Backstage MCP Server: Let AI Query Your Developer Portal

Why Give AI Access to Backstage?

Backstage is the CNCF-incubating developer portal that thousands of engineering teams use to catalog services, track ownership, and host TechDocs. When you need to find who owns a service, check its deployment status, or read documentation for an internal API, you navigate to the Backstage UI and search manually.

An MCP server for Backstage lets your AI agent query the software catalog, look up service ownership, read TechDocs, and check component health directly from Claude, Cursor, or Windsurf.

What Becomes Possible

Once your AI agent has Backstage access:

• "Who owns the payments-service?"
• "What APIs does the checkout team expose?"
• "Show me the TechDocs for the auth library"
• "Which services depend on the user-db component?"
• "What's the lifecycle status of the legacy billing system?"
• "List all services with no assigned owner"

How It Works

1. Go to DataFaucet and enter your Backstage URL (e.g. https://backstage.company.com)
2. Log into your Backstage instance
3. Browse the software catalog, search entities, view TechDocs as you normally would
4. Each action becomes an MCP tool your AI can call
5. Deploy and connect to Claude, Cursor, or Windsurf

Works with any Backstage instance running the standard catalog and TechDocs plugins.

Security Best Practices

• Read-only service account — create a dedicated account with catalog read permissions only
• No scaffolder access — prevent AI from triggering new component creation
• Entity-kind filtering — restrict to specific kinds (Component, API, System) if needed
• Audit via Backstage plugins — track API access through existing audit plugins
• Token rotation — use short-lived tokens for the MCP connection

Use Cases by Role

Platform engineers: Catalog oversight. "Which components have no owner?" without writing custom catalog queries.

Backend developers: Discovery. "What APIs does the notifications team expose?" before building a new integration.

Engineering managers: Ownership tracking. "List all services my team owns and their lifecycle status" for quarterly reviews.

SREs: Incident context. "What does the order-service depend on and who owns its dependencies?" for faster triage.

Backstage UI vs AI Agent

Getting Started

Set up a service account for AI access:

1. Create a Backstage service account or use an existing read-only identity
2. Ensure it has catalog-entity read permissions
3. Disable scaffolder and other write-action permissions
4. Generate an API token or configure SSO passthrough

Then point DataFaucet at your Backstage instance, authenticate with the service account, and your AI agent can query the entire software catalog as MCP tools.