fix: prevent $out and $merge stages when create/update/delete operations are disabled MCP-196

[nirinchev]

Proposed changes

This expands on the earlier validation to also include disabled tools in the check so that users who don't run the server in readonly mode but have explicitly disabled create, update, or delete operations do not accidentally run aggregations with $out or $merge stages.

[Copilot]

Pull Request Overview

This PR prevents MongoDB $out and $merge aggregation stages when individual write operations (create, update, delete) are disabled, expanding beyond the existing readonly mode check. This ensures users who selectively disable write operations cannot accidentally run aggregations that would perform writes.

• Expanded validation logic to check for disabled write operations in addition to readonly mode
• Added comprehensive test coverage for all three disabled operation types with both $out and $merge stages
• Updated error messaging to reflect the new validation scenarios

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/tools/mongodb/read/aggregate.ts	Enhanced validation to prevent write stages when individual operations are disabled
tests/integration/tools/mongodb/read/aggregate.test.ts	Added test coverage for disabled operations validation with cleanup

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}