MongoDB MCP Server Prerequisites for Running Atlas Tools

For the complete MongoDB documentation index, see www.mongodb.com/docs/llms.txt

MongoDB MCP Server Prerequisites for Running Atlas Tools

The MCP Server can run Atlas tools that perform various Atlas operations. To run the Atlas tools, your Atlas cluster requires a service account with the appropriate permissions. For a list of the tools, see [MongoDB MCP Server Tools.](https://www.mongodb.com/docs/mcp-server/tools.md#std-label-mcp-server-tools

If you don't need to initially run the Atlas tools, you can omit this task and do it later.

To perform a simple MCP Server configuration, see [Get Started](https://www.mongodb.com/docs/mcp-server/get-started.md#std-label-mcp-get-started-configure. You can provide a connection string to your Atlas cluster.

About this Task

Select the permissions to run the MCP Server Atlas tools and create a service account with those permissions.

Before you Begin

Select the minimum permissions for the service account.

Note:

Granting the [Organization Owner](https://www.mongodb.com/docs/atlas/reference/user-roles/#mongodb-authrole-Organization-Owner role is rarely necessary and can be a security risk.

The following table shows a subset of the operations you can perform with the MCP Server and the required roles for those operations:

Operation Safest Role to Assign Level
List organizations and projects Organization Member or Organization Read Only Organization
Create new projects Organization Project Creator Organization
View clusters and databases in a project Project Read Only Project
Create and manage clusters in a project Project Cluster Manager Project
Manage project access lists Project Network Access Manager Project
Manage database users Project Database Access Admin Project

You should typically use Project level roles for most operations, and assign those roles to the specific projects you need to manage or view. Avoid Organization Owner unless you require full administrative control over all projects and settings in the organization. Write down the permissions you want to use. You'll use them in the next section.

For a full list of roles and privileges, see Atlas User Roles.

Note:

The MCP Server doesn't disable or hide tools based on the service account permissions. If the service account doesn't have the permission to access a tool, trying to run the tool may result in an error.

Enable AI Clients

AI clients connect to Atlas through the MongoDB MCP Server. An organization owner must enable the AI Clients setting before members can connect with a plugin.

Note:

The AI Clients setting only applies to user-delegated access through [Atlas App Connections](https://www.mongodb.com/docs/atlas/app-connections.md#std-label-atlas-app-connections. It does not apply to programmatic access through connections that use the Atlas CLI or Atlas Admin API. For those connections, permissions come from the roles assigned to the service account in the MCP Server configuration.

To enable AI client plugin connections for your organization:

  1. Log in to Atlas.

Log in to Atlas at cloud.mongodb.com.

  1. Go to your Organization Settings page.

If it's not already displayed, select your organization from the organization menu in the navigation bar.

In the sidebar, click Organization Settings.

  1. Click the App Connections tab.

This tab lists the AI clients that users in your organization can connect to Atlas.

  1. Toggle Allow users to connect AI clients to on.

In the dropdown menu, select the permission level you want to allow for AI client connections.

Steps

To limit access, use a service account with Project level roles. Assign those roles to the specific projects you need to manage or view.

You can also use a service account with Organization level roles. For example, if you need a service account with Organization roles to list all projects or manage multiple projects with one service account.

The following sections provide instructions for creating a service account with either Project or Organization roles.

Create an Atlas Service Account with Project Roles

To create an Atlas service account with Project roles, perform these steps:

  1. Create Atlas service account

Log in to Atlas at cloud.mongodb.com.

The instructions assume you have an organization and project already created. Click Project Identity & Access in the sidebar under the SECURITY section.

Click Create Application > Service Account.

Enter a Name.

Enter a Description.

Set a Client Secret Expiration period.

From the Project Permissions menu, select the appropriate roles.

Click Create.

Note:

The Atlas user interface is subject to change and the steps may vary. For details, see [Grant Programmatic Access to an Organization.](https://www.mongodb.com/docs/atlas/configure-api-access.md#std-label-grant-api-access-org

  1. Save client credentials

After you create your Atlas service account, you'll see a client ID and client secret. Copy and save the client secret. The UI won't display it again.

You'll use the client ID and client secret to set the apiClientId and apiClientSecret in the [Connecting with Atlas API Credentials](https://www.mongodb.com/docs/mcp-server/local-mcp/configuration/methods.md#std-label-mcp-server-configuration-atlas-api-credentials section later.

  1. Add access list entry

To allow the MCP Server to connect to your Atlas cluster, add an access list entry for the IP address of the computer on which the MCP Server runs. If you run the MCP Server on your local computer, add your local IP address.

Click Add Access List Entry.

Enter your IP address.

Click Save.

Create an Atlas Service Account with Organization Roles

If you need a service account with Organization roles, perform these steps:

  1. Create Atlas service account

Log in to Atlas at cloud.mongodb.com.

The instructions assume you have an organization already created. Select your organization from the ORGANIZATION section near the top of the page.

Click Applications in the sidebar under the IDENTITY & ACCESS section.

Click Add new > Service Account.

Enter a Name.

Enter a Description.

Set a Client Secret Expiration period.

From the Organization Permissions menu, select the appropriate roles.

Click Create.

Note:

The Atlas user interface is subject to change and the steps may vary. For details, see [Grant Programmatic Access to an Organization.](https://www.mongodb.com/docs/atlas/configure-api-access.md#std-label-grant-api-access-org

  1. Save client credentials

After you create your Atlas service account, you'll see a client ID and client secret. Copy and save the client secret. The UI won't display it again.

You'll use the client ID and client secret to set the apiClientId and apiClientSecret in the [Connecting with Atlas API Credentials](https://www.mongodb.com/docs/mcp-server/local-mcp/configuration/methods.md#std-label-mcp-server-configuration-atlas-api-credentials section later.

  1. Add access list entry

To allow the MCP Server to connect to your Atlas cluster, add an access list entry for the IP address of the computer on which the MCP Server runs. If you run the MCP Server on your local machine, add your local IP address.

Navigate to Network Access.

Click Add IP Address.

Enter your IP address.

Next Steps

After you create the service account, you can configure the MCP Server to use the Atlas API credentials. For details, see [Connecting with Atlas API Credentials.](https://www.mongodb.com/docs/mcp-server/local-mcp/configuration/methods.md#std-label-mcp-server-configuration-atlas-api-credentials

Learn More

  • [MongoDB MCP Server Usage Examples](https://www.mongodb.com/docs/mcp-server/examples.md#std-label-mcp-server-examples

  • [MongoDB MCP Server Tools](https://www.mongodb.com/docs/mcp-server/tools.md#std-label-mcp-server-tools