Right now, db.collection.copyTo is implemented in as a shell helper which runs a server side javascript method. This serverside feature is nice, since it eliminates network hops to and from the client for each document. However, this implementation suffers the problem using eval(), which in any situation with auth enabled, requires permissions that we actively advise not giving anybody.

Instead, what if there was a proper command on the server for this? We have several options for copying from another host, so it would seem to fit in. Once it exists, copyTo could be reimplemented to call the command, without the need for eval.