A MongoDB read-only user for an AI agent, and the MCP server's read-only mode

The short answer

Create a dedicated user with the built-in read role on the one database the agent needs, and give the agent that user’s connection string, nowhere else to connect. If you run the MongoDB MCP server, add --readOnly too, which removes its create, update and delete tools. If the agent must write, use a custom role with insert and update but without remove, dropCollection or dropIndex, because the built-in readWrite role includes all three.

What the built-in roles allow

MongoDB’s role descriptions, with the actions that matter for an agent:¹

The trap is readWrite. It sounds like “can change documents”, but its actions include dropCollection and dropIndex.¹ An agent told to “clean up the test data” with a readWrite user can drop a whole collection.

A read-only user

Run this in mongosh as an administrator. passwordPrompt() asks for the password instead of putting it in your shell history.³

Code Program code, for developers. The text around it says what it does.

use admin
db.createUser({
  user: "agent_ro",
  pwd: passwordPrompt(),
  roles: [ { role: "read", db: "app" } ]
})

The role applies to the app database only. The agent can run find, list collections and indexes, and open change streams,¹ and nothing else.

Connection string for the agent:

Code What the screen or file shows, copied as is.

mongodb://agent_ro:<password>@db.internal:27017/app?authSource=admin

Put it in the environment the agent reads, not in a committed config file.

A role that writes but can’t drop

Sometimes an agent needs to insert or update documents: logging results, updating a status field. A custom role grants exactly the actions you list, on the resource you name.²

Code Program code, for developers. The text around it says what it does.

use admin
db.createRole({
  role: "agentWriteNoDelete",
  privileges: [
    {
      resource: { db: "app", collection: "tasks" },
      actions: [ "find", "insert", "update" ]
    },
    {
      resource: { db: "app", collection: "" },
      actions: [ "find", "listCollections", "listIndexes" ]
    }
  ],
  roles: []
})

db.createUser({
  user: "agent_rw",
  pwd: passwordPrompt(),
  roles: [ { role: "agentWriteNoDelete", db: "admin" } ]
})

The agent can read every collection in app, and insert and update only in tasks. No remove, no dropCollection, no dropIndex, no createIndex. If it tries db.tasks.deleteMany({}) or db.tasks.drop(), the server refuses.

An update can still overwrite fields with wrong values. For a field that matters, keep a history: write changes to a separate collection, or use change streams to record them, so you can see and undo what the agent did.

The MongoDB MCP server’s read-only mode

MongoDB’s own MCP server has three controls, all documented in its README:⁴

--readOnly defaults to false, but the README’s examples include it, with a note to remove it only if you need writes.⁴ A config that combines the flag with a read-only user:

Code Data in JSON, the format software uses to pass records and settings.

{
  "mcpServers": {
    "mongodb": {
      "command": "npx",
      "args": ["-y", "mongodb-mcp-server@latest", "--readOnly"],
      "env": { "MDB_MCP_CONNECTION_STRING": "${MONGODB_AGENT_URI}" }
    }
  }
}

Use both. The flag hides tools from the model; the database user decides what any connection can do. And note one requirement on confirmations: they need a client that supports elicitation.⁴ On a client that doesn’t, check what happens before you rely on the prompt.

The shell is a gap

Coding agents don’t only use MCP. They also run mongosh from the terminal. We ran Deedglass’s shell guard from 0.13.0 against mongosh --eval "db.dropDatabase()" and it had nothing to ask: its catalog covered SQL and ORM commands, not MongoDB.⁵ 0.14.1 added a row: mongosh or mongo with --eval code that calls dropDatabase() or a collection’s drop() now gets an ask, while reads such as db.stats() pass.⁵ The guard also reads text only, so a value known at run time passes untouched.⁵ For MongoDB, the user’s role is the control that holds. If the agent’s connection string belongs to agent_ro, dropDatabase fails at the server whatever tool sent it.

A checklist

• The agent has its own user, not the application’s or an admin’s.
• That user has read on one database, or a custom role naming its collections.
• No readWrite, dbAdmin or dbOwner for agents.
• The connection string lives in an environment variable.
• The MCP server runs with --readOnly unless writes are needed.
• Destructive tools are in confirmationRequiredTools, and your client supports the prompt.

Questions people ask

Can a MongoDB readWrite user drop a collection?

Yes. The readWrite role’s actions include dropCollection and dropIndex, as well as remove.¹

How do I make the MongoDB MCP server read-only?

Start it with --readOnly or set MDB_MCP_READ_ONLY=true. Create, update and delete tools are then not registered.⁴

Which MongoDB role can only read?

read, on the database you name. readAnyDatabase reads every database except local and config.¹

Can the MongoDB MCP server ask before dropping a collection?

Yes, by default: confirmationRequiredTools includes drop-database, drop-collection, delete-many and drop-index, but the prompt needs a client that supports elicitation.⁴

The same idea for other databases: a MySQL read-only user, safe Postgres access for agents, and the glossary entry on read-only database access. For SQL and ORM commands an agent might run, see migration commands that delete data, and for the config file itself, the ten-minute MCP config audit.

To see what your agent setup can change, run npx deedglass scan in the repository (what the grade means), or watch the checks in the playground.

Written with AI assistance and checked against our claims register.