Pipeline component catalog
Nexo components inspect, enforce, transform, route, or observe MongoDB traffic. A pipeline orders them by phase:
- Connection establishes the client-to-Proxy session.
- Request runs before an operation reaches MongoDB.
- Router chooses an upstream target.
- Response runs before a reply returns to the client.
:::caution Availability is release-specific
A component appearing in the dashboard, a schema, or source code does not by itself mean that an installed Nexo bundle executes it. Select the documentation version matching your installed bundle and check the availability column before deployment.
:::
Availability summary
The minimum tiers below follow the canonical Nexo pricing entitlement list. Growth has the same component set as Pro with higher limits and additional sub-features. Query Size Limit is a selectable compatibility alias of Query Guard and does not count as a separate commercial component.
| Component | Phase | Minimum tier | Next documentation | 0.2.0 bundle |
|---|---|---|---|---|
| Connection Pipeline | Connection | Free | Unavailable at runtime | Schema installed and recorded, but settings are not delivered to the runtime |
| Logging | Request + response | Free | Catalog | Reconciled and executable |
| Metrics | Request + response | Free | Catalog | Reconciled and executable |
| Index Advisor | Request + response | Free | Catalog | Schema only |
| X-Ray | Request + response | Free | Backend capability; not catalog-selectable | No dedicated CRD; not deployable |
Access Control (Filter) | Request | Free | Ineffective contract | CRD/runtime fields differ; do not rely on access enforcement |
| Query Guard | Request | Free | Catalog | Schema only |
| Query Size Limit | Request | Free | Catalog alias of Query Guard | Reconciled and executable |
| Version Compatibility | Request + response | Free | Catalog | Reconciled and executable |
| Rate Limiting | Request | Pro | Catalog | Reconciled and executable |
| Query Rewrite | Request | Pro | Catalog | Reconciled and executable |
| MongoDB Cache | Request + response | Pro | Catalog | Reconciled and executable |
| Read/Write Splitter | Router | Pro | Catalog | Schema only; router phase is not executed |
| Traffic Split | Router | Pro | Catalog | Reconciled, but the pinned Proxy does not execute the router phase |
| Shadow Traffic | Request + response | Pro | Catalog | Reconciled and executable |
| PII Masking | Response | Pro | Ineffective contract | Installed CRD has no masking fields; do not rely on data redaction |
| Audit Log | Request + response | Pro | Unavailable end to end | CRD/runtime fields differ; no supported audit evidence |
| Tenant Isolation | Router | Business | Catalog | Reconciled, but the pinned Proxy does not execute the router phase |
| Field Encryption | Request + response | Enterprise | Enterprise implementation; confirm bundle publication | Schema only |
| Change Stream Fanout | Response | No canonical entitlement | Dashboard manifest only | Unsupported |
| Geo-Routing | Router | No canonical entitlement | Dashboard manifest only | Unsupported |
| Cross-Cluster Federation | Router + response | No canonical entitlement | Dashboard manifest only | Unsupported |
| Query Replay | Request + response | No canonical entitlement | Dashboard manifest only | Unsupported |
| Intelligent Failover | Router + response | No canonical entitlement | Dashboard manifest only | Unsupported |
:::warning 0.2.0 reconciliation requirement
The pinned Proxy controller does not watch NexoTrafficSplit,
NexoTenantIsolation, NexoQuerySizeLimit, or NexoVersionCompat. After editing any
of those resources, trigger reconciliation of the owning NexoProxy through the
approved deployment workflow and verify the active graph revision.
:::
:::note Known dashboard tier-label mismatch
The canonical entitlement list above is authoritative. The current dashboard manifests still display Version Compatibility as Pro and Index Advisor, Cache, and Audit as Business, although their canonical minimum tiers are Free, Free, Pro, and Pro. Until the dashboard labels are corrected, an incorrect badge must not override the licensed entitlement decision.
:::
Dashboard-manifest-only concepts
The following built-in manifests can appear in legacy or secondary dashboard catalog surfaces, but they are absent from the canonical tier entitlement list and do not have a supported deployment contract. A visible card is not permission to deploy them.
Change Stream Fanout
Describes multiplexing one MongoDB change stream to multiple consumers with buffering, delivery guarantees, filtering, and resume-token storage. No supported Nexo bundle currently publishes it as an entitled component.
Geo-Routing
Describes selecting a MongoDB target from region, database, client, header, or user metadata for residency-aware routing. It has no canonical entitlement or supported runtime contract.
Cross-Cluster Federation
Describes presenting databases or collections across multiple MongoDB clusters as a logical federation, with optional cross-cluster aggregation and failover. It is not a published Nexo component.
Query Replay
Describes recording sampled production traffic and replaying or comparing it against a test target for migration validation. Recording may contain sensitive customer data; no supported bundle publishes this component.
Intelligent Failover
Describes health-scored multi-cluster traffic shifting and failback. It has no canonical entitlement, and no released runtime contract should be inferred from the dashboard manifest.
Marketplace entries
The dashboard code contains sample marketplace cards for community plugins. Private Preview does not publish a supported live plugin marketplace or guarantee those sample artifacts. Treat only bundle-pinned, signed, approved plugins as deployable components.
| Sample card | Intended concept | Private Preview status |
|---|---|---|
| Field Trimmer | Remove configured response fields | Sample only |
| Timestamp Injector | Add request/response timestamps | Sample only |
| Mock Responses | Return synthetic responses for testing | Sample only |
| Chaos Monkey | Inject latency and faults | Sample only |
| Slack Alert | Send query or policy alerts to Slack | Sample only |
| S3 Query Archive | Archive sampled query payloads | Sample only |
| PagerDuty Incident | Escalate policy or deployment failures | Sample only |
| Elasticsearch Sync | Stream query events to Elasticsearch | Sample only |