Investigate one document
Filter by an application identifier and return only the fields needed for the question. A projection reduces unrelated data in the response.
Databases · MCP integration
Explore MongoDB with AI and a clear collection boundary.
Use MCP to inspect MongoDB documents and read-only aggregation results from your AI app. GateRook keeps credentials separate from the connection URI, limits exposed collections and makes returned documents and query limits visible.
Connection in GateRook
stage-documents
MongoDB
stage / QA- Name / environment
- stage-documents / stage
- Connection string
- mongodb://mongo.stage.internal:27017/orders
- User / password
- gateway_reader / Enter in GateRook (write-only)
- Auth database / mechanism
- admin / auto
The route
Your AI requests a tool. GateRook checks the endpoint policy, resolves credentials locally, and calls the configured service.
Understand the request flowAsk your AI
Read the status and total for order 48213 from MongoDB; omit personal fields.
mongo_find · arguments
{
"connection": "stage-documents",
"database": "orders",
"collection": "orders",
"filter": {
"orderId": 48213
},
"projection": {
"_id": 0,
"orderId": 1,
"status": 1,
"total": 1
},
"limit": 10
}Example result
{
"database": "orders",
"collection": "orders",
"documents": [
{
"orderId": 48213,
"status": "pending",
"total": 149
}
],
"returned": 1,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Put context to work
What you can do with MongoDB and AI
Summarize a collection
Ask for a pipeline using stages such as $match and $group to count orders by status. GateRook rejects stages that would write the result into a collection.
Correlate records with logs
Put a limited MongoDB connection and a log connection on a diagnostic endpoint. The AI can compare document state with logged events using the same application identifier.
From service to MCP
How to connect MongoDB
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select MongoDB. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Prepare a read account and network route
Make the MongoDB deployment reachable from the GateRook computer. Use a database user with read privileges and check any deployment IP access rules.
Add MongoDB without credentials in the URI
Choose Connections, Add connection, then MongoDB. Enter the mongodb:// or mongodb+srv:// address separately from the user, password and auth database in Credentials.
Scope collections and query execution
Set the namespace allowlist, query time limit and read preference. On a replica set, secondaryPreferred can direct reads away from the primary when a secondary is available.
Test the settings and attach an endpoint
Run Test connection to check connectivity and the account. Complete Add to endpoint to save. The endpoint can publish mongo_find and mongo_aggregate in Read only mode.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure MongoDB in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Name / environment | stage-documents / stage | Choose MongoDB as the connector type. |
Connection string | mongodb://mongo.stage.internal:27017/orders | Do not embed a user name or password. A mongodb+srv:// URI enables TLS. |
User / password | gateway_reader / Enter in GateRook (write-only) | Use a MongoDB account with the read role for the intended databases. |
Auth database / mechanism | admin / auto | SCRAM-SHA-256 and SCRAM-SHA-1 can also be selected explicitly. |
Use TLS / read preference | On / secondaryPreferred | Use settings supported by the deployment. Production defaults to TLS and secondaryPreferred. |
Collections the agent may read | orders.orders | Namespace patterns use database.collection or database.*. |
Know what you expose
MongoDB tools and access boundaries
The connector determines what is possible. Endpoint modes and connection policies determine what a particular AI client may use.
| Tool | Purpose | Access behavior |
|---|---|---|
mongo_find | Find documents using a filter, projection, sort, limit and skip. | Read only |
mongo_aggregate | Run a bounded aggregation pipeline without write stages or server-side JavaScript. | Read only |
Before you enable access
- The built-in MongoDB connector is read-only. It exposes no insert, update or delete tool.
- Aggregation stages $out and $merge, and server-side JavaScript, are refused.
- With an empty namespace allowlist, the connector permits readable application databases but excludes admin, local, config and system collections.
- secondaryPreferred can fall back to the primary. Returned reads can be limited by document count, response size or query timeout.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
MongoDB connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Can I use a MongoDB Atlas connection string?
The connector accepts mongodb+srv:// as well as mongodb://. Supply credentials separately, allow the GateRook computer to reach the deployment, and run Test connection against your configuration.
Can the AI run a MongoDB aggregation?
Yes, through mongo_aggregate with a bounded pipeline. Write stages and server-side JavaScript are refused.
How do I expose only one collection?
Set Collections the agent may read to an exact namespace such as orders.orders, and keep the database account privileges scoped to that data.
Keep exploring
Connect the rest of your stack
PostgreSQL
Connect PostgreSQL to an MCP-compatible AI app with GateRook. Explore schemas, run read-only SQL, review changes and keep database credentials out of prompts.
Redis
Connect Redis to an AI app through MCP. Scan allowed keys, inspect values and TTLs, and troubleshoot cache data with the read-only GateRook connector.
Loki
Connect Loki to AI through MCP. Search and follow scoped logs with GateRook, using native queries, bounded time ranges and private credentials.
Your infrastructure, on your terms
Bring MongoDB into the conversation.
Start with one connection. Choose what your AI can do.