DBHub vs MongoDB MCP Server

DBHub 43

The server holds database credentials, and the MCP side has no credential over stdio. Over HTTP a bearer token is optional and off by default while the default bind is 0.0.0.0, so an exposed port answers anyone the host allow-list admits (12). Read-only mode classifies statements and adds engine-level read-only transactions on PostgreSQL, with row limits and timeouts; there is no confirmation step for writes when read-only is off (16). Rows reach the model unmarked, and no guidance on treating results as untrusted was found beyond a blog post on the lethal trifecta (4). The workbench shows request traces (8). No SECURITY.md, disclosure policy or security.txt found (3). 12 + 16 + 4 + 8 + 3 = 43.

MongoDB MCP Server 81

Database tools use a MongoDB user's own roles. Atlas tools use Atlas service accounts (client ID and secret) with per-operation roles listed in the README, connecting to an Atlas cluster creates a temporary database user that expires after 4 hours, and the managed server uses OAuth. Secrets can go on the command line, which the README warns against (25). --readOnly removes create, update and delete tools, --indexCheck rejects collection scans and server-side JavaScript is off by default. Confirmation is on by default for eight risky tools, but a client without elicitation runs them unconfirmed, and read-only isn't the default (18). Documents and query results come back wrapped in per-call UUID tags with a warning not to follow instructions inside them, on by default. Version 3.1.0 (15 October) adds --disableUntrustedDataWarning, default false, which returns results without the tags (13). Logs go to disk and to the MCP client by default, and Atlas keeps its own activity feed (10). MongoDB publishes a vulnerability disclosure policy, and its trust page lists ISO/IEC 27001:2022 and SOC reports for Atlas, per the 4 October check. The repository still has no SECURITY.md on 1 November ("This project has not set up a SECURITY.md file yet") and publishes no advisories, OSV listed none on 17 October, and mongodb.com/.well-known/security.txt answered with the site's HTML page, not a security.txt, per the 17 October check, not re-read on 1 November (15).

DBHub 61

MIT (30). A local server that sends data only to the configured database; no privacy statement, but nothing to state for hosted processing (15). Removed flags fail loudly with a message pointing at the TOML replacement (--readonly, READONLY, MAX_ROWS), but there is no written deprecation policy (10). No telemetry found in the source, though the README doesn't say so (12). 30 + 15 + 10 + 12 = 67.

MongoDB MCP Server 84

Apache-2.0 (30). The README says where logs and exports live, that exports expire after 5 minutes and that both may hold sensitive data, and MongoDB's privacy policy (last updated 4 November 2025) covers usage data from its products (22). Deprecated options are marked in the configuration table (connectionScope, healthCheckHost, and since 3.2.1 maxTimeMS and the two count caps in favour of timeoutMs) and Node 20 support is flagged for removal, but without dates (12). Telemetry is on by default and the README documents three opt-outs (MDB_MCP_TELEMETRY=disabled, --telemetry disabled, DO_NOT_TRACK=1). It says only "usage data". The source shows tool name, duration, result and a device id, and 3.1.0 fixes events emitted after close being dropped (15).

DBHub 85

Two tools by default, about 1.4k tokens by the README's count, with opt-in extras (25). max_rows caps results and flags truncation, search_objects has names, summary and full detail levels and a limit (18). Errors return as tool errors with the database's message (12). readOnlyHint and destructiveHint follow the access policy, though idempotentHint is always false (18). Few required settings, one DSN, and no SDK is needed for a local server (12). 25 + 18 + 12 + 18 + 12 = 85.

MongoDB MCP Server 75

53 tools in all, 25 database, 22 Atlas, 4 Atlas Local and 2 knowledge-base tools. A connection string alone loads about 27, Docker adds Atlas Local and Atlas credentials add 22 more. We scored the middle case over 30 (5) plus 10 for --disabledTools by name, category (atlas, mongodb) or operation type and for --readOnly (15). find defaults to 10 documents and a 1 MB response, the server caps find and aggregate at 100 documents and 16 MB by default, results report which limits applied, and export moves large results to a file resource (18). Errors set isError, name the tool and redact secrets, and argument errors are their own class the agent can fix (16). Every tool's readOnlyHint and destructiveHint follow its operation type, and eight risky tools (drops, delete-many, user and access-list creation, stream changes) plus $out and $merge pipelines ask for confirmation through elicitation. Create tools aren't marked idempotent (18). Defaults are sensible, but every database tool requires connectionId, even with a configured connection string. Node only, plus Docker (8).

DBHub 80

Scored as a local stdio and HTTP package. Official npm package @bytebase/dbhub with Node.js 22.5 or later stated (20). A run-tests workflow runs unit and container-based integration suites on push and pull request; the pass state wasn't read (15). Of the latest 25 issues, 22 are closed, most crash and regression reports fixed within days, such as the dropped-connection crash closed 21 October and duplicate column names closed 3 November (22). Semver tags for every release but no changelog file, and release notes weren't read (8). 1.0.0 since 28 July 2026 (15). 20 + 15 + 22 + 8 + 15 = 80.

MongoDB MCP Server 88

Scored as a local stdio package (it also runs over HTTP). Official npm package mongodb-mcp-server, 3.2.2 as the npm latest on 1 November, and a Docker image, with Node ^20.19.0 || ^22.13.0 || >= 24.0.0 stated in engines (20). CI runs unit and integration tests on Ubuntu, macOS and Windows with Node 22, plus Node 24 and 26 on Ubuntu, alongside accuracy and end-to-end suites. The latest Code Health runs on main concluded Success on 1 October per the 4 October check (run results weren't readable on 17 October or 1 November), and the test job is still marked continue-on-error in a clone on 1 November, so a failing test leg wouldn't fail the run. 20 of 25. Ten open issues on 1 November, five of them bug reports (#1269 OIDC connect, #1427 output schemas declared as draft-07, #1490 a false COLLSCAN on sharded clusters, #1540 space-separated --disabledTools values ignored, #1643 aggregations that keep running after a cancel), three of them labelled stale with no activity. Most issues opened since 20 October are newer requests (20). Semver with major versions for breaking changes. MongoDB's docs keep dated release notes, still ending at 3.0.5 of 1 October on 1 November and listing neither 3.1.0 nor 3.2.x. The GitHub v3.2.1 release (28 October) has full notes, including the maxTimeMS deprecation, but the v3.0.0 release body is still empty per the 4 October check, and 3.2.2 is on npm without a tag or release (13). Version 3.2.2 (15).

DBHub 73

Both default tools take zod schemas, so inputs are typed JSON Schema (25). dbhub.ai serves llms.txt (10). Descriptions are short and generated per source ("Execute SQL queries on the postgres database [READ-ONLY MODE]"), with the row cap stated, and say little about when not to use a tool (10). search_objects has enums for object type and detail level and a result limit; SQL is free text by nature (12). Docs pages per tool with examples; error formats aren't documented (9). Semver tags without a changelog (7). 25 + 10 + 10 + 12 + 9 + 7 = 73.

MongoDB MCP Server 81

Every tool takes a typed zod schema, and read tools such as find declare output schemas (25). MongoDB serves an llms.txt for the MCP server docs at mongodb.com/docs/mcp-server/llms.txt, live on 17 October and linked from the release notes page read on 1 November (10). Some descriptions say when to use them (list-connections says "Use this to find a connectionId established earlier", the streams tools list the requests they fit), but most database tools get one line ("Run a find query against a MongoDB collection"). Issues #1375 (66 parameters without descriptions) and #1402 (tools that confuse agents) are no longer in the open list on 1 November, and the README descriptions are unchanged since 17 October (12). Sort directions are enums and limit and responseBytesLimit have defaults. Filters and projections are free-form EJSON, which MQL needs (10). README and docs carry config examples. Errors come back as Error running <tool>: <message> with isError set (10). Semver, GitHub releases, dated release notes in the docs from 1.8.1 to 3.0.5 and a server.json for the registry (14, less 1 because the docs page still lists neither 3.1.0 nor 3.2.x on 1 November and 3.2.2 has no GitHub release).