kiliczsh/mcp-mongo-server

v2.1.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 5d MCP Data & Storage

✓ No known CVEs patched

This release patches 2 known CVEs

Topics

antrophic claude claude-desktop cline cursor mcp

+3 more

model-context-protocol mongodb windsurf

Affected surfaces

auth

Summary

AI summary

SEP-1303 adds tool execution error handling for validation failures.

Full changelog

SEP-1303: validation and MongoDB runtime errors are now tool execution errors (isError: true) so models can self-correct; unknown tools remain protocol errors, cancellation propagates as AbortError
Task-augmented execution only runs when explicitly requested by the client
Added title, description and websiteUrl to server implementation info
Tool schemas verified against JSON Schema 2020-12 (strict), tool names conform to SEP-986

Origin header validation on HTTP transport (DNS rebinding protection): invalid origins get 403 Forbidden; configurable via --allowed-origins / MCP_HTTP_ALLOWED_ORIGINS
Dependency overrides for 13 vulnerable transitive packages: audit findings reduced from 57 (1 critical, 16 high) to 3 moderate

@modelcontextprotocol/sdk 1.29 (protocol 2025-11-25), mongodb 7.5, zod 4, @biomejs/biome 2.5, @types/node 26, inspector 1.0

Tested end-to-end against MongoDB 4.4, 6.0, 7.0 and 8.2 (standalone, replica set, no-auth, auth+keyFile RS, TLS) — 7/7 passing.

Full Changelog: https://github.com/kiliczsh/mcp-mongo-server/compare/2.0.2...2.1.0

Origin header validation on HTTP transport blocks DNS rebinding with configurable --allowed-origins / MCP_HTTP_ALLOWED_ORIGINS; invalid origins receive 403 Forbidden
Dependency overrides for 13 vulnerable transitive packages reduce audit findings from 57 (1 critical, 16 high) to 3 moderate

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track kiliczsh/mcp-mongo-server

Get notified when new releases ship.

About kiliczsh/mcp-mongo-server

A Model Context Protocol Server for MongoDB