Can the MongoDB MCP server drop a database?

Yes, if writes are enabled. The server exposes drop-database, drop-collection, drop-index and delete-many (which removes all documents matching a filter) — catastrophic and irreversible at the MCP layer. MongoDB ships a read-only mode (--readOnly or MDB_MCP_READ_ONLY=true) that registers only read, connect and metadata tools, and recommends provisioning a dedicated read-only database user.

Does the MongoDB MCP server manage Atlas infrastructure too?

Yes. Beyond database operations it exposes Atlas control-plane tools — create projects, clusters, database users and IP access-list entries, upgrade and pause/resume clusters, and delete stream-processing or local deployments. So one server spans two blast radii: live application data and cloud infrastructure, each with real cost and destructive potential.

MCP field guide / MongoDB

// mcp field guide · database

MongoDB MCP server

One server, two blast radii: it writes to your live collections and provisions Atlas cloud infrastructure. It can drop-database, run a filter-wide delete-many, or spin up (and tear down) clusters. The good news: MongoDB ships a real --readOnly mode and recommends a read-only DB user. Here's the sourced split.

Maintainer: MongoDB (official) Package: mongodb-mcp-server · Atlas Managed MCP Category: database + cloud

GUARD FIT · READ-ONLY MODE

LOW

With --readOnly only read/connect/metadata tools register — the config flag is the guard. Plus a dedicated read-only DB user.

GUARD FIT · WRITE + PROVISION

STRONG

drop-database, drop-collection, unfiltered delete-many, plus Atlas cluster create/teardown — catastrophic, irreversible, billable.

Overall fit: STRONG for the default write-enabled config; low when read-only mode is on — classify by operation, like Postgres.

What it is

The MongoDB MCP server (mongodb-js/mongodb-mcp-server, npm mongodb-mcp-server) is MongoDB's official server. It runs local (npx/Docker, any deployment via connection string) or as the Atlas Managed MCP Server (hosted inside Atlas, announced Aug 2026). It exposes both database operations and Atlas control-plane operations — so it spans live application data and cloud infrastructure in one place.¹²

Tools by risk surface

Tier	Tools
read-only	`find`, `aggregate`, `count`, `explain`, `list-databases`, `list-collections`, `collection-schema`, `collection-indexes`, `db-stats`, `export`, `connect`; Atlas: `atlas-list-*`, `atlas-inspect-cluster`, `atlas-get-performance-advisor`
mutating	`insert-many`, `update-many`, `create-collection`, `create-index`, `rename-collection`; Atlas: `atlas-create-project`/`-cluster`/`-free-cluster`/`-db-user`/`-access-list`, `atlas-upgrade-cluster`, `atlas-pause-resume-cluster`
destructive	`delete-many`, `drop-collection`, `drop-database`, `drop-index`; Atlas: `atlas-streams-teardown`, `atlas-local-delete-deployment`

Two honest notes. (1) delete-many removes all documents matching a filter — a wrong predicate is a mass deletion, not a single-record one. (2) We did not find a dedicated Atlas cluster-deletion tool in the current tool set (Atlas cluster tools are create/upgrade/pause-resume/inspect); the catastrophic data-loss paths are drop-database/delete-many, and the destructive infra ones are atlas-streams-teardown/atlas-local-delete-deployment. A couple of names (update-one, switch-connection) appear on the docs page but not the raw README — treat as unverified.

Built-in controls (they genuinely help)

--readOnly / MDB_MCP_READ_ONLY=true — registers only read/connect/metadata tools; every create/update/delete tool is simply not registered.
--disabledTools / MDB_MCP_DISABLED_TOOLS — remove specific tools or whole categories.
MongoDB's security best practices recommend read-only mode and a dedicated read-only DB user: "never use database write credentials with the MCP Server."³

Real use cases

Data exploration. find/aggregate/explain against live collections to answer questions and tune queries.

Schema & index work. Create collections/indexes (incl. vector-search), rename, inspect stats — in the dev loop.

Atlas provisioning. Spin up clusters, projects, DB users and access-list entries from the coding tool — self-service infra with real cost.

Where a human-approval guard fits

Read-only mode → low. With --readOnly, there's no mutation to gate; the flag is the control. A guard adds value only where read-only can't be used, where disabledTools only partially trims, or where a shared connection carries write credentials.

Write + provision → strong. This combines committed database writes with Atlas mutations. drop-database, drop-collection, and unfiltered delete-many are catastrophic and irreversible at the MCP layer — no guard and no compensation step can un-drop a collection or restore a filter-wide delete. atlas-create-cluster/-upgrade-cluster carry real billing; atlas-streams-teardown/atlas-local-delete-deployment destroy infra.

Complementary, not redundant: MongoDB ships the coarse controls (--readOnly, disabledTools, least-privilege users). A guard is the finer, per-operation layer for teams that must keep writes enabled but want a diff-and-approve gate before each destructive/provisioning call — while being explicit that a committed drop-database/delete-many cannot be reversed after the fact. Compensation is not undo.

Approve the drop, pass the find

ChronoMCP classifies by operation — reads and metadata flow, and drop/delete-many/cluster-teardown wait for a human.

Read the quickstart → More MCP profiles

Sources

MongoDB — official repo (tool names, --readOnly, disabledTools): github.com/mongodb-js/mongodb-mcp-server
Docs — tools reference & overview (local vs Atlas Managed): mongodb.com/docs/mcp-server/tools
Security best practices (read-only mode + dedicated read-only DB user): mongodb.com/docs/mcp-server/security-best-practices

Profiles describe third-party software from its public sources; ChronoMCP is not affiliated with MongoDB. Tool inventories evolve release-to-release (a couple of names are docs-listed but unverified in source); risk groupings are our classification. Capabilities reflect sources current as of Aug 2026 — check the source links.