mongodb-mcp-setup

Mongodb-mcp-setup is an interactive, step-by-step guide for configuring the MongoDB MCP server so it can be used from an agentic client. It applies when the MCP server is installed but the required environment variables have not been set, or when a user asks about connecting to MongoDB or Atlas without credentials in place. A defining constraint is that the agent never asks for or handles credentials itself; instead it detects the environment, tailors instructions, and has the user add secrets directly to their shell profile or client configuration.

Authentication offers three paths. Option A, a connection string, is the quick route for a single cluster and uses the MDB_MCP_CONNECTION_STRING variable. Option B, service account credentials, is recommended for Atlas because it unlocks the Atlas Admin API and dynamic cluster connection via atlas-connect-cluster without manual DB user management, and it requires MDB_MCP_API_CLIENT_ID and MDB_MCP_API_CLIENT_SECRET. Option C, Atlas Local, runs Atlas locally in Docker for zero-configuration local testing with no credentials. Before anything else, Step 0 detects the client by checking for CODEX_ environment variables to distinguish Codex (which stores credentials in ~/.codex/config.toml) from shell-based clients like Claude, Cursor, Gemini CLI, and Copilot CLI, and this client type is carried through every later step.

The guide then checks existing configuration, interprets which auth is present or partial, and handles cases like adding read-only mode, switching auth methods, or updating credentials. Option B includes detailed Atlas steps for creating a service account, generating a Client ID and Secret that is shown only once, and adding an IP to the API Access List, with a strong warning that 0.0.0.0/0 is a significant security risk. Option C verifies Docker with docker info and then supports commands such as atlas-local-create-deployment and atlas-local-list-deployments. A dedicated step determines read-only versus read-write access for Options A and B, driven by the MDB_MCP_READ_ONLY flag.