MCP Toolbox for Databases vs MongoDB MCP Server

MCP Toolbox for Databases 64

Apache-2.0 (30). A self-hosted server; data goes only to the configured sources and to a telemetry exporter if one is set. There is no data-handling statement of its own (15). A versioning policy defining breaking changes, UPGRADING.md and a notice for the repository rename; prebuilt tool removals are listed in the changelog (16). Telemetry is off unless --telemetry-otlp or --telemetry-gcp is set, and the docs say so (16). 30 + 15 + 16 + 16 = 77.

MongoDB MCP Server 84

Apache-2.0 (30). The README says where logs and exports live, that exports expire after 5 minutes and that both may hold sensitive data, and MongoDB's privacy policy (last updated 4 November 2025) covers usage data from its products (22). Deprecated options are marked in the configuration table (connectionScope, healthCheckHost, and since 3.2.1 maxTimeMS and the two count caps in favour of timeoutMs) and Node 20 support is flagged for removal, but without dates (12). Telemetry is on by default and the README documents three opt-outs (MDB_MCP_TELEMETRY=disabled, --telemetry disabled, DO_NOT_TRACK=1). It says only "usage data". The source shows tool name, duration, result and a device id, and 3.1.0 fixes events emitted after close being dropped (15).

MCP Toolbox for Databases 80

Scored as local software the owner runs. A Go binary, a container in Artifact Registry and @toolbox-sdk/server on npm, with install paths per platform (20). Tests, lint, conformance and nightly tier-report workflows in the repository; the pass state wasn't read (15). 432 open issues and pull requests on a repository with 16,818 stars and releases every two weeks, triaged with labels, though the backlog is large (15). Semantic versioning with a published policy, release-please CHANGELOG and an UPGRADING.md (15). 1.x since well before this check, v1.16.0 now (15). 20 + 15 + 15 + 15 + 15 = 80.

MongoDB MCP Server 88

Scored as a local stdio package (it also runs over HTTP). Official npm package mongodb-mcp-server, 3.2.2 as the npm latest on 1 November, and a Docker image, with Node ^20.19.0 || ^22.13.0 || >= 24.0.0 stated in engines (20). CI runs unit and integration tests on Ubuntu, macOS and Windows with Node 22, plus Node 24 and 26 on Ubuntu, alongside accuracy and end-to-end suites. The latest Code Health runs on main concluded Success on 1 October per the 4 October check (run results weren't readable on 17 October or 1 November), and the test job is still marked continue-on-error in a clone on 1 November, so a failing test leg wouldn't fail the run. 20 of 25. Ten open issues on 1 November, five of them bug reports (#1269 OIDC connect, #1427 output schemas declared as draft-07, #1490 a false COLLSCAN on sharded clusters, #1540 space-separated --disabledTools values ignored, #1643 aggregations that keep running after a cancel), three of them labelled stale with no activity. Most issues opened since 20 October are newer requests (20). Semver with major versions for breaking changes. MongoDB's docs keep dated release notes, still ending at 3.0.5 of 1 October on 1 November and listing neither 3.1.0 nor 3.2.x. The GitHub v3.2.1 release (28 October) has full notes, including the maxTimeMS deprecation, but the v3.0.0 release body is still empty per the 4 October check, and 3.2.2 is on npm without a tag or release (13). Version 3.2.2 (15).

MCP Toolbox for Databases 82

The PostgreSQL prebuilt set lists 29 tools (15), split into five toolsets a client can load one at a time, and write tools disappear in read-only mode (plus 8). Results are bounded per tool, some prebuilt tools take limits, and BigQuery tools compact empty schema fields (14). Errors come back as tool errors; paths are sanitised from file errors since 1.15.0 (12). readOnlyHint and destructiveHint are set per tool and switch with the source's read-only state (18). Prebuilt sets need only environment variables, and SDKs exist in Python, JavaScript, Go and Java (15). 23 + 14 + 12 + 18 + 15 = 82.

MongoDB MCP Server 75

53 tools in all, 25 database, 22 Atlas, 4 Atlas Local and 2 knowledge-base tools. A connection string alone loads about 27, Docker adds Atlas Local and Atlas credentials add 22 more. We scored the middle case over 30 (5) plus 10 for --disabledTools by name, category (atlas, mongodb) or operation type and for --readOnly (15). find defaults to 10 documents and a 1 MB response, the server caps find and aggregate at 100 documents and 16 MB by default, results report which limits applied, and export moves large results to a file resource (18). Errors set isError, name the tool and redact secrets, and argument errors are their own class the agent can fix (16). Every tool's readOnlyHint and destructiveHint follow its operation type, and eight risky tools (drops, delete-many, user and access-list creation, stream changes) plus $out and $merge pipelines ask for confirmation through elicitation. Create tools aren't marked idempotent (18). Defaults are sensible, but every database tool requires connectionId, even with a configured connection string. Node only, plus Docker (8).

MCP Toolbox for Databases 75

Source credentials stay in Toolbox, Google sources use IAM, and optional MCP authorisation validates OAuth 2.1 JWTs with required scopes. --allowed-origins and --allowed-hosts default to *, which the CLI docs themselves call unsafe even on localhost, though the default bind is 127.0.0.1 (20). Read-only mode is enforced at the engine, write tools are suppressed, and custom tools can fix SQL and bind parameters to the signed-in user (18). The security docs cover prompt injection and screening through Model Armor (12). OpenTelemetry traces and metrics per call when exported (10). Google's vulnerability intake with a stated response time and GitHub advisories (15). 20 + 18 + 12 + 10 + 15 = 75.

MongoDB MCP Server 81

Database tools use a MongoDB user's own roles. Atlas tools use Atlas service accounts (client ID and secret) with per-operation roles listed in the README, connecting to an Atlas cluster creates a temporary database user that expires after 4 hours, and the managed server uses OAuth. Secrets can go on the command line, which the README warns against (25). --readOnly removes create, update and delete tools, --indexCheck rejects collection scans and server-side JavaScript is off by default. Confirmation is on by default for eight risky tools, but a client without elicitation runs them unconfirmed, and read-only isn't the default (18). Documents and query results come back wrapped in per-call UUID tags with a warning not to follow instructions inside them, on by default. Version 3.1.0 (15 October) adds --disableUntrustedDataWarning, default false, which returns results without the tags (13). Logs go to disk and to the MCP client by default, and Atlas keeps its own activity feed (10). MongoDB publishes a vulnerability disclosure policy, and its trust page lists ISO/IEC 27001:2022 and SOC reports for Atlas, per the 4 October check. The repository still has no SECURITY.md on 1 November ("This project has not set up a SECURITY.md file yet") and publishes no advisories, OSV listed none on 17 October, and mongodb.com/.well-known/security.txt answered with the site's HTML page, not a security.txt, per the 17 October check, not re-read on 1 November (15).