New MCP Server is on by default

[OzoneChris]

Question

I received a popup from the latest update informing me the new MCP server was on by default. From my reading of it, it will start automatically and connects to the active connection.

Is this a sensible default from a security perspective?

Particularly with "mdb.mcp.readOnly": false being the default, this feels like existing users of the extension, with preconfigured connections are suddenly getting a new risk avenue open that they may not fully understand.

Additional context

New MCP changes were merged with #1115

[himanshusinghs]

Hey @OzoneChris, thanks for raising this concern! We discussed it internally and decided to flip the switch and keep the MCP server off by default, with possibility to enable the auto-start. When started it will start with readOnly mode by default. We’ll have a PR up soon to address this.

[himanshusinghs]

Hey @OzoneChris We've just published v1.14.1 that addresses your concerns. Please feel free to take a look at #1132 for detailed information on the changes.

[OzoneChris]

Thats awesome, the new defaults look much more sensible. Appreciate you taking a second look at it.