mongodb-mcp

Item: mongodb-mcp
Rating: 64
Author: M8ven

MCP server for comprehensive MongoDB integration, enabling database operations, document management, schema analysis, and query tools.

→ VitalyOstanin/mongodb-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

⚠️

Tool annotations don’t match behaviour

3 read-only tools perform write/delete/exec — collection-schema (line 211: writeFile(filePath, JSON.stringify(response, null, 2), { encoding: 'utf8', flag: 'wx' })); explain (line 113: writeFile(filePath, JSON.stringify(explainResult, null, 2), { encoding: 'utf8', flag: 'wx' })); mongodb-logs (line 59: writeFile(filePath, JSON.stringify(resultData, null, 2), { encoding: 'utf8', flag: 'wx' }))

⚠️

Tool descriptions don’t match what handlers do

2 tools describe read intent but their handlers mutate — collection-schema (line 211: writeFile(filePath, JSON.stringify(response, null, 2), { encoding: 'utf8', flag: 'wx' })); explain (line 113: writeFile(filePath, JSON.stringify(explainResult, null, 2), { encoding: 'utf8', flag: 'wx' }))

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configMONGODB_MCP_CONNECTION_STRING— MongoDB connection string (mongodb:// or mongodb+srv:// format)

configMONGODB_MCP_EXPORT_DIR

configMONGODB_MCP_TIMEZONE— optional timezone for date operations (default: Europe/Moscow), must be a valid IANA timezone identifier (e.g., Europe/London, America/New_York, Asia/Tokyo)

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/vitalyostanin-mongodb-mcp-1fas6d)](https://m8ven.ai/mcp/vitalyostanin-mongodb-mcp-1fas6d)

commit: f335842dad1873ad49e65a26ad0fda9a5afed8f9

code hash: ea29e1025314dd3d4984d1a5bf8a1286d9342411d3bab9aa4092c02019924e33

verified: 6/22/2026, 12:46:01 PM

view raw JSON →