need to verify this behavior with the legacy tools, but -
if the authenticationMechanism is x509 (this applies to others too perhaps?), the tool could just assume that authenticationDatabase is $external since there's no other possible value that makes sense with x509.

Also, --authenticationDatabase is treated as a required param in mongostat and mongotop, but if x509 is being used, it shouldn't be required.