Docs / Observability and data
MongoDB
Connect a MongoDB database with an agent access policy, then browse collections and run bounded read-only queries.
Connect a MongoDB database to browse it in Pangea and, if you allow it, let the agent inspect and query it. MongoDB is the only database engine this connector supports. Don't assume other engines work because a CLI for them is installed.
Connect
As a team Administrator, open Connectors → Connect → MongoDB. This opens the Add database dialog.
| Field | Notes |
|---|---|
| Name | For example Production API |
| Connection string | For example mongodb+srv://user:••••@host/database. Read-only and write-capable accounts both work |
| Environment | Defaults to production |
| Tags | Optional, comma separated, for example payments, primary |
| Agent access | Disabled, Metadata only or Read-only queries. Defaults to Disabled |
Click Test connection and review the result. It shows the latency, the endpoint, the database and whether the credential can write. Then click Add database.
The connection string can contain credentials. Enter it only in this field, never in a conversation or a repository. Pangea encrypts it on its servers and only returns redacted connection details. The field is cleared when the dialog closes, and the credential never reaches the desktop app or the agent sandbox.
Pangea connects to your database over the public internet through its backend proxy, so the database must be reachable from Pangea. Every host the driver connects to, including replica-set members found through SRV, must resolve to a public address. Private, loopback and reserved addresses are refused. Allow Pangea in your database's network rules.
Two permission layers
The database account can be read-only or able to write. Either way, the Agent access policy limits what the agent can do:
| Agent access | What the agent can do |
|---|---|
| Disabled | Nothing |
| Metadata only | List databases and collections and read collection details |
| Read-only queries | Metadata, plus bounded find, aggregate, count and explain queries |
Pangea rejects and audits server-side JavaScript, writes, unbounded results and anything the policy doesn't allow. Still, give the database account the smallest privileges it needs. A valid connection string does not get around MongoDB's network rules, TLS settings or authentication database.
Inspect and query
Each database has these pages in Pangea: Overview, Collections, Query, Changes, Monitoring, Access, Audit and Settings.
To use the agent, select the connection in a conversation and name the database and collection. Ask for bounded results. Review Access to see who can use the connection and Audit to see what was queried.
The agent cannot create connections, test credentials, change the access policy or run database changes from a conversation.
Troubleshoot and remove
If the connection fails, check that the database is reachable from Pangea, your network allow-lists, TLS and the database user before you change any permissions.
Removing the connection ends access from Pangea. It does not delete the database or its database user. Rotate or revoke that user in MongoDB separately when needed.