Atlas / MCP servers / softinstigate / RESTHeart

RESTHeartBLOCK

mcp/softinstigate/restheart

The Agent-native Backend for MongoDB

Verdict
BLOCK
Grade
F
Trust score
53 /100
Exposed tools
10 8r · 2w · 0d
Transport
—
License
AGPL-3.0
Stars
889
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A backend for web, mobile, AI and IoT apps.

[](https://github.com/SoftInstigate/restheart/commits/master) [](https://github.com/SoftInstigate/restheart/actions/workflows/branch.yml) [](https://github.com/SoftInstigate/restheart) [](https://central.sonatype.com/namespace/org.restheart) [](https://javadoc.io/doc/org.restheart/restheart-commons) [](https://hub.docker.com/r/softinstigate/restheart/) [](https://join.slack.com/t/restheart/shared_invite/zt-1olrhtoq8-5DdYLBWYDonFGEALhmgSXQ) [](https://cla-assistant.io/SoftInstigate/restheart)

What RESTHeart is

RESTHeart is a backend for web, mobile, AI and IoT apps. It gives an application the backend it would otherwise have to write — AI agents and RAG, accounts, permissions, data APIs, live data, email, payments — as configuration, not code. What an application needs beyond it goes into plugins, in Java, Kotlin, JavaScript or TypeScript.

Example

curl "https://demo.restheart.org/messages?filter={\"from\":\"Bob\"}&pagesize=1"

No route was written for /messages. It is a MongoDB collec

Read from source at commit 01af831a22b4OBSERVED · 2026-09-26
02

Exposed tools (10)

8 read · 2 write · 0 destructive.

ToolRiskDescription
ccHiderreadhides credit card numbers
helloWorldInterceptorreadmodifies the response of helloWorldService
helloWorldServicereadjust another Hello World
helloWorldTSreadTest typescript
httpClientServicewritea service that uses java.net.http.HttpClient to execute a GET request
mclientServicereadjust an example JavaScript service that uses the MongoClient
mongoGetDocInteceptorreada js interceptor that modified the response of GET /coll/<docid>
mongoPostCollInterceptorwritemodifies the content of POST requests adding a timestamp
nodePromiseSrvreadjust an example node service that requires http and returns a promise
requireModuleServicereadjust an example JavaScript service that uses a CommonJS module
03

Trust audit

BLOCKgrade F · trust 53/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (1 observation(s))
Network
declared (13 observation(s))
Shell
declared (2 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
polyglot/src/js/restheart.js:90
const parsed = eval(code);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
polyglot/src/js/restheart.js:117
evaluated = eval(code);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
core/bin/aws-build-native.sh:156
TOKEN=\$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
core/bin/aws-build-native.sh:157
ISELF=\$(curl -s -H "X-aws-ec2-metadata-token: \$TOKEN" http://169.254.169.254/latest/meta-data/instance-id)
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.tls_off · CWE-200, CWE-319
core/bin/convert-letsencrypt-java-keystore.sh:151
curl --insecure https://letsencrypt.org/certs/${FNAME} > ${outdir}/${FNAME}
Why it matters. certificate verification is disabled
Fix. leave verification on
HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321
commons/src/main/java/org/restheart/configuration/Configuration.java:130
* Input:  mongodb://user:secretPass@host:27017/db
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
core/bin/aws-build-native.sh:156
TOKEN=\$(curl -sX PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 60")
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
core/bin/aws-build-native.sh:157
ISELF=\$(curl -s -H "X-aws-ec2-metadata-token: \$TOKEN" http://169.254.169.254/latest/meta-data/instance-id)
MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321
docs/restheart-emails-module.md:76
smtp-username: AKIAX4NFDXSDBHZ4RU6K
MEDIUMHard-coded secrets · secret.aws · CWE-798, CWE-321
docs/restheart-emails-module.md:88
smtp-username: AKIAX4NFDXSDBHZ4RU6K
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
commons/src/test/java/org/restheart/configuration/ConnectionStringMaskingTest.java:41
String original = "mongodb://repoUser:myPassword@localhost:27017/mydb";
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
commons/src/test/java/org/restheart/configuration/ConnectionStringMaskingTest.java:52
String original = "mongodb+srv://repoUser:[email protected]/?authSource=admin&replicaSet=rs0";
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
commons/src/test/java/org/restheart/configuration/ConnectionStringMaskingTest.java:65
String original = "mongodb://repoUser:admin@caas-mongo/?authSource=admin&replicaSet=rs0";
MEDIUMHard-coded secrets · secret.db_uri · CWE-798, CWE-321
commons/src/test/java/org/restheart/configuration/ConnectionStringMaskingTest.java:79
String original = "mongodb://user123:p%40ss%[email protected]:27017/db";
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
core/src/test/java/karate/accounts/invitations.feature:173
And param token = '0000000011111111222222223333333344444444555555556666666677777777'
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
core/src/test/java/karate/accounts/verify.feature:177
And param token = '0000000011111111222222223333333344444444555555556666666677777777'
LOWInventory / provenance · inv.hidden_file · CWE-1104
chart/.helmignore
.helmignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
chart/templates/NOTES.txt:19
Then visit: http://127.0.0.1:8080
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
chart/templates/NOTES.txt:23
Health check: curl http://127.0.0.1:8080/ping
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
core/src/test/resources/etc/conf-overrides.yml:490
proxy-pass: http://127.0.0.1:8080/echo
LOWSupply chain · supply.unpinned · CWE-829, CWE-1357
examples/js-plugin/package.json
moment, one-liner-joke
Why it matters. 2 dependency range(s) float
Fix. pin exact versions or ship a lockfile
LOWPrompt injection · prompt.credential_read · CWE-94, CWE-1427
examples/x-powered-by-remover/README.md:31
Access-Control-Allow-Credentials: true
Why it matters. asks the agent to read credentials
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
README.md:34
- [**Accounts**](https://restheart.org/docs/accounts/overview): sign-up, login, email verification, password reset, team invitations, Google sign-in, tokens and API keys
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
examples/slack-notifier/README.md:70
http -a admin:secret :8080/contacts name=uji [email protected] message="This is cool!"
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
examples/user-signup/README.md:88
$ echo '{"_id":"user","$schema":"http://json-schema.org/draft-04/schema#","type":"object","properties":{"_id":{"type":"string","pattern":"^\\w+@[a-zA-Z_]+?.[a-zA-Z]{2,3}$"},"password":{"type":"string"
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine

Gates applied: no_behavioural_pass.

Audited 2026-09-26 · audit v0.4.1 · source sha 01af831a22b4full audit observations/trust-audit/mcp-server/softinstigate__restheart.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-09-2601af831a22b4BLOCKF53first audit
05

Questions

What is the RESTHeart MCP server?

The Agent-native Backend for MongoDB

What tools does RESTHeart expose?

10 in total: 8 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is RESTHeart safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (53/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does RESTHeart need?

No credential environment variables were found in its source, so it appears to need none.

How current is this page?

The grade is for one exact copy of the source (01af831a22b4), read on 2026-09-26. The repository is watched and re-audited when it changes.

Advertisement