Skip to main content
Connect your MongoDB databases to enable Tony (Database Engineer) to analyze queries, optimize performance, and monitor database health.

​
Supported platforms

PlatformSupport
Self-hosted MongoDB4.x, 5.x, 6.x, 7.x
MongoDB AtlasAll versions

​
Prerequisites

  • A MongoDB instance or Atlas cluster reachable from CloudThinker over the network.
  • Admin access to create a dedicated database user and assign roles.
  • The MongoDB connection string with credentials.

​
Setup

Select your MongoDB platform for specific connection instructions.
1

Connect as admin

Connect to your MongoDB instance using the Mongo shell (mongosh) with administrative privileges.Replace <admin-user>, <admin-password>, and <your-host> with your credentials. The /admin database is required.
mongosh "mongodb://<admin-user>:<admin-password>@<your-host>:27017/admin"
2

Switch to the admin database

Ensure you are on the admin database where users are created:
use admin
3

Create a read-only user

Create a dedicated user for CloudThinker using standard MongoDB built-in roles:
db.createUser({
  user: "<cloudthinker_user>",
  pwd: "<secure-password>",
  roles: [
    { role: "readAnyDatabase", db: "admin" },
    { role: "clusterMonitor", db: "admin" }
  ]
})
The clusterMonitor role is recommended for performance metrics analysis.
4

Configure network access

Ensure CloudThinker can reach your database:
  • Add CloudThinker IPs to your firewall or security group
  • Ensure MongoDB is bound to an accessible IP address in mongod.conf
5

Add the connection in CloudThinker

Navigate to Connections → MongoDB and paste your connection string:
mongodb://<cloudthinker_user>:<secure-password>@<your-host>:27017/admin?tls=true&appName=CloudThinker
Include tls=true if your deployment enforces TLS encryption. Click Connect. CloudThinker shows a Connected status once it succeeds.

​
Connection details

FieldDescriptionExample
Connection stringFull MongoDB URI including credentialsmongodb+srv://user:pass@host/admin?tls=true
TLS/SSLEnforce TLS for the connection — use tls=true in the URItrue
Read preferenceWhich nodes to route read operations toprimary
Connection timeoutSeconds to wait for connection10

​
Required permissions

RolePurpose
readAnyDatabaseAnalyze queries and index usage across all collections
clusterMonitorAccess serverStatus, replSetGetStatus, and other diagnostic commands for performance metrics
Assign both roles to unlock full query analysis and cluster health monitoring. Never grant write or admin roles to the CloudThinker user.

​
Agent capabilities

Once connected, Tony can:
CapabilityDescription
Query analysisIdentify slow queries, analyze execution plans with explain()
Index recommendationsFind missing indexes, identify unused indexes
Performance metricsMonitor connections, memory usage, and replication lag

​
Verify the connection

@tony #report list all MongoDB databases and summarize their collection counts

​
Example prompts

@tony #report analyze slow queries on the production MongoDB instance
@tony #recommend find missing indexes on the users collection
@tony #report check replication lag on the secondary nodes

​
Troubleshooting

  • Verify username and password are correct
  • Ensure the user is created on the admin database, or append ?authSource=admin to your connection string
  • For Atlas: confirm the user was created with the correct privileges under Database Access
  • Check that CloudThinker IPs are added to your Atlas Network Access list or your firewall
  • For local MongoDB, ensure bindIp in mongod.conf is not set to only 127.0.0.1
  • Tony needs the clusterMonitor role to run serverStatus and replSetGetStatus
  • Add the clusterMonitor role to the CloudThinker user on the admin database and reconnect

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • TLS required — always use tls=true in the connection string to encrypt data in transit.
  • Minimal roles — grant only readAnyDatabase and clusterMonitor; never grant write or admin roles.

Tony Agent

Database-focused optimization agent
https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/postgresql.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=8bb2ac033d0a2ccbef51154a76e1e819

PostgreSQL Connection

Setup instructions for PostgreSQL databases