TL;DR: If reads work but every write fails, check your client config for the `--readOnly` flag. It ships in all the README examples and disables every write tool. Remove it from `args` when you actually want to write, then restart the client.

```text
Error: not authorized on mydb to execute command { insert: ... }
```

(Variant: write tools missing from the tool list entirely.)

## Fix it

1. Open the server entry in your client config and look at `args`:

```json
{
  "args": ["-y", "mongodb-mcp-server@latest", "--readOnly"]
}
```

2. If you need writes, delete the `"--readOnly"` entry. If you want to stay read-only (safer for agents), leave it and stop trying to write.

3. Restart the client.

   Expected: write tools (`insert`, `update`, `delete`) appear and succeed, assuming the database user has write privileges.

## When to use this

- Reads succeed, writes fail with authorization or read-only errors.
- Write tools are absent from the tool list.
- You copied the README example config verbatim.

## When NOT to use this

- Reads also fail. That is connection or auth, not the read-only flag.
- Writes fail with `bad auth`. The database user itself may lack write privileges. Grant them in Atlas or mongosh.

## Compatibility

- mongodb-mcp-server (all versions with the `--readOnly` flag).

## Why it happens

The README examples default to `--readOnly` as a safety posture: agents querying production data should not be able to mutate it by default. It is a deliberate guardrail, not a bug. But because it is baked into the copy-paste examples, people who do want writes inherit the restriction without realizing it.

## Edge cases

- Even with `--readOnly` removed, the database user needs write roles (`readWrite` on the database). Check Atlas Database Access if writes still fail.
- For shared or production databases, prefer keeping `--readOnly` and doing writes through a separate, deliberate channel.
- The flag is read once at server startup. A client restart is required after changing it.