One customer, answered from four places at once

Why is a schemaless database harder for an agent?

In Postgres the shape of the data is a fact you can look up.

In Mongo it is a distribution. A companion that samples fifty documents has told you the truth about those fifty. Nothing in the collection announces the field that exists only on records created between two releases in 2023.

So any count coming out of a Mongo collection deserves one check against a number you already trust. "How many users are verified" is a question about your history, and your history is encoded in field names that changed while nobody was writing it down.

What can a companion do with MongoDB connected?

The MongoDB entry under `strawberry://settings/integrations` lists every tool the app exposes in its Available tools section, with the read-only ones marked. Read it first. It is the only place the answer is current.

The Permissions block beneath sets each action to Ask every time, Always allow, or off, and consequential steps stop at an approval card either way. An update without a tight filter in Mongo is quiet in a way a bad SQL UPDATE usually is not, so the write side is worth deciding about early.

• Read the Available tools list first, then decide what the workflow can be.
• Writes switched off unless a named task needs them.
• A user with `read` on one database, via a custom role rather than `readWriteAnyDatabase`.
• If you run Atlas, use its IP access list so the connection comes from somewhere you chose.

Which Mongo questions are worth handing over

The ones where the document is the start of the trail.

A ticket names an account. The account document holds a plan, a feature flag object and a created date. The reason the customer is complaining is in a thread and a billing page. Four tabs, finished while you read something else.

On the aggregation side, the value is everything after the number: turning a saved pipeline’s output into a note for people who never open Compass, on a cadence, with the context attached. That is where product engineering work and weekly metrics meet.

Where the connection string lives

Outside Strawberry, encrypted, and Strawberry never receives it.

You see the exact permissions before you approve them, the connection is isolated to one Strawberry profile, and disconnecting removes the managed account.

Which leaves the user inside that string. Create a Mongo user with a custom role granting `find` on the collections you want visible and nothing else. Anything the database will not serve directly, a companion still reaches in the tabs you are already signed into. Do AI agents work behind logins covers that half.

Frequently asked questions