Summary

The whole Aiven platform, with the switches you will want to set before connecting it.

This reaches a long way — creating services, producing into Kafka topics, running write SQL against PostgreSQL, deploying an application from a GitHub branch — so the interesting configuration is what you turn off. Read-only mode leaves only reads, a write allowlist re-opens exactly the ones you meant, and the secrets flag decides whether connection strings and passwords ever enter the conversation at all. Beneath all of that, the permissions of the account you authenticate as are the boundary that actually holds.

What it is

Aiven's server for its managed data platform, hosted at mcp.aiven.live or run locally over stdio. It covers projects and services, Kafka topics, Connect and Schema Registry, PostgreSQL including read and write queries, service integrations, and deploying Dockerised applications.

What you get

Projects, services, clouds, plans and hourly plan pricing all listed before you commit to a shape
Services created, updated in plan, cloud, configuration or power state, inspected, and their logs, metrics and current query activity read
Kafka topics listed, created with explicit partitions and replication, updated and deleted, with messages consumed and produced through the Kafka REST API
Kafka Connect connectors listed, created, edited, paused, resumed, restarted and deleted, with their runtime status checked
Schema Registry subjects listed and a specific subject version read
PostgreSQL queried read-only or with writes, its available extensions and query statistics read, PgBouncer pools created and tuned, and a slow query optimised through EverSQL
Service integrations created between two services or to an external endpoint, then updated, listed and deleted — with the valid integration and endpoint types enumerated first
A Dockerised application deployed from a GitHub repository and branch and redeployed after a push, with the connected VCS accounts and their repositories listed
Project event logs and the project's VPCs

Requirements

An Aiven account. The hosted route is https://mcp.aiven.live/mcp, where your client authorises with Aiven and sends the token as a bearer, with read_only, services_scope and allow_secrets as query parameters and /aws, /azure or /gcp path segments for marketplace subscriptions. Locally it is npx -y mcp-aiven on Node.js 18 or newer with an AIVEN_TOKEN created at console.aiven.io/profile/tokens. Three settings are worth deciding before you connect: AIVEN_READ_ONLY exposes reads only, AIVEN_WRITE_ALLOWLIST re-enables named write tools inside that, and AIVEN_ALLOW_SECRETS decides whether the connection-info tool returns live credentials or [REDACTED]. AIVEN_SERVICES_SCOPE narrows the surface to core, pg, kafka, application or integrations. Everything the tools can do is bounded by the Aiven permissions of the account you authenticate as — which includes dropping databases and deleting services.

Setup effort

One command plus a key — npx -y mcp-aiven, then supply credentials