ro-mongodb-mcp-rs

The server is explicitly designed for read-only operations, preventing accidental or malicious write/delete actions. Query injection risks are mitigated by JSON-escaping collection names and validating user-provided queries as JSON before execution. For Kubernetes connections, it uses `mongosh --eval` but with carefully constructed and escaped commands. Credentials for K8s are discovered securely from mounted files within the MongoDB pods (paths defined by environment variables). Direct connections use a native Rust MongoDB driver. A 30-second query timeout is in place to prevent resource exhaustion. Users are advised to secure the `config.yaml` file if it contains direct MongoDB connection strings with credentials.