server-Sent Events, 'json' for standard JSON responses.
MDB_MCP_IDLE_TIMEOUT_MSIdle timeout for a client to disconnect (only applies to http transport).
MDB_MCP_INDEX_CHECKWhen set to true, enforces that query operations must use an index, rejecting queries that perform a collection scan.
MDB_MCP_LOG_PATHFolder to store logs.
MDB_MCP_LOGGERSComma separated values of logger types.
MDB_MCP_MAX_ACTIVE_CONNECTIONSMaximum number of MongoDB connections a single scope (an MCP session by default, see connectionScope) can hold open. When exceeded, the scope's least-recently-used connection is closed and its connectionId revoked. The preconfigured connection does not count towards the limit.
MDB_MCP_MAX_BYTES_PER_QUERYThe maximum size in bytes for results from a find or aggregate tool call. This serves as an upper bound for the responseBytesLimit parameter in those tools.
MDB_MCP_MAX_DOCUMENTS_PER_QUERYThe maximum number of documents that can be returned by a find or aggregate tool call. For the find tool, the effective limit will be the smaller of this value and the tool's limit parameter.
MDB_MCP_MAX_SESSIONSMaximum number of concurrent sessions the HTTP transport will hold in memory (only used when transport is 'http'). Each session holds a full server instance, transport, and timers, so choose a value based on your deployment's available memory; the default is a conservative safety net rather than a recommended production value.
MDB_MCP_MAX_TIME_M_SDeprecated. Use `timeoutMs` instead. The maximum time in milliseconds that operations are allowed to run on the MongoDB server.
MDB_MCP_MCP_CLIENT_LOG_LEVELMinimum severity level for log messages forwarded to the MCP client.
MDB_MCP_MONITORING_SERVER_FEATURESFeatures to expose on the monitoring server (only used when transport is 'http' and monitoringServerHost/monitoringServerPort are set).
MDB_MCP_MONITORING_SERVER_HOSTHost address to bind the monitoring HTTP server to (only used when transport is 'http'). If provided, `monitoringServerPort` must also be set.
MDB_MCP_MONITORING_SERVER_PORTPort number for the monitoring HTTP server (only used when transport is 'http'). If provided, `monitoringServerHost` must also be set.
MDB_MCP_NOTIFICATION_TIMEOUT_MSNotification timeout for a client to be aware of disconnect (only applies to http transport).
MDB_MCP_PREVIEW_FEATURESComma separated values of preview features that are enabled.
MDB_MCP_QUERY_COUNT_MAX_TIME_MS_CAPDeprecated. Use `queryCountTimeoutMs` instead.
MDB_MCP_QUERY_COUNT_TIMEOUT_MSThe maximum time in milliseconds for the count phase of find operations. This is used to limit the time spent counting documents when determining if results were capped.
MDB_MCP_READ_ONLYWhen set to true, only allows read, connect, and metadata operation types, disabling create/update/delete operations.
MDB_MCP_TELEMETRYWhen set to disabled, disables telemetry collection.
MDB_MCP_TIMEOUT_MSThe maximum time in milliseconds that MongoDB operations are allowed to run, applied as the driver's timeoutMS (client-side operation timeout, CSOT) on each connection. It bounds the entire operation, including server selection and network round trips.
MDB_MCP_TRANSPORTEither 'stdio' or 'http'.
MDB_MCP_VOYAGE_API_KEYsecretAPI key for Voyage AI embeddings service (required for creating Atlas Local deployments with auto-embed vector search capabilities).

Own this server?

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Claim listing

Badge for your README

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/mongodb-js-mongodb-mcp-server.svg)](https://mcp.market/server/mongodb-js-mongodb-mcp-server)

How the badge works