The CLI tools (mongo, mongodump, mongorestore, etc) should look for the specific environment variables MONGODB_USERNAME and MONGODB_PASSWORD and authenticate to the database using that credential. If only MONGODB_PASSWORD is given in the environment variables, the CLI tools should use the username passed in on the command line and replace the password passed in on the command line and use the password from the environment variable instead.

export MONGODB_USERNAME="my-mongodb-username"
export MONGODB_PASSWORD="my-mongodb-password"

host="example.com"
port="27017"
db="my-pile-of-data"

mongo $host:$port/$db --quiet ~/some-advanced-mongo-script.js

This way the username/password will never show up in the command-line of a process.