MongoDB Atlas
Query your MongoDB collections and manage Atlas infrastructure from an AI assistant. 41 tools spanning full document CRUD and cluster, database-user and IP-access-list management. Read-only mode is a first-class, documented connect option — and it is the default for programmatic agents.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect MongoDB Atlas via MCP
https://mcp.mongodb.com/Works in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
MongoDB Atlas Tools & Capabilities (41)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- Full CRUD is on the surface.
delete-many,drop-collectionanddrop-databaseare among the directory's 41 tools. This connector can destroy data, not merely read it. - Annotations are not a boundary, and MongoDB says so. It documents
readOnlyHintanddestructiveHintas advisory metadata sent to the client, which the client can ignore, and which authorize, restrict and block nothing. createtools reportdestructiveHintfalse even when they change security posture.atlas-create-access-listandatlas-create-db-userare MongoDB's own examples.aggregatecan write. A pipeline stage can write results into any database or collection the identity can reach, and can overwrite an existing target collection entirely.- Confirmation prompts depend on the client. MongoDB states that where an AI client does not support elicitation, the server runs the tool without asking — and tells readers not to assume a prompt appears before a risky operation.
- Access modes are organization-wide only. MongoDB documents no per-user, per-cluster or per-client control, and lists the inability to restrict access to specific AI clients as a limitation.
- You cannot delegate a subset of your permissions. An authorized client acts with your full Atlas role, bounded only by the org access mode.
- An Organization Owner cannot revoke one user's connection. MongoDB lists this among the limitations; individuals revoke their own, or the owner disables access org-wide.
- Revocation is not instant. MongoDB documents that revoking invalidates the refresh token while the current access token stays valid for up to 10 minutes. Disabling access org-wide ends control-plane access immediately, but states that data-plane access through artifacts a client already created, such as database users, continues to work.
- New-user organizations start with AI client access enabled. Off by default for existing organizations; on by default for an organization created by a brand-new Atlas user.
- Read-only Administration API calls are not audit-logged. MongoDB notes this is pre-existing Atlas behaviour, not AI-specific.
atlas-create-clusterbills hourly with no documented cap. From $0.08/hr at M10, autoscaling on by default, and nothing in the MCP documentation bounding tier, regions or cluster count.- We could not verify tool behaviour ourselves. The endpoint returns 401 to an anonymous handshake, so no live schemas and no annotation values were readable to us. Every annotation claim here is MongoDB's own, from its security documentation.
- Prompts are unconfirmed. Anthropic's snapshot lists no prompt names, and the gated endpoint blocked our own check.
- The directory record carries no permissions label at all, over a surface including
drop-databaseandatlas-create-db-user.
Frequently asked questions
Can I connect the MongoDB Atlas MCP server in read-only mode?
Yes, and it is the strongest control on this connector. MongoDB documents three organization-level access modes — read, read and write, and disabled — set by an Organization Owner in Atlas. In read mode, MongoDB states that write tools are not registered with the session and do not appear in the client's tool list at all. For programmatic service accounts, a read-only flag is enabled by default.
Can the MongoDB Atlas MCP server delete my data?
Yes. The directory's 41 tools include `delete-many`, `drop-collection`, `drop-database` and `drop-index`, alongside `update-many` and `insert-many`. That is full document CRUD, not aggregation reads only. MongoDB annotates update and delete tools with `destructiveHint` set to true, but states plainly that annotations are advisory metadata a client can ignore and are not a security boundary.
What does atlas-create-access-list actually change?
It adds entries to an Atlas project's IP access list, the allowlist deciding which network addresses can reach the cluster. MongoDB names this risk itself, giving `0.0.0.0/0` as an entry that exposes the cluster to every IP address. The tool is annotated non-destructive because it adds rather than removes, and MongoDB explicitly warns against judging it on that annotation.
Does creating a cluster through the MongoDB MCP server cost money?
`atlas-create-free-cluster` does not; `atlas-create-cluster` does. MongoDB documents the latter as creating a dedicated M10 to M80 cluster, and its pricing page lists an M10 base price starting at $0.08 per hour. Compute autoscaling is on by default and disk autoscaling is always on, so the running cost is not fixed at creation. Free clusters are limited to one per project.
Does an AI client get more access than the person who authorized it?
No. MongoDB documents that an AI client acts under your Atlas identity with your existing role and cannot exceed your permissions. Access is the more restrictive of your role and the organization's access mode, which can only reduce it. The stated flip side is that you also cannot delegate a subset — the client gets everything your role allows.
Can the aggregate tool write to my database?
Yes, and MongoDB documents this trap directly. `aggregate`, `aggregate-db` and the export tool report `readOnlyHint` as true, but an aggregation pipeline can carry a stage that writes its results to a collection — potentially a different database than the one being read. MongoDB triggers a confirmation prompt for those pipelines, though only where the AI client supports elicitation.
How many tools does the MongoDB Atlas MCP server have?
Anthropic's directory snapshot lists 41 for the hosted server at mcp.mongodb.com. MongoDB's own tool reference documents a larger superset covering both its hosted server and the self-hosted one, including four local-deployment tools, two knowledge-base search tools and several connection-management tools that only apply when you run the server yourself. The 41 is the hosted subset.
How does the MongoDB Atlas MCP server handle audit logging?
Atlas attributes every tool call to the individual user who authorized the AI client. MongoDB documents that organization audit log events record both your user ID and the AI client's ID, so delegated actions are distinguishable from ordinary activity. One documented gap: read-only Atlas Administration API calls are not recorded, which MongoDB notes is existing Atlas behaviour rather than an AI-specific choice.
Sources
- MongoDB MCP Server documentation index — https://www.mongodb.com/docs/mcp-server (the URL Anthropic's directory publishes; fetched 2026-08-19) · retrieved 2026-08-19
- MongoDB MCP Server Tools — https://www.mongodb.com/docs/mcp-server/tools (fetched 2026-08-19 as Markdown via the
.mdsuffix; source of every tool description and the local-vs-hosted tool split) · retrieved 2026-08-19 - MongoDB MCP Server Overview — https://www.mongodb.com/docs/mcp-server/overview (fetched 2026-08-19; source of the two-deployment-type comparison and the per-configuration administrator controls) · retrieved 2026-08-19
- Security, Governance, and Auditability (Remote MCP) — https://www.mongodb.com/docs/mcp-server/remote-mcp/security (fetched 2026-08-19; source of the annotation table, the security-sensitive
createtools section, the aggregation-write warning and the elicitation caveats) · retrieved 2026-08-19 - Manage AI Client Access to Your Organization — https://www.mongodb.com/docs/mcp-server/remote-mcp/manage-ai-client-access (fetched 2026-08-19; source of the access modes, the default-off/default-on split, audit attribution and the limitations list) · retrieved 2026-08-19
- Enable or Disable MongoDB MCP Server Features — https://www.mongodb.com/docs/mcp-server/local-mcp/configuration/enable-or-disable-features (fetched 2026-08-19; the self-hosted read-only and tool-disabling options) · retrieved 2026-08-19
- Get Started with the MongoDB MCP Server — https://www.mongodb.com/docs/mcp-server/get-started (fetched 2026-08-19; the plugin and service-account setup paths) · retrieved 2026-08-19
- Atlas cluster configuration costs — https://www.mongodb.com/docs/atlas/billing/cluster-configuration-costs (fetched 2026-08-19) · retrieved 2026-08-19
- MongoDB pricing — https://www.mongodb.com/pricing (fetched 2026-08-19; M10 base price starting at $0.08/hr) · retrieved 2026-08-19
- Atlas Free Cluster Limits — https://www.mongodb.com/docs/atlas/reference/free-shared-limitations (fetched 2026-08-19; one Free cluster per project) and Atlas cluster comparison — https://www.mongodb.com/docs/atlas/manage-clusters (fetched 2026-08-19; 512 MB Free-cluster storage) · retrieved 2026-08-19
- MongoDB docs machine index — https://www.mongodb.com/docs/mcp-server/llms.txt (fetched 2026-08-19; note its listed paths are stale — several resolve to 404 and the live pages sit under
/local-mcp/and/remote-mcp/).https://www.mongodb.com/docs/mcp-server/robots.txtreturns 404; the site-rootrobots.txt(fetched 2026-08-19) restricts only forum paths and carries noContent-Signalaxes · retrieved 2026-08-19 - Live RFC 9728 protected-resource descriptor — https://mcp.mongodb.com/.well-known/oauth-protected-resource (fetched 2026-08-19; 200, two keys, no
scopes_supported) · retrieved 2026-08-19 - Live RFC 8414 authorization-server metadata — https://authorize.mongodb.com/.well-known/oauth-authorization-server (fetched 2026-08-19). The resource host's own
.well-known/oauth-authorization-serverreturns the 401 challenge instead, andhttps://authorize.mongodb.com/.well-known/openid-configurationreturns 404 · retrieved 2026-08-19 - Live anonymous probe — 2026-08-19: an unauthenticated
initializerequest tohttps://mcp.mongodb.com/returns HTTP 401 withwww-authenticate: Bearer realm="mcp", resource_metadata="https://mcp.mongodb.com/.well-known/oauth-protected-resource"· retrieved 2026-08-19 - Anthropic connector directory — https://claude.ai/directory/c700435a-e86b-41f6-a377-ee226164a909 (snapshot 2026-08-16; source of the 41 tool names, the empty prompt list and the absent permissions field) · retrieved 2026-08-16
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- MongoDB Atlas
- Tools
- 41
- Domain
- mcp.mongodb.com
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.