A useful MongoDB GUI should do more than render JSON. mongoui covers the whole operating loop: browse a collection, author a query, inspect measured evidence, compare environments, review a change, and keep a recovery path when the change writes data. AI can help plan the work, but it never receives an unrestricted shell. That distinction is the product.
Browse is the floor, not the ceiling
Browse runs bounded MongoDB find operations with filters, projections, sorts, collation, and hints. Aggregation workflows support read-only pipelines, explain plans, stage debugging, and code export. Queries, pipelines, and bulk-update drafts can be saved to the verified deployment and namespace that produced them.
Documents can be inserted, cloned, edited, replaced, or deleted through canonical Extended JSON. Exact edits reload by _id and compare the reviewed pre-image before dispatch. BSON values stay BSON values, which saves an ObjectId from returning from a text editor as a very confident string.
See document and bulk updates for the write path.
Plain English becomes a draft, not a side effect
Natural-language query generation creates a find filter, projection, and sort from your request and the selected collection's bounded structure. Pipeline drafting does the same for read-only aggregations.
Both flows place the result in the normal editor. Nothing executes automatically. mongoui rejects write stages and server-side JavaScript in generated pipelines, validates the response against a strict local contract, and allows at most one value-free correction turn when the provider returns the wrong shape.
The model does the typing. You still do the code review. Read the full natural-language query workflow.
The Operator plans against typed database tools
The AI Database Operator handles broader requests such as inspecting a collection, measuring a query plan, and preparing the next safe action. It receives only the tools available for the current connection, target, collection kind, and access mode.
Each proposed step shows its canonical operation, target, risk tier, MongoDB time budget, provider data scope, and required approval. Bounded reads run only after approval. Previewable writes must produce fresh measured evidence before the final apply action. Structural writes use the existing typed review screens.
When an initial plan contains only reads, Operator can continue once from the displayed value-free measurements. It cannot quietly feed raw query results back to the model. Changing the target, provider, model, privacy mode, connection, catalog, or collection evidence expires pending approval.
The AI Operator guide lists the current operations and approval model.
Database changes keep their own safety machinery
Single-document changes are bound to exact identity and reviewed content. Set-based updateMany and deleteMany operations run a dry run first. The preview captures the matched population, before and after evidence, operation options, and a fingerprint of the authored intent.
Changing the filter, update, collation, hint, array filters, target, or underlying evidence invalidates approval. Applied cleanups write local Activity evidence and retain exact pre-images for guarded Undo. Concurrent changes become conflicts instead of being overwritten.
The same rules apply when AI proposed the operation. There is no smaller safety system hiding behind the sparkle button.
Slow queries start with server evidence
Query Optimizer reads a real explain() plan and reports the winning stage, documents examined versus returned, index use, and actionable index candidates. Pipeline Debugger measures each prefix so the stage that expands or stalls the result becomes visible.
Profiler history reads up to 50 operations from an already-existing system.profile collection, shows the profiler state MongoDB reported, and opens supported finds or aggregations for a fresh analysis. It never enables or reconfigures profiling. MongoDB already has enough settings that can ruin a quiet afternoon.
Use the profiler history guide or the slow-query article.
Live events stay bounded and temporary
The Change Stream Monitor watches inserts, updates, replacements, and deletes on replica sets and sharded deployments. Current-document lookup for updates is explicit and off by default. The newest 200 events stay in renderer memory; events and resume tokens are never persisted.
Stop, navigation, disconnect, or window closure closes the driver stream. This is a debugger for live behavior, not a durable event-processing service. See monitoring change streams.
Exports can leave identifiers behind
Privacy Export streams canonical NDJSON while pseudonymizing, redacting, or excluding sensitive dotted field paths. A new random secret is generated for every export. Equal values remain joinable within one pseudonymized file and differ across separate exports.
Masking changes only the streamed copy. Source documents are never updated. Output uses atomic temporary files and a bounded cursor, so a canceled export does not leave a partial result pretending to be complete. The masked export guide covers the formats and rules.
Environment drift becomes reviewable evidence
Environment Compare uses a separate read-only destination connection. Collection comparison covers bounded schema inference, validators, and index definitions. Deployment comparison inventories databases and collections, reports missing namespaces and structural drift, and supports explicit mappings for renamed collections.
Recurring review profiles and baselines stay local and bind to verified deployment identities. Exported policies run in CI through native mongoui-drift executables for macOS, Windows, and Linux. Policies and reports exclude credentials, connection strings, documents, validator bodies, and migration commands.
Start with Environment Compare and move the approved policy into the deployment drift CLI.
Local-first has a precise boundary
The engine runs on your machine and connects directly to MongoDB with the official driver. Full documents, connection strings, certificate paths, and database credentials are never sent to mongoui.
AI is optional. Local explanations call no provider. Explicit AI actions send disclosed authored and structural context directly to Anthropic, OpenAI, Google Gemini, local Ollama, or a custom endpoint using your configuration. mongoui has no AI proxy, account service, or cloud control plane.
The macOS desktop builds are signed and notarized for Apple Silicon and Intel. A Windows 10 and 11 x64 installer is available unsigned, so SmartScreen may prompt. Both desktop platforms update through the verified public release feed. Downloads and SHA-256 checksums are on the download page.