Countersign is an MCP server that sits between AI agents and MongoDB Atlas. Agents never write to the database directly. Every change becomes a proposal: Countersign checks who is asking (the agent and the person it acts for), validates the query, and dry-runs it to find the exact records it would touch. Routine changes are applied automatically. Risky ones (bulk updates, deletes, sensitive fields, refunds over a limit, or anything unlike past approved changes) wait in an approval inbox where a different person sees a before-and-after diff. Dangerous ones are blocked outright. Applied changes run in a single Atlas transaction that re-checks every record's version, saves a copy of each document, and verifies only the declared fields changed. Any change can be undone in one click. Every decision goes into a SHA-256 hash-chained audit log that the service's own database user can only append to. An emergency stop cuts off every agent instantly, and planted canary records freeze a hijacked agent. It works with Claude Code, Claude Desktop, claude.ai, Cursor, VS Code and ChatGPT using one key. People sign in with GitHub, and agent keys are requested, approved by someone else, and shown once. We red-teamed it with 12 attacks (prompt injection, bulk delete, privilege escalation, writes hidden in reads, cross-tenant joins, approval tampering, replay, race conditions, ledger tampering). Against plain MongoDB access all 12 succeed. Through Countersign all 12 are blocked. Live: https://countersign-production-d0c9345e.up.railway.app Try it as an approver: https://countersign-production-d0c9345e.up.railway.app/app?demo=bob
Team
