How to connect the Aiven MCP server

Before you start

• An Aiven account. Aiven MCP is included with the account at no extra cost. aiven.io/docs
• MCP connections must be enabled for your organization. An organization admin turns them on in the Aiven Console under Admin, Authentication, Allow MCP connections. If you created the Aiven account, you are the admin. aiven.io/docs
• Organization admins can restrict MCP connections to read-only operations. That policy overrides the client's read-only setting, so write tools fail even if you connect without read-only mode. aiven.io/docs
• If you subscribed to Aiven through AWS, Azure or Google Cloud Marketplace, choose that marketplace in Aiven's install options so you sign in to the correct console. aiven.io/docs

Authentication

Your client → Aiven MCP

OAuth sign-in, handled by your MCP client. aiven.io/docsmodelcontextprotocol.io/specification

Aiven MCP → Aiven API

The server acts on your account with the access you approve. aiven.io/docs

Steps

1. Open Aiven's MCP install instructions for your client

   aiven.io/docs/tools/mcp-server
2. Choose whether to expose only read-only tools
   aiven.io/docsregistry.modelcontextprotocol.io/v0.1
3. Choose which service tools to load (all, or PostgreSQL, Kafka or integrations)
   aiven.io/docsregistry.modelcontextprotocol.io/v0.1
4. Choose whether to allow connection credentials (development only)
   aiven.io/docsregistry.modelcontextprotocol.io/v0.1
5. Add the Aiven MCP server to your client

   Add https://mcp.aiven.live/mcp as a remote MCP server that uses the Streamable HTTP transport (often labelled "http"), with your chosen options as URL parameters. Aiven's install page generates the configuration for Claude Code, Cursor (including a one-click install), VS Code 1.102 or later with GitHub Copilot, Gemini CLI and other clients. For Claude Desktop, Aiven's configuration goes through the mcp-remote bridge. Keep connection credentials off for production: with them on, the agent receives PostgreSQL and Kafka URIs, passwords and certificates.

   aiven.io/docsregistry.modelcontextprotocol.io/v0.1
6. Sign in to Aiven in your browser and authorize MCP access
   aiven.io/docs
7. If you can't use OAuth, run Aiven MCP locally with an API token

   In headless environments or other cases where OAuth isn't possible, Aiven documents running its MCP server locally from the mcp-aiven npm package instead of the hosted server. It reads your Aiven API token from the AIVEN_TOKEN environment variable, and AIVEN_READ_ONLY and AIVEN_ALLOW_SECRETS set the same options. The token's permissions apply, so scope it to the minimum needed and rotate it regularly. This is a separate connection from the hosted server this guide covers.

   aiven.io/docs
8. List the server's tools

   Your client should list the server's tools. That confirms the connection, not every API permission.

   aiven.io/docs

What we observed

• 5 Nov 2026: HTTP 401 with no WWW-Authenticate header; body "Missing or invalid Authorization header". Same result with the Registry template filled with its defaults. Protected-resource metadata is served at https://mcp.aiven.live/.well-known/oauth-protected-resource/mcp and names the authorization server https://api.aiven.io with scopes projects, services and accounts:read.