Connect an AI agent with MCP

Every TeselaDB node has a Model Context Protocol server with the MongoDB MCP Server tools. This guide connects an MCP client (a desktop assistant, an IDE or your own agent) with read-only permissions.

1. A user just for the agent

db.getSiblingDB("admin").createUser({
  user: "agent",
  pwd: passwordPrompt(),
  roles: [{ role: "read", db: "shop" }],
});

2. An API key

teseladb admin apikey create --user agent

The key (tdb_…) is shown once and expires after 90 days by default. It carries at most the user's roles.

3. Configure the MCP client

Most clients read a configuration like this one. teseladb mcp speaks stdio and forwards to the node's HTTP port; the key goes in an environment variable, never in the arguments:

{
  "mcpServers": {
    "teseladb": {
      "command": "teseladb",
      "args": ["mcp", "--uri", "https://node-01:27080"],
      "env": { "TESELADB_API_KEY": "tdb_…" }
    }
  }
}

If your client supports MCP over HTTP, point it to https://node-01:27080/mcp with the Authorization: Bearer header.

4. Ask

The agent sees tools such as list-collections, collection-schema, find, aggregate and count. Try «How many paid orders were there yesterday?»: the agent looks at the schema of orders and runs a count or an aggregate.

What the agent cannot do

• The MCP server starts read-only. The tools that write only appear if you turn them on with the mcpOptions cluster parameter.
• aggregate rejects $out and $merge.
• Each tool checks privileges with the key's roles, and every call is recorded in the audit log with transport: "mcp".

To remove access, revoke the key: teseladb admin apikey revoke <id>. Every node rejects it in less than a second.