Free

Ask before any write to the data you protect

Turn on write protection for a connection, a database or a few collections. Monghoul asks before each write there, and the driver refuses one you did not approve, even if the query text hides it.

Download Monghoul

The delete collection confirmation on a write-protected target, naming the connection, the database and the collection the protection covers, above a red Confirm — Fig 01 Write protection · The confirmation names what is protected before it asks

Turn it on where it matters

Protect a whole connection, or name the databases and collections to protect. With both lists empty, everything on the connection is protected.

The Write Protection section of the Advanced tab on a connection: the confirmation checkbox ticked, the analytics database listed under Protected Databases, and shop.orders and shop.customers under Protected Collections — Fig 02 Write protection · Turned on per connection, and narrowed to a database and two collections

Paste a connection string

Paste a mongodb:// or mongodb+srv:// string and the rest is behind two tabs. Turn Save password off and the password is never written to disk.

The connection dialog on its General tab, with a pasted connection string and the Security and Advanced tabs beside it — Fig 03 Connections · Paste a connection string, and the rest is behind two tabs

Test before you save

Test Connection runs before the profile is saved, so a bad setting is caught on the form.

Fig 04 Connections · The test runs before the profile is saved, so a bad setting is caught here

SSH and TLS

Reach a database through an SSH server with a password or a private key, and use TLS with your own CA certificate.

The connection dialog on its Security tab, with the SSH tunnel enabled and its host, port, user and key file filled in — Fig 05 Connections · The tunnel form, on the Security tab

Passwords under your system’s key

Saved passwords are encrypted with a key the operating system keeps, such as the macOS Keychain, and Settings says which key protects them.

The Security line in Settings with a closed padlock, reading "Credentials are protected by your system keychain", and below it that the key is held by the operating system rather than in the app database — Fig 06 Settings · Monghoul says which key is protecting your saved passwords

Also in this part

What counts as a write: Inserts, updates, deletes, bulk writes, drops, renames, creations, index changes and aggregation output stages.
Enforced at the driver: The confirmation is raised by reading your query, and the block is enforced at the driver, so a destructive call the text cannot show is still refused.
Authentication: 8 authentication methods: no auth, username and password, SCRAM-SHA-1 and SCRAM-SHA-256 free, plus X.509, LDAP, Kerberos and AWS IAM on Pro.

Try it against your own data

38 MB installer. Free forever, and a 14-day Pro trial with no card.

Download Monghoul