Fix LangChain's 'authorizedCollections is not supported' on Firestore

TL;DR: LangChain's MongoDBDatabaseToolkit crashes on Firestore because it calls list_collection_names(authorizedCollections=True), which Firestore's MongoDB-compatible endpoint rejects; patch database.py to retry without the flag until PR langchain-mongodb#363 ships.

The error fires the moment you build the toolkit - inside MongoDBDatabaseToolkit(db=db, llm=llm).get_tools() - not when the agent runs a query, which is why most debugging time goes to the connection string, SCRAM auth, or loadBalanced=true instead of the real cause. The crash is tracked in langchain issue #36609 and reproduces on LangChain 1.2.15 with langchain-mongodb 0.11.0 and PyMongo 4.16.0 against a Firestore URI such as mongodb://<user>:<pass>@<project>.us-central1.firestore.goog:443/?loadBalanced=true&tls=true&authMechanism=SCRAM-SHA-256&retryWrites=false. If you hit a different LangChain failure on the same project, the Automation Error Index catalogs each one with a verified fix.

Why does "authorizedCollections is not supported" happen?

authorizedCollections is a MongoDB option on the listCollections command that, combined with nameOnly: true, limits the result to collections the user has privileges to read. PyMongo exposes it as list_collection_names(authorizedCollections=True). Firestore's MongoDB-compatible API implements a subset of the Mongo wire protocol and rejects that option outright, returning {'ok': 0.0, 'errmsg': 'authorizedCollections is not supported', 'code': 2, 'codeName': 'InvalidArgument'}.

The toolkit calls it during construction. In langchain_mongodb/agent_toolkit/database.py, MongoDBDatabase.__init__ runs self._db.list_collection_names(authorizedCollections=True) to enumerate tables for the agent, so the failure lands before the agent ever sends a query. The same authorizedCollections=True call appears in four other files in the repo (cache.py, graphrag/graph.py, the LangGraph MongoDB store, and tests/utils.py); the agent toolkit is simply the first one most users hit.

How do you fix the authorizedCollections error?

Two local fixes work while PR langchain-mongodb#363 waits to merge. The fix shape, from the confirmed fix comment on issue #36609, is to try the authorized call first and fall back to a plain call only for the Firestore-specific failure:

from pymongo.errors import OperationFailure

try:
    names = db.list_collection_names(authorizedCollections=True)
except OperationFailure as e:
    # Firestore's compatible endpoint rejects the option;
    # re-raise every other OperationFailure so real auth/server
    # errors are not swallowed.
    if "authorizedCollections is not supported" in str(e):
        names = db.list_collection_names()
    else:
        raise

1. Patch database.py inline. If you can't install from a fork, edit libs/langchain-mongodb/langchain_mongodb/agent_toolkit/database.py in your installed package and wrap the list_collection_names(authorizedCollections=True) call at line 61 with the try/except above. Vendor the file or re-pin the package so a later pip install --upgrade doesn't silently revert the edit.

Install from the PR fork. The cleanest path is to pull the fix branch directly so you don't edit site-packages:

pip install git+https://github.com/daletyler1737/langchain-mongodb.git@fix/mongodb-firestore-authorizedCollections

This replaces your 0.11.0 install with the patched build and holds until the PR merges upstream.

The matching condition matters: catch only the Firestore authorizedCollections message and re-raise everything else. A bare except OperationFailure: pass would hide real authentication failures, wrong database names, and server errors, the exact class of bug that makes intermittent agent failures hard to trace. The same careful-retry pattern is what you want whenever you handle errors in LangChain tools: surface the recoverable case, propagate the rest.

How do you verify the fix worked?

After applying the patch, construct the toolkit and list its tools. Both calls must return without raising:

db = MongoDBDatabase.from_connection_string(MONGO_URI, database=DB_NAME)
toolkit = MongoDBDatabaseToolkit(db=db, llm=llm)
print([t.name for t in toolkit.get_tools()])
# Expect: ['list-mongodb-collections', 'query-mongodb-data', ...]

If get_tools() returns the tool list, the enumeration fell back to the plain list_collection_names() call and the agent can now run read-only queries against the Firestore-backed database. Confirm with one query-mongodb-data call from the agent; a successful rows-back result is the end-to-end check.

What if the fix didn't work?

If you still see authorizedCollections is not supported after patching, the toolkit is importing a second copy of langchain-mongodb (common in notebooks and Docker images with layered requirements). Run python -c "import langchain_mongodb; print(langchain_mongodb.__file__)" and confirm the printed path is the one you patched. The code lives in the companion langchain-ai/langchain-mongodb repo, not the main langchain-ai/langchain monorepo, so editing the wrong copy is the most common reason a patch appears to do nothing.

A different OperationFailure (wrong auth mechanism, missing role, loadBalanced mismatch) means the fallback path is working and the remaining problem is the connection itself. For unrelated agent-runtime failures, an agent that picks a tool but never calls it, or one that stalls on a fixed iteration count, see the guides on AgentExecutor not calling tools and the broader LangChain vs LangGraph runtime split.

FAQ

What does "authorizedCollections is not supported" actually mean?

It means the server you're connected to doesn't implement the authorizedCollections option on the listCollections command. Real MongoDB supports it so users see only collections they can read; Firestore's MongoDB-compatible API enforces authorization differently and rejects the option with codeName: InvalidArgument.

Why does MongoDBDatabaseToolkit fail on Firestore but not on real MongoDB?

The toolkit calls list_collection_names(authorizedCollections=True) at construction. Real MongoDB accepts the option; Firestore's compatible endpoint implements a subset of the wire protocol and rejects it. The toolkit has no fallback, so the call raises before the agent starts.

Does the patch hide real authentication errors?

No, only if written loosely. The correct patch matches the Firestore-specific authorizedCollections is not supported message and re-raises every other OperationFailure. A bare except OperationFailure: pass would hide auth and server errors, so don't use it.

Is the fix released in langchain-mongodb yet?

No. As of langchain-mongodb 0.11.0, the latest release on PyPI, PR langchain-mongodb#363 is still open. Install from the PR fork or patch database.py locally until a new release ships.

Where do I apply the patch, the monorepo or langchain-mongodb?

The companion langchain-ai/langchain-mongodb repo. The toolkit moved out of the main monorepo, so edits to langchain/ in site-packages do nothing. The file lives at libs/langchain-mongodb/langchain_mongodb/agent_toolkit/database.py.

Do other langchain-mongodb files hit the same error?

Yes. authorizedCollections=True also appears in cache.py, graphrag/graph.py, and the LangGraph MongoDB store. If you use those paths against Firestore, apply the same try/except fallback. The agent toolkit is just the first one most users hit because construction is mandatory.