mcp_replace_document

What mcp_replace_document does on Mongo-MCP

AI agents use mcp_replace_document to create or update resources in Mongo-MCP, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Mongo-MCP environment.

Why mcp_replace_document is rated Medium

Document replacement is a write operation that modifies data but remains reversible—the old document can be recovered from backups or application logs, and the action itself is not permanent deletion. However, severity is high due to the potential for significant data modification and the risk of an AI agent replacing critical documents with incorrect values.

From the tool's definition Tool name 'mcp_replace_document' indicates it modifies/overwrites existing documents. Description is empty, but sibling tools include destructive operations (mcp_delete_document, mcp_drop_collection) and the server provides 'complete suite of CRUD operations'…

The rule that runs mcp_replace_document safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Mongo-MCP, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For mcp_replace_document, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "mcp_replace_document": {
      "limits": [
        {
          "counter": "mcp_replace_document_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

Questions about mcp_replace_document