mongo-scout

Inspiration

On-call engineers and analysts constantly need to know "what does the data say right now?" — counts, growth, stuck records, schema drift — without writing a one-off aggregation each time. We wanted to turn those into plain questions, while making it impossible for the assistant to damage production data.

What it does

mongo-scout is a read-only, natural-language triage agent for MongoDB. You ask a plain-English question about a live deployment; the agent plans and answers using only Model Context Protocol tool calls (list-collections, count, aggregate, collection-schema, find, …) against the official mongodb-mcp-server, launched --readOnly. Every number it reports is derived from live tool output — never guessed — and it cannot mutate: with --readOnly the server exposes no write/delete/drop tools, so even a prompt-injected "delete everything" has no tool to call.

How we built it

Agent: google.adk.agents.LlmAgent running gemini-2.0-flash.
Tools: ADK McpToolset launches the official mongodb-mcp-server over stdio with --readOnly; the connection string is passed via the server's environment, not argv, so credentials never appear in the process list.
No DB code: every read is a model-issued MCP tool call. The repo contains zero hand-written queries — the model's entire database surface is the MCP server.
Reproducibility: two key-free, account-free proofs under demo/ boot a real ephemeral MongoDB (mongodb-memory-server) and drive the real MCP server — npm run demo (database layer, 5/5 checks) and npm run loop (the full ADK reasoning loop, model→tool→model→answer, 3/3 checks).

Challenges we ran into

Untrusted-data handling. The MongoDB MCP server wraps every row of DB output in explicit prompt-injection guard fences (<untrusted-user-data-…>). Designing the agent to treat tool output as data, not instructions, is core to keeping a data-reading agent safe.
Provable safety. Rather than prompting the model to be read-only, we enforce it at the tool layer: --readOnly removes the write tools entirely, so safety doesn't depend on the model behaving.
Reviewer reproducibility without secrets. We made both proofs run with no Gemini key and no Atlas account by swapping in an ephemeral mongod and (for the loop) a scripted LLM with identical wiring.

Accomplishments that we're proud of

A genuinely safe-by-construction data agent — not "please don't delete", but "there is no delete tool".
An end-to-end proof anyone can run in ~30s with a single command and no credentials, including the full Gemini-shaped ADK loop.

What we learned

MCP turns "give the model database access" into a bounded, auditable capability: the exact tool surface is visible, launch flags constrain it, and untrusted rows arrive pre-fenced. That combination is what makes an autonomous DB agent defensible in production.