@kansodata/kansodata-mongodb-plugin

External OpenClaw plugin for MongoDB with strict read-only scope.

Scope

This plugin is designed for MongoDB runtime access in OpenClaw. It is not a MongoDB Compass integration.

Read-only tools

• mongodb_ping
• mongodb_list_databases
• mongodb_list_collections
• mongodb_collection_stats
• mongodb_find_sample
• mongodb_aggregate_preview
• mongodb_get_indexes
• mongodb_explain_query

Out of scope

• No insert, update, delete, drop, create, or other mutating operations.
• No arbitrary JavaScript execution in filters/pipelines.

Canonical identifiers

• Repository: kansodata-mongodb-plugin
• Package: @kansodata/kansodata-mongodb-plugin
• Plugin manifest id: mongodb

OpenClaw integration artifacts

• openclaw.plugin.json
• package.json openclaw block
• Runtime entrypoint in package artifact: dist/index.js

Installation (OpenClaw external plugin)

npm install @kansodata/kansodata-mongodb-plugin

OpenClaw reads plugin metadata from the package openclaw block and openclaw.plugin.json. Install mechanism is npm package install (no local-path install metadata is required for publish).

Environment variables

• Primary credential: MONGODB_URI (required MongoDB connection string)
• MONGODB_DATABASE (optional)
• MONGODB_APP_NAME (optional, default: kansodata-mongodb-plugin)
• MONGODB_MAX_RESULTS (optional MONGODB_*, default: 50, safety capped)
• MONGODB_MAX_TIME_MS (optional MONGODB_*, default: 2000, safety capped)
• MONGODB_LOG_LEVEL (optional MONGODB_*: debug|info|warn|error, default: info)

Security and hardening

• Read-only tool surface only.
• Safe JSON parsing with blocked unsafe operators/stages ($where, $function, $accumulator, $out, $merge).
• Bounded result size and query runtime limits.
• Fail-closed config loading (MONGODB_URI required at runtime execution).
• Secret redaction in error/log paths.

Local validation

npm install
npm run lint
npm run typecheck
npm run build
npm test