AI access

Setting it up

• 70+ Model Context Protocol tools. Works with Claude, Cursor, Windsurf, and any MCP-compatible client
• Setup is a three-step flow: pick the connections and tools an assistant may reach, copy its configuration, start access. A new setup starts with nothing selected
• Enable or disable the server, choose its port, and generate or replace its authentication token
• Ready-to-copy connection snippets for the common AI clients

What an assistant can reach

• Access can be unrestricted or limited to selected connections and databases. Inaccessible items are hidden from discovery and any action targeting one is refused
• Connection-wide access includes databases discovered later. Database-specific access does not
• AI access limits organize what the assistant reaches. They do not replace MongoDB permissions

Permissions and approvals

• Permissions are one row per kind of change: looking at things, changing the workspace, deleting things in Monghoul, and reaching your databases, each set to Ask first or Allow
• Reads always run. Workspace changes are allowed by default. Deletions inside Monghoul and anything touching a database ask first
• An approval names the operation, what it lands on, and any destructive methods found in submitted code, and declines itself after ten minutes if ignored
• A non-destructive tool can be approved for the rest of the session. The grant ends with the assistant and is never written to disk
• Any single tool can be set to always ask or never ask, whatever its permission row says
• A write-protected connection always asks, whatever the permissions say, and the confirming action stays unavailable until you tick the override beside it
• A query an assistant asks to run opens as a tab you can read and edit. Approving runs exactly what is on screen, and the banner marks the query as edited when you changed it
• Declining leaves the tab in place as an ordinary tab. Closing the tab declines the request

The tool catalog

• The AI panel docks beside the workspace with what is waiting, a live feed of recent activity, and how many assistants are connected
• Capability groups for connections, queries, schema, statistics, import/export/copy, indexes, tabs, panels, windows, sidebar organization, favorites, pins, themes, charts, notifications, logs, background tasks, and replica-set status
• A group, or a single tool inside one, can be switched off. It is then refused for an assistant that is already connected, not just a new one
• Ten essential tools always available: list_connections, sync_databases, sync_collections, execute_query, get_tab_result, create_query_tab, get_workspace, update_tab_code, activate_tab, show_toast
• The discover_tools, enable_tools, disable_tools, and check_approval meta-tools are always available too. The client discovers and toggles the optional groups itself

The activity trail

• The AI Activity window keeps the newest 1,000 calls across restarts, filtered by tool, outcome, risk, connection, time, and text
• Each entry records which assistant asked, the arguments, the outcome, your decision and how long it took, with links to the operation log and the tab it opened
• Argument recording has three levels. The default keeps targets and query text, a metadata-only level drops the query text, and full recording is an explicit choice with a warning. Credentials are redacted at every level
• Only you can clear the trail. No MCP tool can, and clearing the operation log leaves it untouched
• Work an assistant did is attributed to it in the operation log, and tabs it opened are marked in the tab strip

Boundaries

• An AI-initiated query has no network access. fetch is withdrawn for it, and a query you approve and run yourself is unaffected
• AI-initiated query and chart changes appear in the open app without a manual refresh
• Expired Pro access switches the server off and keeps the configuration, along with every activity entry already recorded