MongoDB

What it coversCopy Anchor Link

Use MongoDB only after other evidence points to a collection or query. mongosh can check liveness, show running operations, inspect replica set state and connection counters, and return a bounded collection sample.

ConnectCopy Anchor Link

reckon connect mongo-prod --org acme --provider mongodb --for-env prod

Fill in ~/.reckon/orgs/acme/secrets/mongo-prod.env:

MONGODB_URI=mongodb+srv://readonly:replace_me@cluster0.example.net/app?readPreference=secondary

The file is read literally, so the URI needs no shell quoting. Reckon passes it to mongosh as the connection string. There is no reckon login for databases.

reckon verify mongo-prod runs mongosh --quiet --eval 'db.runCommand({ping:1})'.

Read-only contractCopy Anchor Link

MongoDB is an approval connection: the agent must ask you before each run, and Claude Code's settings in the org folder mark every reckon run mongo-prod or reckon run mongodb as ask. Read each command before you allow it.

• The role is the real barrier. The user in MONGODB_URI must have a read-only role.
• readPreference=secondary routes reads away from the primary. It is routing, not authorization, and does not reject writes.
• Reckon refuses --host, --port, -u, --username, -p, --password, --authenticationDatabase, --apiKey and --nodb.
• Bound every sample with .limit(...).

Key commandsCopy Anchor Link

reckon run mongodb -- --quiet --eval 'db.currentOp({active:true, secs_running:{$gt:1}})'
reckon run mongodb -- --quiet --eval 'rs.status()'
reckon run mongodb -- --quiet --eval 'db.serverStatus().connections'
reckon run mongodb -- --quiet --eval 'db.<collection>.find({<filter>}).limit(10).toArray()'

LinksCopy Anchor Link

• MongoDB Shell documentation