Skip to content

3.0.0

Choose a tag to compare

View all tags
@kiliczsh kiliczsh released this 29 Jul 11:31
· 2 commits to main since this release
3.0.0
9ea8487
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Major release: migrates to the MCP SDK v2 with dual-era protocol support, adds security hardening, and introduces new capabilities.

Highlights

Protocol / SDK

  • Migrated to MCP SDK v2 (@modelcontextprotocol/server, /node, /express).
  • Dual-era protocol support — negotiates 2026-07-28 while still serving legacy 2025-11-25 clients.
  • Error semantics aligned with the newer spec: validation/lookup misses return InvalidParams (-32602).

Security hardening (opt-in, safe by default)

  • Cross-database scoping — aggregations pinned to the connected database; cross-db $lookup/$out/$merge rejected unless --allow-cross-db.
  • Server-side JavaScript blocked by default ($where, $function, $accumulator, mapReduce) unless --allow-server-js.
  • Hardened system-collection guard (case-insensitive).
  • Configurable HTTP body limit (--json-limit); oversized/malformed bodies return proper JSON-RPC errors.
  • Nesting-depth guard on the aggregation operator scan.
  • Optional bearer-token auth for the HTTP transport (--auth-token), constant-time comparison.

Features & fixes

  • New convertTime tool (Unix/date → UTC ISO 8601 / GMT / Unix + server timezone); date filters honor timezone offsets.
  • Fixed sort on the query tool (was silently stripped from the input schema).
  • Fixed createIndex returning an empty {} — now returns { acknowledged, createdIndexes, indexCount }.

Breaking changes

  • Runs on the MCP SDK v2 line and negotiates the 2026-07-28 protocol (legacy 2025-11-25 still supported).
  • Stricter defaults: cross-database targets and server-side JavaScript are rejected unless explicitly enabled.
  • Minimum MongoDB server version is 4.2+ (modern driver requirement); older servers can no longer be connected.

Full changelog: #44

Assets 2
Loading