Medium Risk

mongodb_create_collection

Create a new collection in MongoDB

How to control mongodb_create_collection ↓

What mongodb_create_collection does on MCP-MongoDB-MySQL-Server

AI agents use mongodb_create_collection to create or update resources in MCP-MongoDB-MySQL-Server — usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your MCP-MongoDB-MySQL-Server environment.

Medium Risk

Why mongodb_create_collection needs a policy

Collection creation is a Write operation—it adds a new data container to MongoDB that can be modified or deleted later. While it changes database schema, the action is reversible (collections can be dropped), distinguishing it from Destructive operations. The blast radius is medium because erroneous collection creation could consume storage resources or interfere with application logic, but the impact is recoverable.

From the tool's definition Tool name 'mongodb_create_collection' and description 'Create a new collection in MongoDB' indicate data structure creation. MongoDB collections are schema containers that organize data; creating one modifies database structure reversibly.

Documented attack patterns abuse exactly the kind of access mongodb_create_collection gives an agent:

How to control mongodb_create_collection

PolicyLayer is an MCP gateway — it sits between your AI agents and MCP-MongoDB-MySQL-Server, and nothing reaches the server without passing your rules. This is the rule we recommend for mongodb_create_collection:

policy.json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "mongodb_create_collection": {
      "limits": [
        {
          "counter": "mongodb_create_collection_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}

mongodb_create_collection stays usable, but capped — an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.

  1. Create a free account and register MCP-MongoDB-MySQL-Server — nothing to install.
  2. Add this policy — paste it, or build it visually.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
LIMIT THIS TOOL →

Free to start. No card required.

Related tools and policies

Go deeper

Questions about mongodb_create_collection

What does the mongodb_create_collection tool do? +

Create a new collection in MongoDB. It is categorised as a Write tool in the MCP-MongoDB-MySQL-Server MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.

How do I enforce a policy on mongodb_create_collection? +

Register the MCP-MongoDB-MySQL-Server MCP server in PolicyLayer and add a rule for mongodb_create_collection: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches MCP-MongoDB-MySQL-Server. Nothing to install.

What risk level is mongodb_create_collection? +

mongodb_create_collection is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.

Can I rate-limit mongodb_create_collection? +

Yes. Add a rate_limit block to the mongodb_create_collection rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block mongodb_create_collection completely? +

Set action: deny in the PolicyLayer policy for mongodb_create_collection. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides mongodb_create_collection? +

mongodb_create_collection is provided by the MCP-MongoDB-MySQL-Server MCP server (yaoxiaolinglong/mcp-mongodb-mysql-server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.

Enforce policy on every MCP-MongoDB-MySQL-Server tool call.

Start from MCP-MongoDB-MySQL-Server, add the rest of your stack, and see everything your agents can call. Then put policy on all of it.

Free to start. No card required.

14 MCP-MongoDB-MySQL-Server tools catalogued and risk-classified — across an index of 43,000+ MCP servers.

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.