MongoDB MCP: writes fail with --readOnly (remove the flag to allow writes)

TL;DR: If reads work but every write fails, check your client config for the --readOnly flag. It ships in all the README examples and disables every write tool. Remove it from args when you actually want to write, then restart the client.

Error: not authorized on mydb to execute command { insert: ... }

(Variant: write tools missing from the tool list entirely.)

Fix it

1. Open the server entry in your client config and look at args:

{
  "args": ["-y", "mongodb-mcp-server@latest", "--readOnly"]
}

1. If you need writes, delete the "--readOnly" entry. If you want to stay read-only (safer for agents), leave it and stop trying to write.

1. Restart the client.

Expected: write tools (insert, update, delete) appear and succeed, assuming the database user has write privileges.

When to use this

• Reads succeed, writes fail with authorization or read-only errors.
• Write tools are absent from the tool list.
• You copied the README example config verbatim.

When NOT to use this

• Reads also fail. That is connection or auth, not the read-only flag.
• Writes fail with bad auth. The database user itself may lack write privileges. Grant them in Atlas or mongosh.

Compatibility

• mongodb-mcp-server (all versions with the --readOnly flag).

Why it happens

The README examples default to --readOnly as a safety posture: agents querying production data should not be able to mutate it by default. It is a deliberate guardrail, not a bug. But because it is baked into the copy-paste examples, people who do want writes inherit the restriction without realizing it.

Edge cases

• Even with --readOnly removed, the database user needs write roles (readWrite on the database). Check Atlas Database Access if writes still fail.
• For shared or production databases, prefer keeping --readOnly and doing writes through a separate, deliberate channel.
• The flag is read once at server startup. A client restart is required after changing it.