The MCP Server can run Atlas tools that perform various Atlas operations. To run the Atlas tools, your Atlas cluster requires a service account with the appropriate permissions. For a list of the tools, see MongoDB MCP Server Tools.
If you don't need to initially run the Atlas tools, you can omit this task and do it later.
To perform a simple MCP Server configuration, see Configure MCP Server File. You can provide a connection string to your Atlas cluster.
About this Task
Select the permissions to run the MCP Server Atlas tools and create a service account with those permissions.
Before you Begin
Select the minimum permissions for the service account.
Note
Granting the Organization Owner role is rarely necessary and can be a security risk.
The following table shows a subset of the operations you can perform with the MCP Server and the required roles for those operations:
Operation | Safest Role to Assign | Level |
|---|---|---|
List organizations and projects |
| Organization |
Create new projects |
| Organization |
View clusters and databases in a project |
| Project |
Create and manage clusters in a project |
| Project |
Manage project access lists |
| Project |
Manage database users |
| Project |
You should typically use Project level roles for most operations,
and assign those roles to the specific projects you need to manage or
view. Avoid Organization Owner unless you require full
administrative control over all projects and settings in the
organization. Write down the permissions you want to use. You'll use
them in the next section.
For a full list of roles and privileges, see Atlas User Roles.
Note
The MCP Server doesn't disable or hide tools based on the service account permissions. If the service account doesn't have the permission to access a tool, trying to run the tool may result in an error.
You can use the MCP Server with local Atlas deployments. To use the MCP Server tools with local Atlas deployments, you must install Docker. For an introduction to local Atlas deployments, see Create a Local Atlas Deployment.
Steps
To limit access, use a service account with Project level roles.
Assign those roles to the specific projects you need to manage or view.
You can also use a service account with Organization level roles.
For example, if you need a service account with Organization roles
to list all projects or manage multiple projects with one service
account.
The following sections provide instructions for creating a service
account with either Project or Organization roles.
Create an Atlas Service Account with Project Roles
To create an Atlas service account with Project roles, perform
these steps:
Create Atlas service account
Log in to Atlas at cloud.mongodb.com.
The instructions assume you have an organization and project already created. Click Project Identity & Access in the sidebar under the SECURITY section.
Click Create Application > Service Account.
Enter a Name.
Enter a Description.
Set a Client Secret Expiration period.
From the Project Permissions menu, select the appropriate roles.
Click Create.
Note
The Atlas user interface is subject to change and the steps may vary. For details, see Grant Programmatic Access to an Organization.
Save client credentials
After you create your Atlas service account, you'll see a client ID and client secret. Copy and save the client secret. The UI won't display it again.
You'll use the client ID and client secret to set the
apiClientId and apiClientSecret in the
Connecting with Atlas API Credentials section
later.
Add access list entry
To allow the MCP Server to connect to your Atlas cluster, add an access list entry for the IP address of the computer on which the MCP Server runs. If you run the MCP Server on your local computer, add your local IP address.
Click Add Access List Entry.
Enter your IP address.
Click Save.
Create an Atlas Service Account with Organization Roles
If you need a service account with Organization roles, perform these
steps:
Create Atlas service account
Log in to Atlas at cloud.mongodb.com.
The instructions assume you have an organization already created. Select your organization from the ORGANIZATION section near the top of the page.
Click Applications in the sidebar under the IDENTITY & ACCESS section.
Click Add new > Service Account.
Enter a Name.
Enter a Description.
Set a Client Secret Expiration period.
From the Organization Permissions menu, select the appropriate roles.
Click Create.
Note
The Atlas user interface is subject to change and the steps may vary. For details, see Grant Programmatic Access to an Organization.
Save client credentials
After you create your Atlas service account, you'll see a client ID and client secret. Copy and save the client secret. The UI won't display it again.
You'll use the client ID and client secret to set the
apiClientId and apiClientSecret in the
Connecting with Atlas API Credentials section
later.
Add access list entry
To allow the MCP Server to connect to your Atlas cluster, add an access list entry for the IP address of the computer on which the MCP Server runs. If you run the MCP Server on your local machine, add your local IP address.
Navigate to Network Access.
Click Add IP Address.
Enter your IP address.
Next Steps
After you create the service account, you can configure the MCP Server to use the Atlas API credentials. For details, see Connecting with Atlas API Credentials.