MongoDB MCP Server read-only and permission model
Parent: MongoDB Query Optimization Tooling: Compass Explain, Atlas Query Insights and Performance Advisor · Published reference · snapshot 2026-10-22 · skill ranked-c1db2bdc
↓ Facts as markdownall context files
Source-anchored research for MongoDB MCP Server read-only and permission model. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- When local MCP connects to Atlas through atlas-connect-cluster without a supplied connection string, it creates a random temporary database user that expires after four hours by default. The user receives readAnyDatabase when read-only mode is on or create, delete, and update tool categories are disabled; a fully permissive server receives readWriteAnyDatabase. (high confidence) (verified as of 2026-10-22) [source]
Problems, failure modes and limitations
- MCP tool annotations such as readOnlyHint and destructiveHint are advisory metadata, not authorization controls. In Atlas Managed access, aggregate, aggregate-db, and export remain read-labeled even though pipelines can contain $out or $merge; a read-only Atlas identity cannot complete those writes, and confirmation depends on the client supporting MCP elicitation. (high confidence) (verified as of 2026-10-22) [source]
- Atlas API roles authorize Atlas operations independently of whether a tool is visible: the MCP Server does not hide tools when a service account lacks a required role, and the call can fail. Prefer the narrowest needed project-level role, such as Project Read Only for viewing project clusters and databases. (high confidence) (verified as of 2026-10-22) [source]
- Atlas Managed user-delegated access uses the authorizing Atlas user's roles and cannot exceed that user's permissions; an organization can impose read-only access. Programmatic access instead uses roles assigned to its MCP configuration, which has a read-only setting selected by default and does not expose write tools in that mode. (high confidence) (verified as of 2026-10-14) [source]
- The Atlas atlas-get-performance-advisor tool returns index, slow-query, and schema recommendations and requires Project Read Only access or higher. (low confidence) (verified as of 2026-10-14) [source]
Comparisons and alternatives
- Atlas Managed user-delegated access uses OAuth and the authorizing Atlas user's existing roles. An organization owner can set a read-only or read-write access mode that further restricts that user; enablement is organization-wide for AI clients rather than a per-client or per-project grant. (high confidence) (verified as of 2026-10-22) [source]
Facts and statements
- For the self-hosted/local MCP Server, read-only is opt-in and defaults to false. Set --readOnly or MDB_MCP_READ_ONLY=true to prevent create, update, and delete operation tools from registering; disabledTools can further disable named tools or operation categories. (high confidence) (verified as of 2026-10-22) [source]
- For a local server using a supplied MongoDB connection string, --readOnly filters the server's tool surface but does not narrow the database user's own roles. Use a dedicated MongoDB user with the read role or a custom read-only role, scoped to the databases and collections the workflow needs. (high confidence) (verified as of 2026-10-22) [source]
- Atlas Managed programmatic access assigns roles to each administrator-provisioned MCP configuration through its service account, with an optional IP access list and a read-only setting that is preselected at creation. A read-only configuration does not expose write tools. (high confidence) (verified as of 2026-10-22) [source]
- For self-hosted MongoDB MCP deployments exposed over a network, inbound authentication and authorization are separate from MongoDB database authentication and authorization; MongoDB says the Local MCP Server does not provide inbound auth or authorization by itself. MCP authorization is optional at the protocol level and its specification covers HTTP transports, so protect the inbound server separately from the database connection. (high confidence) (verified as of 2026-10-14) [source]
- MongoDB recommends a dedicated read-only database user for Local MCP and says not to use database write credentials. MongoDB database RBAC can scope access to databases, collections, and operations, while OWASP recommends minimum permissions and scoped credentials for each MCP server. (medium confidence) [source]
Children
- No children recorded.