Labsco
confluentinc logo

Confluent Cloud

✓ Official★ 163

from confluentinc

Interact with Confluent Cloud REST APIs to manage Kafka clusters, topics, and data.

🔥🔥🔥🔥✓ VerifiedFreeAdvanced setup
#automation#payments#database#cloud#devops#git#security

Confluent MCP Server

npm version License: MIT

An open-source MCP server that enables AI assistants to interact with Confluent Cloud, Confluent Platform, and standalone Apache Kafka deployments through natural language. It provides 50+ tools across Kafka, Flink SQL, Schema Registry, Connectors, Tableflow, and more -- usable from any MCP-compatible client including Claude Desktop, Claude Code, Cursor, VS Code, Goose, and Gemini CLI.

[!TIP] Already a Confluent Cloud customer? Confluent offers a fully managed MCP server with no local server to run and no dependencies to install. It provides access to your Confluent Cloud resources with AI-powered connector diagnostics, governed by your existing RBAC permissions. Use this open-source server if you need Confluent Platform / self-managed Kafka support, or want to customize and extend the toolset.

Table of Contents

Available Tools

Tools are auto-enabled based on which service blocks are present in your resolved configuration; see CONFIGURATION.md for the full block-to-tool mapping.

You can list all available tools via the CLI:

Copy & paste — that's it
npx -y @confluentinc/mcp-confluent --list-tools

Always-Available Tools

These tools need no service blocks or authentication — they're enabled even on a bare config, regardless of which deployment the rest of your config targets.

CategoryToolsDescription
Documentationsearch-product-docs, get-product-doc-pageSearch Confluent product docs and fetch full page content
Diagnosticsexplain-disabled-tools, list-configured-connections, config-help, describe-configured-connectionExplain why tools are absent, list configured connections and the tools enabled on each, suggest the YAML to enable a specific tool, and describe one connection's config and tool availability

Available Tools for Confluent Cloud

These tools require endpoints and authentication against specific Confluent Cloud components. Refer to config.example.yaml for the full set of configuration variables. Categories marked with ¹ also work with OAuth authentication — sign in via your browser instead of provisioning API keys.

CategoryToolsDescription
Kafka ¹list-topics, create-topics, delete-topics, produce-message, consume-messages, list-consumer-groups, describe-consumer-group, get-consumer-group-lag, alter-topic-config, get-topic-configManage topics, produce/consume messages, inspect consumer groups, configure topic settings
Flink SQL ¹create-flink-statement, list-flink-statements, get-flink-statement-results, delete-flink-statements, get-flink-statement-exceptions, list-compute-poolsCreate and manage Flink SQL statements; discover Flink compute pools
Flink Catalog ¹list-flink-catalogs, list-flink-databases, list-flink-tables, describe-flink-table, get-flink-table-infoExplore Flink catalogs, databases, and table schemas
Flink Diagnostics ¹check-flink-statement-health, detect-flink-statement-issues, get-flink-statement-profileHealth checks, issue detection, and query profiling
Connectors ¹list-connectors, get-connector-config, get-connector-offsets, get-connector-status, get-connector-tasks, get-connector-error-summary, get-connector-error-recommendations, get-connector-logs, create-connector ², delete-connector, pause-connector, resume-connector, restart-connector, update-connector-configInspect and manage Kafka Connect connectors
Schema Registry ¹list-schemas, create-schema, delete-schemaList, inspect, create, and delete data schemas
Catalog & Tags ¹search-topics-by-tag, search-topics-by-name, create-topic-tags, delete-tag, remove-tag-from-entity, add-tags-to-topic, list-tagsOrganize and search topics using tags
Organizations, Environments & Clusters ¹list-organizations, list-environments, read-environment, list-clustersDiscover Confluent Cloud resources
Tableflow ¹create-tableflow-topic, list-tableflow-topics, read-tableflow-topic, update-tableflow-topic, delete-tableflow-topic, list-tableflow-regionsManage Tableflow-enabled topics
Tableflow Catalog ¹create-tableflow-catalog-integration, list-tableflow-catalog-integrations, read-tableflow-catalog-integration, update-tableflow-catalog-integration, delete-tableflow-catalog-integrationManage Tableflow catalog integrations (e.g., AWS Glue)
Metrics ¹list-available-metrics, query-metricsDiscover and query Confluent Cloud operational metrics
Billing ¹list-billing-costsQuery billing and cost data

¹ Also available under OAuth — see OAuth Authentication for Confluent Cloud for setup and caveats. Categories not marked currently require a direct connection with static API keys; OAuth migration is in progress.

² Individual tool not available under OAuth; requires a direct connection with static API keys.

Available Tools for local deployments

These tools only require Kafka or Schema Registry endpoints - no Confluent Cloud API key/secret is needed. Ideal for local development with self-managed clusters, including Confluent Platform.

Copy & paste — that's it
# minimal config.yaml for local development
connections:
  local:
    type: direct
    kafka:
      bootstrap_servers: "localhost:9092"
    schema_registry:
      endpoint: "http://localhost:8081"

Ready-to-use variants live in sample_configs/.

CategoryToolsDescription
Kafkalist-topics, create-topics, delete-topics, produce-message, consume-messages, list-consumer-groups, describe-consumer-group, get-consumer-group-lagManage topics, produce/consume messages, inspect consumer groups
Schema Registrylist-schemas, create-schema, delete-schemaList, inspect, create, and delete data schemas

Using with Confluent Platform

mcp-confluent runs against a self-managed Confluent Platform (CP) cluster the same way it runs against any local Kafka + Schema Registry deployment: point a direct connection at your brokers and Schema Registry. A CP connection exposes the same tools as any other local deployment — see Available Tools for local deployments. The Confluent Cloud tools (Flink, Tableflow, Billing, Metrics, and the rest) require a Confluent Cloud account and stay disabled on CP. The only differences from a localhost:9092 setup are authentication and TLS.

Sample YAML config

sample_configs/confluent-platform.yaml is a copy-pasteable starter. It assumes PLAIN over SASL_SSL for Kafka and HTTP Basic Auth for Schema Registry. Customize the broker and Schema Registry URLs, and inject credentials via the ${KAFKA_API_KEY} / ${KAFKA_API_SECRET} / ${SCHEMA_REGISTRY_API_KEY} / ${SCHEMA_REGISTRY_API_SECRET} environment variables. If your cluster uses SCRAM or another SASL mechanism, override security.protocol and sasl.mechanisms through the kafka.extra_properties map in that file.

TLS trust (internal CAs)

CP clusters frequently sit behind an internal CA. If you see TLS handshake failures against the broker or Schema Registry, point Node at your CA bundle when starting the server:

Copy & paste — that's it
NODE_EXTRA_CA_CERTS=/path/to/internal-ca.pem pnpm run start -- --config path/to/config.yaml

End-to-end smoke test

A docker-compose stack (docker-compose.cp-test.yml) brings up a local CP Kafka (KRaft, SASL_PLAINTEXT/PLAIN) plus an unauthenticated Schema Registry. The matching integration tests are tagged @cp and live next to their handlers as *.cp.integration.test.ts:

Copy & paste — that's it
docker compose -f docker-compose.cp-test.yml up -d
# Wait ~30s for Kafka + SR to become ready, then:
CP_KAFKA_USERNAME=mcp CP_KAFKA_PASSWORD=mcp-secret \
  pnpm run test:integration --tags-filter=@cp
docker compose -f docker-compose.cp-test.yml down -v

The tests skip cleanly when those env vars are unset, so pnpm run test:unit and a default pnpm run test:integration against your real Confluent Cloud account are unaffected if you don't have the docker stack running.

OAuth Authentication for Confluent Cloud

The MCP server can authenticate to Confluent Cloud via OAuth (PKCE) instead of static API keys. On the first tool call that needs Confluent access, the server opens your browser to the Confluent Cloud sign-in page; subsequent tool calls reuse the resulting session. No API keys to provision.

Setup

Copy & paste — that's it
npx @confluentinc/mcp-confluent --init-oauth-config
# edit ./config.yaml if needed, then:
npx @confluentinc/mcp-confluent --config ./config.yaml

--init-oauth-config drops a starter config.oauth.example.yaml into ./config.yaml. The whole file is essentially:

Copy & paste — that's it
connections:
  ccloud-oauth:
    type: oauth

See CONFIGURATION.md → Authentication modes for the full schema and ergonomics.

The ¹-marked categories in Available Tools for Confluent Cloud work under OAuth today; everything else still needs a direct connection with static API keys.

Telemetry

This MCP server collects usage data to help make improvements. You can opt out by setting DO_NOT_TRACK=true in your environment. See telemetry.md for full details on what is collected.

Contributing

Bug reports and feedback is appreciated in the form of Github Issues. For guidelines on contributing please see CONTRIBUTING.md

Pre-release testing

To run the MCP server against a pre-release version for beta testing or early feedback, download the release tarball file to a local directory. Then, when running any of the npx commands above, replace @confluentinc/mcp-confluent with the path to that tarball, e.g. npx @~path/to/my/tarball --list-tools