Kong Admin API — MCP Server

An MCP server that exposes the full Kong Gateway Admin API (Enterprise & OSS) as tools an AI assistant can call. Configure it with your Admin API URL and admin token, and the assistant can manage services, routes, consumers, plugins, upstreams, certificates, RBAC, workspaces — anything the Admin API can do.

Built against the Kong Gateway Admin EE API 3.14.

What it can do

Every Admin API action is reachable. There are ergonomic CRUD tools for the standard entities plus a universal escape-hatch tool for everything else (nested resources, RBAC, keyring, schemas, declarative config, future endpoints).

The entity argument accepts plain names (services, routes, consumers, plugins, upstreams, certificates, ca_certificates, snis, vaults, consumer_groups, …) and nested collection paths (upstreams/<id>/targets, services/<id>/routes, consumers/<id>/key-auth, rbac/roles, …).

Related MCP server: openapi-mcp-bridge

Install & build

cd kong-mcp
npm install      # also builds to dist/
npm run build    # rebuild after edits

Configuration

The connection is set via environment variables (see .env.example):

You can also change the URL / token / workspace at runtime by asking the assistant to use the kong_configure tool — handy for switching between environments in one session.

Wiring it into an MCP client

Claude Code

claude mcp add kong \
  --env KONG_ADMIN_URL=http://localhost:8001 \
  --env KONG_ADMIN_TOKEN=your-rbac-token \
  -- node /Users/monochong/Desktop/kong-mcp/dist/index.js

Claude Desktop / generic mcp.json

{
  "mcpServers": {
    "kong": {
      "command": "node",
      "args": ["/Users/monochong/Desktop/kong-mcp/dist/index.js"],
      "env": {
        "KONG_ADMIN_URL": "http://localhost:8001",
        "KONG_ADMIN_TOKEN": "your-rbac-token",
        "KONG_WORKSPACE": "default"
      }
    }
  }
}

Restart the client after adding the server.

Example prompts

• "List all services, then show the routes for the one named web-api."

• "Create a service httpbin pointing at http://httpbin.org, add a route on /get, then enable the rate-limiting plugin at 100 req/min."

• "Show me the config schema for the jwt plugin."

• "Create a consumer alice and a key-auth credential for her."

• "Switch to the staging workspace and list its plugins." (uses kong_configure)

• "What Kong version is running and is the database reachable?"

Notes

• The token is masked anywhere config is displayed.

• List endpoints follow Kong's offset-based pagination; pass fetch_all: true to collect every page.

• For DB-less / declarative config, use kong_request with POST /config.

• Auth failures (401/403) and unreachable endpoints return clear, actionable error messages.

Development

npm run dev      # run from TypeScript source via tsx
npm run watch    # tsc --watch

License

MIT