dockndevai/mcp-debezium

A Model Context Protocol server for **Debezium** (via the **Kafka Connect** REST API). It lets an MCP-capable client (Claude Desktop, Claude Code, etc.) **monitor and manage change-data-capture connectors** — status, config, restarts, lifecycle — with behaviour controlled entirely by flags.
Safe by default: it starts read-only, can be scoped to an allowlist of connectors, protects critical connectors from mutation, redacts credentials in connector configs, and gates deletion behind an explicit opt-in.
Features
- **Monitoring** — worker/cluster info, connector list, plugins, per-connector config, status (with failed-task traces), and topics.
- **Management** — create/update, pause/resume, restart connector or a single task.
- **Lifecycle** — delete connectors (admin).
- **Access modes** — read-only → read-write → admin, layered so a mode never exposes tools above its level.
- **Credential redaction** — database.password and other secret-shaped config values are replaced with ***REDACTED*** before results are returned.
- **Security flags** — connector allowlist, protected connectors, delete gating, dry-run, and JSON audit logging (see below).
Security model
| Concern | Flag | Default | Effect |
| --- | --- | --- | --- |
| What can the server do? | DEBEZIUM_MODE | read-only | read-only exposes monitoring only; read-write adds lifecycle management; admin adds delete. Tools above the mode are **never registered**. |
| Which connectors are in scope? | DEBEZIUM_CONNECTOR_ALLOWLIST | *(all)* | When set, operations on other connectors are refused. |
| Which connectors are read-only forever? | DEBEZIUM_PROTECTED_CONNECTORS | *(none)* | Inspectable but never paused/reconfigured/deleted. |
| Can it delete? | DEBEZIUM_ALLOW_DELETE | false | delete_connector needs this **and** admin mode. |
| Preview without touching Connect | DEBEZIUM_DRY_RUN | false | Write/admin tools validate + log intent, then return. |
| Audit trail | DEBEZIUM_AUDIT_LOG | true | Emits a JSON line to stderr per guarded operation. |
| Interactive confirmation | *(automatic)* | — | Destructive & high-impact actions prompt the human to approve via MCP elicitation before running; clients without elicitation fall back to the *_ALLOW_* gate. |
| Credential redaction | *(always on)* | — | Secret-shaped config values are redacted before return. |
Tools
**Read** (read-only+): cluster_info, list_connectors, list_connector_plugins, get_connector, get_connector_config, get_connector_status, get_connector_topics
**Write** (read-write+): create_connector, update_connector_config, pause_connector, resume_connector, restart_connector, restart_task
**Admin** (admin): delete_connector (needs DEBEZIUM_ALLOW_DELETE)
Quickstart — add to your agent
Published on npm as @dockndevai/mcp-debezium. No clone or build needed — your MCP client runs it on demand with npx. **Start in read-only mode**; see .env.example for every variable and docs/CLIENTS.md for the full per-client guide.