Scoping the LLM query

[khaledosama999]

Description

Given the MCP gives direct access to the LLM for the whole DB (even in read mode), anyway to intercept the request from the MCP client somehow and force it to use a tool given certain filters i.e (userID: '1213')

and so on, or would that have to be done MCP client side ?

[blva]

Hi @khaledosama999 , thanks for your question!

Answer

The MCP does not currently support any built-in mechanisms to intercept or filter requests made by a client before directly interacting with the LLM.

You can use MongoDB’s built-in features, such as:

• Users and Roles: Allows you to restrict access to your database resources (at the database and collection level) depending on user permissions. Learn more in Manage Users and Roles.

• Collection-Level Access Control: Lets you specify privileges at the collection level, ensuring restricted access based on defined roles and permissions. For more details, refer to Collection-Level Access Control.

• Atlas Privileges for Specific Users: In a MongoDB Atlas environment, you can define privileges specific to your database users based on roles (e.g., read-only, read/write for specific collections). This approach can help limit the scope of client actions. You can explore this further at Atlas: MongoDB Users, Roles, and Privileges.

Summary

• If you are using Atlas, leverage the tool atlas-create-db-user to achieve collection or database level access restrictions.
• If not, you need to use mongosh probably and create the role manually as we do not have that mongodb tool yet

Atlas MDB example

1. Create a view that filters data based on your criteria, such as userID: '1213'.

use sample_database  
  
db.createView(  
  "filtered_data",  
  "original_collection",  
  [{ $match: { userID: "1213" } }]  
);  

2. Restrict access to the view using user roles:

Prompt LLM: Create a DB role that has access only to the 'sample_database' database and 'filtered_data' collection

Local MDB example

In your case a quick tutorial to setup a user to use in your MCP:

1. Create a view that filters data based on your criteria, such as userID: '1213'.
   use sample_database

db.createView(  
  "filtered_data",  
  "original_collection",  
  [{ $match: { userID: "1213" } }]  
);  

2. Restrict access to the view using user roles:
   Create a role that only provides access to the view:
   use admin

db.createRole({  
  role: "viewAccessRole",  
  privileges: [  
    { resource: { db: "sample_database", collection: "filtered_data" }, actions: ["find"] }  
  ],  
  roles: []  
});  

3. Assign the role to the user:

db.createUser({  
  user: "filteredUser",  
  pwd: "strongpassword",  
  roles: [{ role: "viewAccessRole", db: "admin" }]  
});  

Now, when the user logs in, they can only access the filtered_data view and will see data that matches the criteria (e.g., userID: '1213').

Hope this helps!