Kong MCP Server: Let AI Query Your API Gateway

Why Give AI Access to Kong?

Kong is the API gateway that sits in front of your microservices, handling routing, rate limiting, authentication, and observability. When you need to check which routes exist for a service, verify rate limit configurations, or troubleshoot upstream connectivity, you use the Kong Admin API or Manager UI.

An MCP server for Kong lets your AI agent query routes, inspect plugins, check upstream health, and review consumer configurations directly from Claude, Cursor, or Windsurf.

What Becomes Possible

Once your AI agent has Kong access:

• "What routes are configured for the payments service?"
• "Which plugins are enabled on the /api/v2 route?"
• "What's the rate limit set for the mobile-app consumer?"
• "Are all upstreams for the API gateway healthy?"
• "Which services have authentication plugins disabled?"
• "Show me all routes that don't have rate limiting"

How It Works

1. Go to DataFaucet and enter your Kong Manager URL (e.g. https://kong-manager.company.com)
2. Log into your Kong Manager or Admin API
3. Browse services, routes, plugins, and consumers as you normally would
4. Each action becomes an MCP tool your AI can call
5. Deploy and connect to Claude, Cursor, or Windsurf

Works with Kong Gateway OSS, Enterprise, and Konnect. The AI agent gets whatever access your Admin API token permits.

Security Best Practices

• Read-only RBAC role — create a workspace role with only read permissions
• Workspace-scoped — restrict access to specific workspaces, not global
• No admin write access — prevent AI from modifying routes or plugins
• Network isolation — expose Admin API only through internal network
• Token rotation — rotate Admin API tokens on a regular schedule

Use Cases by Role

Platform engineers: Gateway oversight. "Which services have no rate limiting configured?" without querying the Admin API manually.

Backend developers: Route discovery. "What's the full route path to reach my service from outside?" before writing client code.

SREs: Incident triage. "Are any upstreams unhealthy right now?" during a service degradation.

Security engineers: Plugin audit. "Which routes are missing authentication plugins?" for compliance reviews.

Kong Manager vs AI Agent

Getting Started

Create a read-only token for AI access:

1. In Kong Manager, go to Teams → Roles → Add Role
2. Create a role with read-only permissions on services, routes, plugins, upstreams
3. Assign to a service account
4. Generate an Admin API token for that account

Then point DataFaucet at your Kong Manager instance, authenticate with the read-only token, and your AI agent can query gateway configuration as MCP tools.