Connecting to MongoDB

mongoui connects with a standard MongoDB connection string (URI). The connection is made directly from your machine to your database — your URI and credentials are stored locally and never sent to us.

Local server

A standalone mongod on the default port:

mongodb://127.0.0.1:27017

Local replica set

If you run a single-node replica set locally (recommended, so you can test transactions and change streams), connect directly to the node:

mongodb://127.0.0.1:27017/?directConnection=true

directConnection=true tells the driver to talk to exactly that node instead of trying to discover the replica-set topology — which is what you want for a local one-node set.

MongoDB Atlas

Copy the mongodb+srv:// string from the Atlas UI (Connect → Drivers) and fill in your password:

mongodb+srv://USER:PASSWORD@cluster0.xxxxx.mongodb.net/

Make sure your current IP is on the Atlas Network Access allowlist, or the connection will time out.

Authentication

For a server that requires auth, include the credentials and the auth database:

mongodb://USER:PASSWORD@127.0.0.1:27017/?authSource=admin

TLS and X.509

Open TLS / X.509 below the connection string when your deployment uses a private certificate authority, mutual TLS, or X.509 authentication.

1. Enable Use explicit TLS options.
2. Choose the CA PEM when the server certificate is not trusted by your system.
3. For mutual TLS or X.509, choose the combined client certificate and private-key PEM. Enter its private-key password only when the key is encrypted.
4. Choose Test DB. The test uses the same URI, certificate files, password, and verification policy as Connect.

For X.509 database authentication, also set the mechanism required by your deployment in the URI, for example:

mongodb://db.example.net/?authMechanism=MONGODB-X509&authSource=%24external

Certificate and hostname verification remain enabled by default. The two verification exceptions in the advanced section are for controlled testing only; mongoui keeps an amber warning visible when either exception is active, including on a saved profile.

Native certificate paths never enter the web renderer. It receives only short-lived, owner-scoped tokens and basenames while the Electron main process opens the selected files for the MongoDB driver.

SOCKS5 proxies and SSH bastions

Open SOCKS5 proxy when your MongoDB deployment is reachable through a proxy or bastion. Enter the proxy host and port, plus both username and password when the proxy requires authentication. Test DB and Connect use the same proxy for every socket the MongoDB driver opens, including replica-set and sharded-topology discovery.

For an SSH bastion, start a local dynamic tunnel outside mongoui:

ssh -D 1080 bastion.example.net

Then use 127.0.0.1 and port 1080 in mongoui. Your MongoDB URI stays unchanged.

SOCKS5 does not encrypt traffic by itself. Mongoui warns when a remote proxy can inspect a non-TLS MongoDB connection. It also warns that username/password proxy authentication is plaintext to a remote proxy. Use a trusted path and enable MongoDB TLS. Loopback proxies used with ssh -D do not show those remote warnings.

Where credentials live

Scrubbed recent-profile metadata stays in renderer-local storage. When you explicitly choose the Remember option, the full URI, certificate paths, private-key password, and SOCKS5 endpoint and credentials are encrypted by the operating system through Electron safeStorage and written only under the app's local user-data directory. If secure OS encryption is unavailable, mongoui does not save that bundle and one-click reconnect remains disabled.

After disconnect, Test DB, Connect, and the saved recent profile continue using the same encrypted TLS and proxy transport until you choose Replace settings or edit the connection. Raw documents, connection strings, certificate paths, and database credentials are never sent to an AI provider. AI is optional and configured separately with a local Ollama endpoint or your own provider key.