restheart

mcp
Guvenlik Denetimi
Uyari
Health Gecti
  • License — License: AGPL-3.0
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 874 GitHub stars
Code Uyari
  • fs module — File system access in .github/workflows/native-image-release.yml
Permissions Gecti
  • Permissions — No dangerous permissions requested
Purpose
This tool acts as an agent-ready backend for MongoDB, exposing your database through a native Model Context Protocol (MCP) server, alongside REST, GraphQL, and WebSocket APIs.

Security Assessment
Overall Risk: Medium. The primary security consideration is inherent to its purpose: it acts as a direct pipeline to your MongoDB database, meaning it inherently accesses and transmits sensitive data depending on your database contents. The application itself does not request dangerous permissions, execute unexpected shell commands, or contain hardcoded secrets. A code scan flagged file system access, but this is safely isolated within its GitHub Actions continuous integration workflows rather than the core application. It also features robust built-in authentication and authorization (JWT, OAuth2, LDAP) to help secure data access.

Quality Assessment
The project is highly mature and extremely well-maintained. It is actively developed, with its most recent code push occurring just today. It has garnered nearly 900 GitHub stars, reflecting a strong level of community trust and real-world adoption. Furthermore, it operates under the AGPL-3.0 license, which is standard for open-source software but does require careful review if you plan to modify and distribute the code in a commercial product.

Verdict
Safe to use.
SUMMARY

The Agent-Ready Backend for MongoDB.

README.md

RESTHeart logo RESTHeart

The Agent-Ready Backend for MongoDB

GitHub last commit
Build snapshot release
Github stars
Maven Central Version
javadoc
Docker Pulls
Join the chat on Slack


What is RESTHeart?

RESTHeart is the agent-ready backend for MongoDB: it exposes your data through a native MCP server and full REST and GraphQL APIs, so AI agents and developers can read and write without custom integration code.

RESTHeart logical architecture

RESTHeart gives AI agents and developers instant, secure access to MongoDB. It ships with a native MCP server that any MCP-compatible client (Claude, Claude Code, Cursor, VS Code) can connect to out of the box, plus full REST, GraphQL, and WebSocket APIs for traditional application development. Built-in authentication and authorization, zero backend boilerplate, and a plugin framework for custom business logic when you need it.

Available as a Docker image and GraalVM native binary. Built on Java 25, Undertow, and virtual threads.

Core capabilities:

  • MCP Server: Native Model Context Protocol server. Connect any MCP-compatible AI client (Claude, Claude Code, Cursor, VS Code) directly to your MongoDB data with one line of config.
  • REST API: Full CRUD, aggregations, filtering, sorting, pagination
  • GraphQL: Schema-driven mapping to MongoDB queries
  • WebSocket: Real-time change streams and data sync
  • SSE: Server-Sent Events for live dashboards, IoT feeds, and event streams
  • IoT / MQTT: Connect devices and ingest telemetry directly into MongoDB (coming soon)
  • Authentication and Authorization: JWT, OAuth2, LDAP, MongoDB-based users, ACL rules
  • Plugin system: Extend with Java, Kotlin, JavaScript, or TypeScript for custom business logic

AI Agents & MCP

RESTHeart ships with a native Model Context Protocol (MCP) server. Any MCP-compatible AI client can connect directly to your MongoDB data — no custom integration code required.

MCP endpoint:

http(s)://<restheart-host>/mcp/

Connect with Claude Code:

claude mcp add --transport http restheart http://localhost:8080/mcp/

Connect with Claude Desktop (add to claude_desktop_config.json):

{
  "mcpServers": {
    "restheart": {
      "type": "http",
      "url": "http://localhost:8080/mcp/"
    }
  }
}

Connect with stdio clients (VS Code, Zed — requires Node.js 18+):

{
  "restheart": {
    "command": "npx",
    "args": ["mcp-remote", "http://localhost:8080/mcp/"]
  }
}

Public demo MCP endpoints (no authentication required):

https://sophia-api.restheart.com/mcp/restheart/    — RESTHeart docs knowledge base
https://sophia-api.restheart.com/mcp/cloud/        — RESTHeart Cloud docs knowledge base

Quick Start

# Start MongoDB + RESTHeart with Docker Compose
curl https://raw.githubusercontent.com/SoftInstigate/restheart/master/docker-compose.yml \
  --output docker-compose.yml && docker compose up --attach restheart

# Test it
curl http://localhost:8080/ping

Default credentials: admin / secret (change in production)

More options: https://restheart.org/docs/foundations/quick-start


Example: Query MongoDB via HTTP

const url = encodeURI('https://demo.restheart.org/messages?filter={"from":"Bob"}&pagesize=1');

fetch(url)
  .then(response => response.json())
  .then(json => console.log(JSON.stringify(json, null, 2)));

That's it. No Express routes, no Mongoose schemas, no middleware setup.

📄 Full documentation: https://restheart.org/docs/


Use Cases

  • AI agent backends: Give your agents a production-grade MongoDB backend via MCP. No custom integration code.
  • API development without boilerplate: Skip CRUD code, focus on business logic
  • Mobile and web backends: Get REST/GraphQL APIs immediately
  • Real-time applications: WebSocket and SSE for chat, notifications, and live dashboards
  • IoT backends: Collect and store sensor data via MQTT, query it via REST (coming soon)
  • MongoDB Data API replacement: Self-hosted alternative to the deprecated Atlas Data API (migration guide)
  • Legacy modernization: Add modern APIs to existing MongoDB databases
  • PostgreSQL with MongoDB API: Use via FerretDB for PostgreSQL storage (tutorial)

Extend with Plugins

Write custom logic only when you need it. RESTHeart handles the rest.

Java Plugin

@RegisterPlugin(name = "greetings")
public class GreeterService implements JsonService {
    @Override
    public void handle(JsonRequest req, JsonResponse res) {
        res.setContent(object()
            .put("message", "Hello World!")
            .put("timestamp", Instant.now()));
    }
}

JavaScript Plugin

export const options = {
    name: "greetings",
    uri: "/greetings"
}

export function handle(request, response) {
    response.setContent(JSON.stringify({
        message: 'Hello World!',
        timestamp: new Date().toISOString()
    }));
    response.setContentTypeAsJson();
}

Plugin types:

  • Services: custom REST endpoints
  • Interceptors: modify requests and responses, add validation
  • Initializers: run code at startup
  • Providers: dependency injection

📖 Plugin development: https://restheart.org/docs/plugins/overview/

🔧 Use restheart-cli for scaffolding, testing, and hot-reload.


Deployment

Docker

docker pull softinstigate/restheart:latest

docker run -p 8080:8080 \
  -v ./restheart.yml:/opt/restheart/etc/restheart.yml \
  softinstigate/restheart

Kubernetes

Stateless architecture supports horizontal scaling. Configure with ConfigMaps and Secrets.

Native Executables

Prebuilt binaries for macOS, Linux, and Windows with faster startup and lower memory footprint.

See docs/native-executables.md for download links.

RESTHeart Cloud

Fully managed service: cloud.restheart.com

  • Instant provisioning
  • Automatic scaling
  • Free tier available
  • Premium plugins (Webhooks, Sophia AI, Facet)

Database Compatibility

Database Support Level Notes
MongoDB Full All versions 3.6+
MongoDB Atlas Full Cloud-native support
Percona Server Full Drop-in MongoDB replacement
⚙️ FerretDB Partial PostgreSQL-backed (tutorial)
⚙️ AWS DocumentDB Partial Most features work
⚙️ Azure Cosmos DB Partial MongoDB API compatibility layer

Community and Support


Contributing

Contributions welcome. RESTHeart is open source (AGPL).

  • Report bugs and request features via GitHub Issues
  • Submit pull requests
  • Improve documentation
  • Share use cases

See CONTRIBUTING.md for guidelines.


License

RESTHeart core is licensed under the GNU AGPL v3.

The plugin SDK (restheart-commons, Maven artifact org.restheart:restheart-commons) is licensed under the Apache License 2.0. Plugins and extensions that depend only on restheart-commons are not subject to the AGPL v3 and may be distributed under any license you choose, including proprietary licenses. This follows the same pattern used by MongoDB: the server is AGPL, the drivers and SDKs are Apache 2.0.

See PLUGIN_EXCEPTION for the formal terms of this permission.

Commercial license: If you need to modify RESTHeart core without open-sourcing your changes, commercial licenses are available. See restheart.com/on-premises.


Built with ❤️ by SoftInstigate | GitHub | Website | Cloud


Made in EU

Yorumlar (0)

Sonuc bulunamadi