feat: hide atlas tools when not configured (#96)

fmenezes · web-flow · commit 9ba243d47ec4 · 2025-04-23T12:56:17.000+01:00
diff --git a/README.md b/README.md
@@ -109,6 +109,8 @@ You may experiment asking `Can you connect to my mongodb instance?`.
 - `atlas-list-db-users` - List MongoDB Atlas database users
 - `atlas-create-db-user` - List MongoDB Atlas database users
 
+NOTE: atlas tools are only available when you set credentials on [configuration](#configuration) section.
+
 #### MongoDB Database Tools
 
 - `connect` - Connect to a MongoDB instance
diff --git a/src/common/atlas/apiClient.ts b/src/common/atlas/apiClient.ts
@@ -6,11 +6,13 @@ import { paths, operations } from "./openapi.js";
 
 const ATLAS_API_VERSION = "2025-03-12";
 
+export interface ApiClientCredentials {
+    clientId: string;
+    clientSecret: string;
+}
+
 export interface ApiClientOptions {
-    credentials?: {
-        clientId: string;
-        clientSecret: string;
-    };
+    credentials?: ApiClientCredentials;
     baseUrl?: string;
     userAgent?: string;
 }
diff --git a/src/session.ts b/src/session.ts
@@ -1,27 +1,24 @@
 import { NodeDriverServiceProvider } from "@mongosh/service-provider-node-driver";
-import { ApiClient } from "./common/atlas/apiClient.js";
+import { ApiClient, ApiClientCredentials } from "./common/atlas/apiClient.js";
 import config from "./config.js";
 
 export class Session {
     serviceProvider?: NodeDriverServiceProvider;
-    apiClient?: ApiClient;
+    apiClient: ApiClient;
 
-    ensureAuthenticated(): asserts this is { apiClient: ApiClient } {
-        if (!this.apiClient) {
-            if (!config.apiClientId || !config.apiClientSecret) {
-                throw new Error(
-                    "Not authenticated make sure to configure MCP server with MDB_MCP_API_CLIENT_ID and MDB_MCP_API_CLIENT_SECRET environment variables."
-                );
-            }
+    constructor() {
+        const credentials: ApiClientCredentials | undefined =
+            config.apiClientId && config.apiClientSecret
+                ? {
+                      clientId: config.apiClientId,
+                      clientSecret: config.apiClientSecret,
+                  }
+                : undefined;
 
-            this.apiClient = new ApiClient({
-                baseUrl: config.apiBaseUrl,
-                credentials: {
-                    clientId: config.apiClientId,
-                    clientSecret: config.apiClientSecret,
-                },
-            });
-        }
+        this.apiClient = new ApiClient({
+            baseUrl: config.apiBaseUrl,
+            credentials,
+        });
     }
 
     async close(): Promise<void> {
diff --git a/src/tools/atlas/atlasTool.ts b/src/tools/atlas/atlasTool.ts
@@ -1,10 +1,18 @@
 import { ToolBase, ToolCategory } from "../tool.js";
 import { Session } from "../../session.js";
+import config from "../../config.js";
 
 export abstract class AtlasToolBase extends ToolBase {
     constructor(protected readonly session: Session) {
         super(session);
     }
 
     protected category: ToolCategory = "atlas";
+
+    protected verifyAllowed(): boolean {
+        if (!config.apiClientId || !config.apiClientSecret) {
+            return false;
+        }
+        return super.verifyAllowed();
+    }
 }
diff --git a/src/tools/atlas/createAccessList.ts b/src/tools/atlas/createAccessList.ts
@@ -27,8 +27,6 @@ export class CreateAccessListTool extends AtlasToolBase {
         comment,
         currentIpAddress,
     }: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
-
         if (!ipAddresses?.length && !cidrBlocks?.length && !currentIpAddress) {
             throw new Error("One of  ipAddresses, cidrBlocks, currentIpAddress must be provided.");
         }
diff --git a/src/tools/atlas/createDBUser.ts b/src/tools/atlas/createDBUser.ts
@@ -34,8 +34,6 @@ export class CreateDBUserTool extends AtlasToolBase {
         roles,
         clusters,
     }: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
-
         const input = {
             groupId: projectId,
             awsIAMType: "NONE",
diff --git a/src/tools/atlas/createFreeCluster.ts b/src/tools/atlas/createFreeCluster.ts
@@ -15,8 +15,6 @@ export class CreateFreeClusterTool extends AtlasToolBase {
     };
 
     protected async execute({ projectId, name, region }: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
-
         const input = {
             groupId: projectId,
             name,
diff --git a/src/tools/atlas/createProject.ts b/src/tools/atlas/createProject.ts
@@ -14,7 +14,6 @@ export class CreateProjectTool extends AtlasToolBase {
     };
 
     protected async execute({ projectName, organizationId }: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
         let assumedOrg = false;
 
         if (!projectName) {
diff --git a/src/tools/atlas/inspectAccessList.ts b/src/tools/atlas/inspectAccessList.ts
@@ -12,8 +12,6 @@ export class InspectAccessListTool extends AtlasToolBase {
     };
 
     protected async execute({ projectId }: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
-
         const accessList = await this.session.apiClient.listProjectIpAccessLists({
             params: {
                 path: {
diff --git a/src/tools/atlas/inspectCluster.ts b/src/tools/atlas/inspectCluster.ts
@@ -14,8 +14,6 @@ export class InspectClusterTool extends AtlasToolBase {
     };
 
     protected async execute({ projectId, clusterName }: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
-
         const cluster = await this.session.apiClient.getCluster({
             params: {
                 path: {
diff --git a/src/tools/atlas/listClusters.ts b/src/tools/atlas/listClusters.ts
@@ -13,8 +13,6 @@ export class ListClustersTool extends AtlasToolBase {
     };
 
     protected async execute({ projectId }: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
-
         if (!projectId) {
             const data = await this.session.apiClient.listClustersForAllProjects();
 
diff --git a/src/tools/atlas/listDBUsers.ts b/src/tools/atlas/listDBUsers.ts
@@ -13,8 +13,6 @@ export class ListDBUsersTool extends AtlasToolBase {
     };
 
     protected async execute({ projectId }: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
-
         const data = await this.session.apiClient.listDatabaseUsers({
             params: {
                 path: {
diff --git a/src/tools/atlas/listOrgs.ts b/src/tools/atlas/listOrgs.ts
@@ -9,8 +9,6 @@ export class ListOrganizationsTool extends AtlasToolBase {
     protected argsShape = {};
 
     protected async execute(): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
-
         const data = await this.session.apiClient.listOrganizations();
 
         if (!data?.results?.length) {
diff --git a/src/tools/atlas/listProjects.ts b/src/tools/atlas/listProjects.ts
@@ -13,8 +13,6 @@ export class ListProjectsTool extends AtlasToolBase {
     };
 
     protected async execute({ orgId }: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {
-        this.session.ensureAuthenticated();
-
         const data = orgId
             ? await this.session.apiClient.listOrganizationProjects({
                   params: {
diff --git a/src/tools/tool.ts b/src/tools/tool.ts
@@ -52,7 +52,7 @@ export abstract class ToolBase {
     }
 
     // Checks if a tool is allowed to run based on the config
-    private verifyAllowed(): boolean {
+    protected verifyAllowed(): boolean {
         let errorClarification: string | undefined;
         if (config.disabledTools.includes(this.category)) {
             errorClarification = `its category, \`${this.category}\`,`;
diff --git a/tests/integration/tools/atlas/accessLists.test.ts b/tests/integration/tools/atlas/accessLists.test.ts
@@ -1,5 +1,4 @@
 import { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
-import { Session } from "../../../../src/session.js";
 import { describeAtlas, withProject } from "./atlasHelpers.js";
 
 function generateRandomIp() {
@@ -17,20 +16,18 @@ describeAtlas("ip access lists", (integration) => {
         const values = [...ips, ...cidrBlocks];
 
         beforeAll(async () => {
-            const session: Session = integration.mcpServer().session;
-            session.ensureAuthenticated();
-            const ipInfo = await session.apiClient.getIpInfo();
+            const apiClient = integration.mcpServer().session.apiClient;
+            const ipInfo = await apiClient.getIpInfo();
             values.push(ipInfo.currentIpv4Address);
         });
 
         afterAll(async () => {
-            const session: Session = integration.mcpServer().session;
-            session.ensureAuthenticated();
+            const apiClient = integration.mcpServer().session.apiClient;
 
             const projectId = getProjectId();
 
             for (const value of values) {
-                await session.apiClient.deleteProjectIpAccessList({
+                await apiClient.deleteProjectIpAccessList({
                     params: {
                         path: {
                             groupId: projectId,
diff --git a/tests/integration/tools/atlas/atlasHelpers.ts b/tests/integration/tools/atlas/atlasHelpers.ts
@@ -2,7 +2,6 @@ import { ObjectId } from "mongodb";
 import { Group } from "../../../../src/common/atlas/openapi.js";
 import { ApiClient } from "../../../../src/common/atlas/apiClient.js";
 import { setupIntegrationTest, IntegrationTest } from "../../helpers.js";
-import { Session } from "../../../../src/session.js";
 
 export type IntegrationTestFunction = (integration: IntegrationTest) => void;
 
@@ -35,19 +34,15 @@ export function withProject(integration: IntegrationTest, fn: ProjectTestFunctio
         let projectId: string = "";
 
         beforeAll(async () => {
-            const session: Session = integration.mcpServer().session;
-            session.ensureAuthenticated();
+            const apiClient = integration.mcpServer().session.apiClient;
 
-            const apiClient = session.apiClient;
             const group = await createProject(apiClient);
             projectId = group.id || "";
         });
 
         afterAll(async () => {
-            const session: Session = integration.mcpServer().session;
-            session.ensureAuthenticated();
+            const apiClient = integration.mcpServer().session.apiClient;
 
-            const apiClient = session.apiClient;
             await apiClient.deleteProject({
                 params: {
                     path: {
diff --git a/tests/integration/tools/atlas/clusters.test.ts b/tests/integration/tools/atlas/clusters.test.ts
@@ -3,8 +3,6 @@ import { describeAtlas, withProject, sleep, randomId } from "./atlasHelpers.js";
 import { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
 
 async function deleteAndWaitCluster(session: Session, projectId: string, clusterName: string) {
-    session.ensureAuthenticated();
-
     await session.apiClient.deleteCluster({
         params: {
             path: {
diff --git a/tests/integration/tools/atlas/dbUsers.test.ts b/tests/integration/tools/atlas/dbUsers.test.ts
@@ -9,7 +9,6 @@ describeAtlas("db users", (integration) => {
             const projectId = getProjectId();
 
             const session: Session = integration.mcpServer().session;
-            session.ensureAuthenticated();
             await session.apiClient.deleteDatabaseUser({
                 params: {
                     path: {
diff --git a/tests/integration/tools/atlas/projects.test.ts b/tests/integration/tools/atlas/projects.test.ts
@@ -1,6 +1,4 @@
 import { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
-import { setupIntegrationTest } from "../../helpers.js";
-import { Session } from "../../../../src/session.js";
 import { ObjectId } from "mongodb";
 import { parseTable, describeAtlas } from "./atlasHelpers.js";
 
@@ -10,8 +8,7 @@ describeAtlas("projects", (integration) => {
     const projName = "testProj-" + randomId;
 
     afterAll(async () => {
-        const session: Session = integration.mcpServer().session;
-        session.ensureAuthenticated();
+        const session = integration.mcpServer().session;
 
         const projects = await session.apiClient.listProjects();
         for (const project of projects?.results || []) {

Original file line number	Diff line number	Diff line change
`@@ -27,8 +27,6 @@ export class CreateAccessListTool extends AtlasToolBase {`
`27`	`27`	`comment,`
`28`	`28`	`currentIpAddress,`
`29`	`29`	`}: ToolArgs<typeof this.argsShape>): Promise<CallToolResult> {`
`30`		`- this.session.ensureAuthenticated();`
`31`		`-`
`32`	`30`	`if (!ipAddresses?.length && !cidrBlocks?.length && !currentIpAddress) {`
`33`	`31`	`throw new Error("One of ipAddresses, cidrBlocks, currentIpAddress must be provided.");`
`34`	`32`	`}`
Original file line number	Diff line number	Diff line change
`@@ -52,7 +52,7 @@ export abstract class ToolBase {`
`52`	`52`	`}`
`53`	`53`
`54`	`54`	`// Checks if a tool is allowed to run based on the config`
`55`		`- private verifyAllowed(): boolean {`
	`55`	`+ protected verifyAllowed(): boolean {`
`56`	`56`	`let errorClarification: string \| undefined;`
`57`	`57`	`if (config.disabledTools.includes(this.category)) {`
`58`	`58`	errorClarification = `its category, \`${this.category}\`,`;