Agent report card
Can an agent use MongoDB Atlas Administration API through Cluster lifecycle?
Five-stage assessment
Where agent autonomy holds and where it breaks
- EvaluateReady
- Sign upLimited
- PayLimited
- ProvisionLimited
- OperateLimited
The exact service and stable evaluation or access entrypoints are publicly discoverable.
The exact service and its stable RESTful administrative endpoints are discoverable via the Atlas Administration API Reference documentation.
Applicable terms are stable, readable, retrievable, and materially complete.
Eligibility conditions and required inputs are explicit and decidable.
Price or no-charge status, variables, currency, and material conditions are explicit.
Verified structured artifacts accelerate discovery of the evaluation surface.
Web-agent access policy is explicit and verified for the assessed resources.
Evidence and actions6 signals
Can an agent decide every material eligibility condition before commitment?
supported: freshEligibility conditions and required inputs are explicit and decidable.
The MongoDB Cloud Terms of Service explicitly states that users must agree to the agreement, represent and warrant that they are authorized if acting on behalf of an organization, and comply with all applicable laws, rules, and regulations when using Cloud Services.
Can an agent estimate cost or confirm no-charge status before commitment?
supported: freshPrice or no-charge status, variables, currency, and material conditions are explicit.
MongoDB Atlas pricing explicitly outlines hardware configuration rates per hour (e.g., $3.95/hr for M80), Flex Cluster tier rates based on ops/second (from $0.0110/hr), and usage variables including compute, storage, region, and data transfer.
Can an agent find the exact service and its stable entrypoints?
supported: freshThe exact service and stable evaluation or access entrypoints are publicly discoverable.
The exact service and its stable RESTful administrative endpoints are discoverable via the Atlas Administration API Reference documentation.
Are verified structured discovery artifacts available?
supported: freshVerified structured artifacts accelerate discovery of the evaluation surface.
Documentation provides an explicit documentation index for AI agents at https://www.mongodb.com/docs/llms.txt and offers markdown versions of all pages by appending .md to any URL path.
Can an agent retrieve and understand the applicable commitment terms?
supported: freshApplicable terms are stable, readable, retrievable, and materially complete.
The MongoDB Cloud Terms of Service provides stable, readable, and retrievable commitment terms governing the use of MongoDB Cloud Services.
Does the vendor deliberately describe access for web agents?
supported: freshWeb-agent access policy is explicit and verified for the assessed resources.
The documentation resource metadata explicitly declares robots indexing ('robots: index') for the assessed public reference resources.
Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
Service accounts provide OAuth 2.0 client credentials access tokens with roles and token revocation, but require initial manual setup in the organization/project.
A stable canonical route begins the required access bootstrap.
Evidence and actions5 signals
Can an agent operate the access controls and safe handoffs deterministically?
supported: freshCurrent admissible evidence does not resolve this finding.
The captured registration page endpoint provides only basic viewport metadata and page titles, leaving access control operability unresolved.
Is there a stable route to begin obtaining service access?
supported: freshA stable canonical route begins the required access bootstrap.
Documentation explicitly provides a canonical path to get started with MongoDB Atlas by registering a new account using email, GitHub, or Google credentials.
Can an agent obtain access without an unsupported CAPTCHA boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence across evaluated targets does not explicitly declare whether CAPTCHA challenges are required or provide a verified-agent alternative.
Can an agent obtain scoped, revocable authority for this service?
supported: freshMachine credentials exist but require manual copying, broad authority, or weak lifecycle support.
Service accounts provide OAuth 2.0 client credentials access tokens with roles and token revocation, but require initial manual setup in the organization/project.
Can required phone verification be completed through a supported boundary?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained evidence does not contain explicit declarations or observations regarding phone verification requirements.
What would improve this stage
- Provide scoped delegated authorization with consent, revocation, and deterministic resumption.
The public commitment omits a material component until later in the flow.
The pricing schedule discloses base cluster rates, billing frequencies (hourly with monthly invoices, or monthly rates), and USD pricing for MongoDB Atlas. However, actual pricing depends on deployment requirements, configurations, and location, leaving certain cost components contextual until configuration.
Self-service is tier- or condition-limited, or a bounded vendor review exposes status.
Evidence and actions4 signals
Can an agent construct checkout, hand off approval safely, and resume?
supported: freshCurrent admissible evidence does not resolve this finding.
Retained evidence describes billing configuration and supported payment methods, but does not document an end-to-end API or web flow for deterministic checkout construction, approval handoff, and resumption.
Is the exact commercial commitment disclosed before authorization?
supported: freshThe public commitment omits a material component until later in the flow.
The pricing schedule discloses base cluster rates, billing frequencies (hourly with monthly invoices, or monthly rates), and USD pricing for MongoDB Atlas. However, actual pricing depends on deployment requirements, configurations, and location, leaving certain cost components contextual until configuration.
Can payment be authorized within scoped agent or explicit human authority?
supported: freshCurrent admissible evidence does not resolve this finding.
Documentation lists accepted payment methods in the Atlas console (such as Card, PayPal, and bank accounts), but does not detail a rail for scoped agent delegation or explicit human-confirmed payment authorization with receipt clauses.
Is a direct self-service path to paid access documented?
supported: freshSelf-service is tier- or condition-limited, or a bounded vendor review exposes status.
MongoDB Atlas supports self-service payment via accepted payment methods in the console, but purchasing a subscription or reviewing alternative billing methods is conditioned on contacting MongoDB Sales or buying through a marketplace.
What would improve this stage
- Disclose the complete commitment before payment authorization.
- Document a direct purchase path or bounded vendor review with machine-readable status.
Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Cluster creation returns a stateName field indicating control plane activity (IDLE, CREATING, UPDATING, DELETING). State CREATING indicates a cluster being provisioned for the first time until ready. Admitted evidence does not establish asynchronous failure reconciliation or time bounds.
Provisioning is machine-triggerable or follows deterministically from an allowed handoff.
Credentials, grants, or configuration are delivered through a documented agent-usable flow.
Evidence and actions3 signals
Can usable access material be delivered securely to an authorized agent?
supported: freshCredentials, grants, or configuration are delivered through a documented agent-usable flow.
Atlas Administration API authentication supports OAuth 2.0 Client Credentials flow using service accounts. A service account provides a client ID and rotatable secret to generate 1-hour access tokens for API requests.
Can an agent determine successful provisioning completion and reconcile asynchronous failure?
supported: freshCompletion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
Cluster creation returns a stateName field indicating control plane activity (IDLE, CREATING, UPDATING, DELETING). State CREATING indicates a cluster being provisioned for the first time until ready. Admitted evidence does not establish asynchronous failure reconciliation or time bounds.
Can provisioning be initiated within supported agent authority?
supported: freshProvisioning is machine-triggerable or follows deterministically from an allowed handoff.
Cluster provisioning can be initiated via HTTP POST request to create one cluster in a project, returning a 201 Created response.
What would improve this stage
- Expose bounded machine-readable terminal status and reconciliation semantics.
Safe failure handling is documented only partially.
Atlas Administration API documents error response codes (such as 400, 409, 410, 429 RATE_LIMITED, and 500) and rate limit parameters, but the retained text does not establish explicit idempotency, cancellation, or reconciliation semantics.
Every essential target has a stable documented agent-usable interface alternative.
Request-time authentication is documented and usable under scoped agent authority.
Essential operations have stable readable request, response, and effect semantics.
Credential lifecycle and recovery are documented and executable within delegated authority.
Evidence and actions6 signals
Is an agent-native protocol interface verified against the essential targets?
supported: freshCurrent admissible evidence does not resolve this finding.
The retained excerpts describe REST or RPC interfaces, SDKs and CLIs for MongoDB Atlas Administration API; they contain no first-party statement that an agent-native protocol interface is absent, and several navigation excerpts mention MCP resources without establishing coverage of the assessed targets.
- cluster-api
Can an agent manage credential expiry, rotation, revocation, compromise, and recovery?
supported: freshCredential lifecycle and recovery are documented and executable within delegated authority.
The documentation specifies credential lifecycle management for service accounts, including client ID and rotatable secret generation, token creation with 1-hour expiration, token generation near expiry, and token revocation when access is no longer needed.
Can an agent handle applicable failure modes safely?
supported: freshSafe failure handling is documented only partially.
Atlas Administration API documents error response codes (such as 400, 409, 410, 429 RATE_LIMITED, and 500) and rate limit parameters, but the retained text does not establish explicit idempotency, cancellation, or reconciliation semantics.
Can an agent authenticate service operations with scoped authority?
supported: freshRequest-time authentication is documented and usable under scoped agent authority.
Requests to the Atlas Administration API are authenticated using scoped service account access tokens (OAuth 2.0 Client Credentials flow) or legacy API keys with HTTP Digest Authentication, with permissions bounded by assigned Atlas roles.
Are essential operation inputs, outputs, and effects stable and decidable?
supported: freshEssential operations have stable readable request, response, and effect semantics.
The essential operation targets detail HTTP methods, JSON request and response entity formats, explicit error JSON schemas, rate limit headers and error parameters, and OpenAPI endpoint specifications for cluster and service management.
- cluster-api
Can an agent perform every essential assessment target through a usable interface?
supported: freshEvery essential target has a stable documented agent-usable interface alternative.
The MongoDB Atlas Administration API provides programmatic RESTful HTTP interfaces covering errors, administration API references, cluster management operations, and rate limits.
- cluster-api
What would improve this stage
- Document applicable structured errors, retry, cancellation, and reconciliation semantics.
What works
- Evaluate: The exact service and stable evaluation or access entrypoints are publicly discoverable.
What blocks agents
No stage is established as blocked.
Where autonomy is limited
- Sign up: Machine credentials exist but require manual copying, broad authority, or weak lifecycle support.
- Pay: The public commitment omits a material component until later in the flow.
- Provision: Completion is observable, but an asynchronous path omits a material terminal, bound, or reconciliation property.
- Operate: Safe failure handling is documented only partially.
What this grade establishes
14 of 14 graded signals have current supporting evidence. 0 of 5 additional barrier checks are verified.Unknown checks are not a pass or a confirmed blocker. This report is not proof of an end-to-end purchase or service session.
How the grade is derived
A through C grades count Limited stages; D and F reflect Blocked stages by lifecycle severity.
Coverage is complete only when every graded signal has supported, fresh, non-conflicting evidence. Barrier and informational signals do not change coverage; only fresh, supported barrier values that passed their admission evidence rule participate in stage outcomes.
Each stage takes its worst graded signal or verified barrier. A fresh, supported mandatory barrier that passed its admission evidence rule can block that stage; incomplete or stale barrier evidence remains context only. The overall grade is derived from the five stage states.
Startup offers
MongoDB on the startup-offers board
- MongoDB Atlas creditsMongoDB for Startups
Distribution
The grade’s badge
One stable image resolving the record’s current live facts, linking to the canonical page. Embed it once; it keeps itself current. Placement is never evidence and never affects rank.
[](https://sourcey.com/log/mongodb/agent-readiness/mongodb-atlas-api/cluster-lifecycle)Improve the report
Correct it, rerun it, or improve the funnel.
- Profile
- arp_01kzf0m4xb4p2kv9d7n6ts3c8y
- Projection
- sha256:3b336b8f3380da8cdce18ad49903d9eefde910f21239b1fa6cda0e39929d9f99
- Policy
- service-use-2026-09-07-blocking-barriers-r12 · sha256:fc9e8f046d86fcf19ab2f1bc547219e503cdc11ffa135d020db7285965cd7d1d
Every request carries these exact identifiers.How report cards are assessed →View the exact declaration