mongodb-js / mongodb-mcp-server

82%

main: 83%

LAST BUILD ON BRANCH ni/input-sanitization

branch: ni/input-sanitization

CHANGE BRANCH

x

Reset

• ni/input-sanitization
• CLA
• CLOUDP-349937
• CLOUDP-362350
• CLOUDP-373012
• CLOUDP-380317
• CLOUDP-397025-OSS-changes
• CLOUDP-397236
• CLOUDP-397237
• CLOUDP-397238
• CLOUDP-407393-create-cluster-cmk-support
• CLOUDP-407394-atlas-scale-cluster
• CLOUDP-407394-scale-in-upgrade-cluster
• CLOUDP-407395-create-cluster-multi-region
• CLOUDP-407921-atlas-pause-resume-cluster
• CLOUDP-407922-update-inspect-cluster-response
• CLOUDP-409257
• CLOUDP-424118-v2
• CLOUDP-424118-v3
• CLOUDP-424119
• CLOUDP-424119-v2
• CLOUDP-427202-active-session-metric
• CLOUDP-427202-eviction-before-rejection
• COMPASS-10911
• LG-5931/use-lg-exports
• MCP-10
• MCP-102
• MCP-124
• MCP-125
• MCP-140
• MCP-155
• MCP-156
• MCP-158
• MCP-159_atlas_local_connect
• MCP-160
• MCP-178
• MCP-184
• MCP-187
• MCP-188
• MCP-199
• MCP-2
• MCP-224
• MCP-257
• MCP-264
• MCP-276
• MCP-280
• MCP-284
• MCP-348
• MCP-374-structuredContent
• MCP-374-structuredContent-atlas-local
• MCP-374-structuredcontent-atlas
• MCP-384
• MCP-402
• MCP-407-index-create-telemetry
• MCP-42
• MCP-446
• MCP-459
• MCP-49
• MCP-5
• MCP-52
• MCP-520
• MCP-53
• MCP-536-core-logic
• MCP-536-core-logic-with-sdk
• MCP-537-wrapper-logging
• MCP-539-e2e-tests
• MCP-539-integ-tests
• MCP-539-unit-tests
• MCP-540-release-workflow
• MCP-541-atlas-mcp-remote-docs
• MCP-543-clarify-list-alerts-description
• MCP-55
• MCP-57
• MCP-571-remote-session-recovery
• MCP-577
• MCP-578
• MCP-580
• MCP-582
• MCP-583
• MCP-584
• MCP-587
• MCP-589
• MCP-60
• MCP-62
• MCP-67
• MCP-68
• MCP-98
• STREAMS-2485
• accuracy-tests-grove-support
• add-http-body-limit-config
• add-maxTimeMS
• add-run-playground-tool
• add-to-cursor
• add-tool-tests
• agent-fix
• api-error-check
• atlas-connect
• atlas-get-performance-advisor-tweaks
• atlas-list-performance-advisor-accuracy-tests
• atlas-list-performance-advisor-base-tool
• atlas-list-performance-advisor-tool
• atlas-mcp-remote-base-url
• atlas-streams-accuracy-tests
• atlas-streams-tools
• atlas-tests
• auto-close
• bianca.vianadeaguiar/CLOUDP-422517-paginate-list-orgs-projects
• bianca.vianadeaguiar/mcp-remote-staging-oauth-mapping
• bump-shell-properly
• chore-allow-test-coverage-on-failure
• chore-test-version-matrix
• chore-update-code-health-workflow
• chore/MCP-130-consistent-type-import-export
• chore/MCP-130-no-config-imports
• chore/MCP-132-injectable-connection-error-handler
• chore/MCP-198-update-readme
• chore/MCP-223-voyage-api-key
• chore/MCP-242-validate-pre-filter-fields
• chore/MCP-288-config-refactor
• chore/MCP-299-mcp-lib-code-examples
• chore/MCP-300-path-lock-down-guidelines
• chore/MCP-301-split-connect-and-switch-connection
• chore/MCP-388-pass-request-context-to-tools
• chore/MCP-6-cjs-bundle
• chore/accuracy-test-fixes
• chore/accuracy-test-workflow-update
• chore/adjust-tests-on-windows
• chore/allow-extending-mcp-http-server
• chore/alpha-9
• chore/atlas-cleanup
• chore/bump-ai-sdk
• chore/ci-workflow-permission-mods
• chore/concurrently-check
• chore/consistent-error-handling
• chore/copilot-instructions
• chore/correct-engine-requirements
• chore/dependabot-cooldown
• chore/disallow-overriding-of-internal-tools
• chore/downgrade-yargs-parser
• chore/env-var-fixups
• chore/fix-accuracy-tests
• chore/fix-config-verification
• chore/fix-publish-workflow
• chore/fix-randon-uuid-test
• chore/index-check-impr
• chore/issue-307
• chore/issue-307-proposal-2
• chore/lib-extension
• chore/load-config-from-file
• chore/mcp-107
• chore/mcp-235
• chore/mcp-240
• chore/mcp-245
• chore/mcp-246
• chore/mcp-80-followup
• chore/mcp-81
• chore/mcp-84
• chore/mcp-86
• chore/mcp-87
• chore/mcp-88
• chore/mcp-89
• chore/mcp-92
• chore/mcp-resource-refactor
• chore/minor-fixes
• chore/preview-feature-telemetry
• chore/readme-update
• chore/remove-preview-flag-setup
• chore/search-index-detection
• chore/static-tool-name
• chore/streamable-http-refactor
• chore/tool-description-changes
• chore/transport-runner-interface-refactor
• chore/update-engine
• chore/update-readme
• chore/use-sample-instead-of-find-for-schemas
• chore/vector-search-testing-feedback
• chore_add_atlas_tests
• chore_bump_auxiliary_packages
• chore_comments
• chore_docker_logs
• chore_more_comments
• chore_move_common
• chore_release_atlas-mcp-remote_v0.2.0
• chore_release_description
• chore_release_v0.0.6
• chore_release_v0.0.7
• chore_release_v0.0.8
• chore_release_v0.1.0
• chore_release_v0.1.1
• chore_release_v0.1.2
• chore_release_v0.1.3
• chore_release_v0.2.0
• chore_release_v0.3.1
• chore_release_v0.3.1-prerelease.1
• chore_release_v1.0.0
• chore_release_v1.0.0-prerelease.1
• chore_release_v1.0.0-prerelease.2
• chore_release_v1.0.1
• chore_release_v1.0.2
• chore_release_v1.0.2-prerelease.1
• chore_release_v1.0.3-prerelease.1
• chore_release_v1.1.0
• chore_release_v1.1.0-prerelease.1
• chore_release_v1.11.0-prerelease.1
• chore_release_v1.11.0-prerelease.2
• chore_release_v1.11.0-prerelease.3
• chore_release_v1.12.0
• chore_release_v1.14.0-prerelease.0
• chore_release_v1.14.0-prerelease.1
• chore_release_v1.14.0-prerelease.2
• chore_release_v1.15.0-alpha.7
• chore_release_v1.2.0
• chore_release_v1.3.0
• chore_release_v1.3.0-pre.1
• chore_release_v1.3.0-pre.2
• chore_release_v1.3.1
• chore_release_v1.4.0
• chore_release_v1.4.0-prerelease.1
• chore_release_v1.4.1
• chore_release_v1.4.1-prerelease.1
• chore_release_v1.4.1-prerelease.2
• chore_release_v1.4.1-prerelease.3
• chore_release_v1.4.1-prerelease.4
• chore_release_v1.4.1-prerelease.5
• chore_release_v1.4.1-prerelease.6
• chore_release_v1.5.0
• chore_release_v1.5.1-prerelease.1
• chore_release_v1.6.0
• chore_release_v1.6.1-prerelease.1
• chore_release_v1.6.1-prerelease.2
• chore_release_v1.6.1-prerelease.3
• chore_release_v1.6.1-prerelease.4
• chore_release_v1.7.0
• chore_release_v1.8.0
• chore_release_v1.8.0-prerelease.1
• chore_release_v1.8.1
• chore_release_v1.8.1-pre.1
• chore_release_v1.8.2-prerelease.1
• chore_release_v1.8.2-prerelease.2
• chore_release_v1.9.0-prererelease.2
• chore_release_v1.9.1-prerelease.1
• chore_release_v1.9.1-prerelease.2
• chore_release_v2.0.0
• claude/serene-satoshi-1ebed4
• cloudp-367319-integrate-to-ci
• cloudp-367319_braintrust_llm-as-judge_poc
• cloudp-367319_correct_nodejs_version
• cloudp-367319_guidance_for_search_fusion
• copilot/fix-vulnerability-scanner-failure
• count-issue
• create-project
• cursor/32b3b4e7
• default-read-only
• default-read-only-2
• default-telemetry
• dependabot/npm_and_yarn/modelcontextprotocol/inspector-0.10.2
• dependabot/npm_and_yarn/mongodb-runner-5.8.3
• dependabot/npm_and_yarn/types/node-22.15.2
• dependabot/npm_and_yarn/types/node-22.15.3
• dependabot/npm_and_yarn/typescript-eslint-8.31.1
• disable-t
• docs
• docs-2
• docs-4
• docs-alerts
• docs-creds
• docs-fix
• docs-keys
• docs-seo
• docs-update
• edgar/create-update-functionality
• extend-addSession
• extend-insert-accuracy-test
• feat-MCP-40
• feat/MCP-16-json-export-tool
• feat/MCP-239-delete-vector-search-indexes
• feat/MCP-292-config-file
• feat/MCP-297-dry-run-mode
• feat/agg-export
• feat/autoembed-index
• feat/drop-index-tool
• feat/export-list-db-ui
• feat/mcp-ui-data-hook
• feature/configurable-auth-client
• feature/mcp-agentcore-runtime
• feature/mcp-ui
• feature/setup-mcp-with-ai
• fix-cleanup-2
• fix-internal-urls
• fix-issue-jira
• fix-jira
• fix-local
• fix-package
• fix-perf-advisor-test
• fix-tool
• fix/MCP-189-export-tool-input-validation
• fix/MCP-21-avoid-memory-overflow
• fix/MCP-281-correct-schema
• fix/MCP-336-fixes-aggregate-vector-search-stage
• fix/MCP-357-update-embeddings-path-correctly
• fix/aggr-readonly-mode
• fix/allow-forks-atlas-tests
• fix/apiclient-shared-proxy-agent
• fix/changes-in-protocol
• fix/ejson-stdio-bug
• fix/export-test-flakiness
• fix/lint-issue
• fix/mcp-publish-workflow
• fix/mcp-ui-dist
• fix/oidc-curl-node-fetch
• fix/oidc-reliability
• fix/pre-release-workflow
• fix/streams-privatelink-description-updates
• fix/streams-privatelink-field-descriptions
• fix/structured-content-error-handling
• fix/tests
• fix/typings
• fix/update-driver
• fix/vscode-build-fixes
• fix_atlas_connection
• fix_dependabot_pr_ci
• fix_index_tests
• fix_operation_ids
• fmenezes/add_flex_clusters
• fmenezes/add_instance_size
• fmenezes/add_org_in_projects
• fmenezes/atlas_connect_tool
• fmenezes/check_dep
• fmenezes/ci_auto_merge
• fmenezes/docker
• fmenezes/docker-security
• fmenezes/error_messages
• fmenezes/feat_hide_atlas
• fmenezes/fix_bad_auth
• fmenezes/fix_ci_auto_merge
• fmenezes/fix_coverage_fork
• fmenezes/fix_fork_ci
• fmenezes/fix_tests
• fmenezes/fix_user_test_error
• fmenezes/fix_version_bump
• fmenezes/issue_templates
• fmenezes/refactor_config
• fmenezes/refactor_log
• fmenezes/refactor_test
• fmenezes/reorg_atlas_tools
• fmenezes/split_test_ci
• fmenezes/test_fork
• fmenezes/update_config_resource
• fmenezes/update_issue_template
• fmenezes/update_package_lock
• gagik/accuracy-embeddings
• gagik/add-depcheck
• gagik/add-more-metrics
• gagik/add-type-check
• gagik/add-types
• gagik/align-types
• gagik/api
• gagik/async-error-handler
• gagik/bool
• gagik/browser-test
• gagik/bump-machine-id
• gagik/bump-sdk
• gagik/bump-version
• gagik/check-dep
• gagik/check-title
• gagik/cjs-target
• gagik/cli
• gagik/conditional-api
• gagik/custom-defaults
• gagik/defer-ui-registry
• gagik/disable-husky
• gagik/doc-gen
• gagik/docs-gen
• gagik/elicitation
• gagik/eslint-type
• gagik/esm-jest
• gagik/extend-tool-context
• gagik/extendable-monitoring
• gagik/fix-build
• gagik/fix-ci
• gagik/fix-conn
• gagik/fix-contributions
• gagik/fix-eslint-warning
• gagik/fix-mcp-embedding
• gagik/fix-node
• gagik/knip
• gagik/konduko
• gagik/latest
• gagik/library-constructor-hook
• gagik/library-session-hook
• gagik/list-alerts
• gagik/log-level-setting
• gagik/logging
• gagik/logging-fixes
• gagik/logging-types
• gagik/make-public
• gagik/marketplace
• gagik/marketplace-server
• gagik/matrix
• gagik/mcp-release
• gagik/metrics
• gagik/minimize-node-specific
• gagik/mongosh-bump
• gagik/move-mongodb-mcp-server
• gagik/move-tests
• gagik/move-to-release
• gagik/node-20
• gagik/parse-mongosh
• gagik/pin-result-merge-version
• gagik/publish-marketplace
• gagik/query-header-override
• gagik/readme-generate
• gagik/redact
• gagik/reexport
• gagik/refactor-logging
• gagik/remove-insert-one
• gagik/rename-mongodb-mcp-server
• gagik/schema-default
• gagik/smithery-remove
• gagik/snyk
• gagik/split-mcp-tools-assistant
• gagik/split-mcp-tools-atlas-v2
• gagik/split-mcp-tools-mongodb-v2
• gagik/strict-validate
• gagik/tests
• gagik/tool-ctx
• gagik/use-device-id
• gagik/use-machine-id
• gagik/use-node-id
• gagik/use-unknown-record
• gagik/vitest
• geoff/atlas-connect-oidc
• gh-327
• ignore-CLAUDE.local.md
• issue216
• jira-fix
• jira-improvements
• jira-issue-remove-help-prefix
• long-running-tasks
• luke.sanderson/list-cluster-fix
• main
• mc/MCP-259_atlas_private_connStr_and_privateEndpoint
• mc/dbuser_shape_fix
• mcp-121
• mcp-29
• mcp-30-2
• mcp-30-3
• mcp-46
• mcp-602-strict-tool-args
• mcp-transports-package
• mcp-wrapper-rename
• mihirmpatil/del-search-index
• new-check
• ni/abort-signals
• ni/abort-signals-tests
• ni/access-lists
• ni/accuracy-models
• ni/accuracy-test-fixes
• ni/accuracy-tests
• ni/add-codeowners
• ni/aggregate-db-fixes
• ni/aggregate-fixes
• ni/aggregate-search
• ni/aggregate-validations
• ni/api-extractor-cleanup
• ni/assert-atlas-search
• ni/atlas-local-load-sample-data
• ni/atlas-local-timeouts
• ni/atlas-search
• ni/atlas-tests-guards
• ni/backwards-compatible-region
• ni/bedrock
• ni/bump-mcp-sdk
• ni/child-loggers
• ni/clean-up-publish
• ni/cluster-statistics
• ni/codeql
• ni/conditional-connect
• ni/connect-guidance
• ni/connect-tool
• ni/connect-tweaks
• ni/connection-string
• ni/count-fixes
• ni/coverage
• ni/create-user
• ni/create-vector-index
• ni/cursor
• ni/cursor-deeplink
• ni/deeplinks
• ni/dependabot
• ni/dependencies
• ni/deps
• ni/diagnose-mongot-healthcheck
• ni/disable-connect
• ni/dont-log-args
• ni/ejson-parsing
• ni/elicitation
• ni/eslint
• ni/extensions
• ni/external-sessions
• ni/feature-flags
• ni/ff-rename
• ni/fix-atlas-project-count
• ni/fix-tests-2
• ni/flaky-tests
• ni/flaky-tests-2
• ni/fs-storage-cleanup
• ni/gha-rework
• ni/healthcheck
• ni/http-pings
• ni/immutable-release-notes-input
• ni/insecure-localhost
• ni/integration-collection-schema
• ni/integration-count
• ni/integration-create-index
• ni/integration-dbstats
• ni/integration-delete
• ni/integration-insert-many
• ni/integration-read
• ni/integration-test-refactor
• ni/integration-update
• ni/jira-title-validation
• ni/list-indexes-unification
• ni/load-sample-data
• ni/load-sample-data-main
• ni/logger-changes
• ni/logs
• ni/mcp-remote-publish
• ni/mcpb
• ni/mcpb-build
• ni/metadata-tools
• ni/mongod-primary
• ni/more-eslint
• ni/more-untrusted-data
• ni/npm-publish
• ni/oidc-test
• ni/perf-advisor-telemetry
• ni/pnpm
• ni/poison-mitigation
• ni/preview-features
• ni/protobufjs
• ni/public-mcp-types
• ni/readme-clarifications
• ni/readonly
• ni/release-notes
• ni/release-workflow
• ni/remove-console
• ni/remove-custom-embeddings
• ni/rename-collection
• ni/report
• ni/runtime-readonly
• ni/search-indexes
• ni/search-tests
• ni/server-side-js
• ni/session-store
• ni/setup-telemetry
• ni/skip-failing-test
• ni/smithery
• ni/smithery-dockerfile
• ni/stateless-sessions
• ni/structured-content
• ni/structured-content-2
• ni/structured-content-create-tools
• ni/structured-content-delete-tools
• ni/structured-content-update-tools
• ni/sync-telemetry
• ni/telemetry
• ni/telemetry-alternative
• ni/telemetry-app-name
• ni/telemetry-hosting-mode
• ni/tests
• ni/untrusted-exports
• ni/untrusted-logs
• ni/upgrade-cluster
• ni/userconfig-schema
• ni/warn-on-insecure-base-url
• ni/windows-open-config
• ni/windsurf
• ni/zod-update
• ni/zod4
• ntaheri/upgrade-vitest
• organization-id-to-org-id
• pass-x-request-id
• poc/tool-consolidation
• read-only
• readonly-hint
• refactor_move_http_server
• release-fix
• release/v0.0.5
• release/vv0.0.5
• remove-get-logs-from-streams-discover
• remove-leftover-logs
• revert-1063-ni/skip-failing-test
• revert-1377-chore_release_v1.15.0-alpha.7
• revert-298-MCP-2
• revert-438-docs-gateway-update
• revert-507-dependabot/npm_and_yarn/mongosh/service-provider-node-driver-3.14.0
• rmcp-ga-release
• search-skunkworks-2025-search-index-status
• search-skunkworks-2025_listSearchIndexes
• skunkworks/create-add-vector-search
• skunkworks_may_25_local_atlas
• smithery/config-46f2
• split-up-mcp-server
• stale-issue
• stop-waiting-deletion
• streams-processing-accuracy-tests
• tel-fix
• telemetry
• telemetry-2
• telemetry-connect
• telemetry-data
• telemetry-data-2
• telemetry-improvements
• telemetry-normalize
• telemetry-update
• telemetry-updates
• test
• tests/mcp-ui
• tests/mcp-ui-rebased
• track-issues
• update-apix-action
• update-create-cluster-response
• update-issue
• update-readme-performance-advisor-tool
• update-user-description
• v2
• v2-rebuilt
• worktree-gagik+split-mcp-ui-package
• x-request-id-case-insensitive

Build # 24843979503

Build Type

Pull #1093

github

Committed by web-flow

Commit Message

Merge 09b3dc682 into 8d58a4d0c

Pull Request Pull Request #1093: fix: sanitize workflow inputs VULN-995 VULN-996

Coverage Stats

1655 of 2248 branches covered (73.62%)

Branch coverage included in aggregate %.

3125 of 3578 relevant lines covered (87.34%)

174.23 hits per line