MongoDB servers open to the internet without a password are found and wiped by bots within hours, and findOne(req.body) lets anyone log in with {"$ne": null}. This skill finds those and six other MongoDB mistakes before you go live, and tells you how to fix each one.

Your agent runs a scanner on mongod.conf (YAML or the old key = value form), Docker Compose files with mongo or Bitnami MongoDB images, and the app code and config that hold connection strings and queries. It knows that ${VARIABLE} values, passwords built at run time and placeholders are not secrets, that a password file or env_file may set the root password, and which queries are safe (named fields cast to strings, sanitize middleware). It never connects to MongoDB. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Passwords are never printed.

What it checks

BLOCK (fix before shipping)

• M01: a server on the network with no authentication

• M02: a password in a connection string or a compose file

• M03: a whole request used as a query filter, or $where built from request text

REVIEW (check before release)

• M11: a reachable server without TLS

• M12: authorization disabled (even on localhost)

• M13: request fields used as is in query filters

• M14: 27017 published on every host interface

• M15: TLS certificate or hostname checks turned off

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• Risky and safe example config, compose and app files, and the real report the scanner produces on the risky ones

Limits

It reads files as written: .env files, users and roles inside the database, MongoDB Atlas settings and firewalls are not seen. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 16 files: SKILL.md, the scanner in scripts/ (4 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (9 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.