Kong Konnect MCP Server Tools

The Kong Konnect MCP Server provides tools to query gateway entities, create debug sessions, analyze API traffic, and search Kong documentation. All operations require authentication with a Personal Access Token and respect your user permissions.

The following regional endpoints are supported:

Retrieves control plane information. List all control planes, get details by UUID or display name, or identify which control plane serves a specific API path. Use this tool to identify which control plane handles a specific API endpoint, list all control planes for configuration audits, or retrieve control plane details before modifying gateway configuration.

Returns: Control plane objects with id, name, and tags. The id field should be extracted as control_plane_id for downstream tools.

Retrieves control planes within a specific control plane group. Use this tool to list all control planes in a specific environment or team group, audit configurations across related control planes, or perform bulk operations on grouped control planes.

Returns: Array of control plane objects with id, name, and tags.

Retrieves API consumer information for a control plane. List all consumers, get details by UUID or username, or investigate authentication issues. Use this tool to investigate authentication failures for specific consumers, review consumer configuration and credentials, identify consumers generating high error rates, or audit consumer access patterns.

Returns: Consumer objects with id, username, custom_id, and tags. Use username for human communication and id when calling GetPlugin.

Retrieves consumer group information for a control plane. Use this tool to review rate limiting tiers and consumer group assignments, audit consumer group membership, or verify consumer group configuration for different service tiers.

Returns: Array of consumer group objects with id, name, created_at, and tags.

Retrieves upstream service configurations for a control plane. List all services, get details by UUID or name, or troubleshoot connectivity issues. Use this tool to investigate service connectivity issues and timeout errors, review upstream configuration and health check settings, verify service endpoints and retry policies, or audit certificate configurations for secure services.

Returns: Service objects with upstream configuration (host, port, protocol, timeouts, retries, certificates).

Retrieves route configurations for a control plane. List all routes, get configuration by UUID or name, or investigate routing issues. Use this tool to debug 404 errors and routing misconfigurations, verify path matching and HTTP method restrictions, review route priority and regex patterns, or identify which service handles specific API endpoints.

Returns: Route objects with path mappings, HTTP methods, and service associations.

Retrieves plugin configurations for a control plane. List all plugins, get configuration by UUID, or troubleshoot plugin issues. Use this tool to identify which plugins affect a specific route or service, review rate limiting policies and authentication requirements, debug plugin configuration errors, or audit security policies across gateway entities.

Returns: Plugin objects with id, name, enabled status, configuration, and scope associations (service, route, consumer).

Retrieves vault configurations for secrets management. List all vaults, get details by UUID or name, or troubleshoot credential access. Use this tool to troubleshoot authentication failures due to expired credentials, verify vault configuration and secret rotation policies, audit secrets management across control planes, or identify which vault provider stores specific credentials.

Returns: Vault objects with id, name, prefix, provider, and configuration details.

Retrieves API request analytics and statistics. Query API requests with filters, analyze traffic patterns, or monitor performance metrics. Use this tool to identify error trends and spikes in failed requests, analyze consumer-specific traffic patterns and usage, investigate performance degradation over time, monitor API health and identify high-latency endpoints, or track rate limiting violations and throttled requests.

Returns:

• For query_api_requests: Detailed request data with metadata, latency breakdowns, and trace identifiers
• For get_consumer_requests: Aggregated statistics and per-request details for a specific consumer

Creates a targeted tracing session to collect real-time performance data. Requires user confirmation before starting. Use this tool to investigate slow API responses and identify latency bottlenecks, debug intermittent 500 errors in production, analyze plugin execution order and performance impact, trace request flow through multiple services, or capture detailed timing for specific endpoints.

Returns: debug_session_id for use with ActiveTracingSession tool.

Using CreateDebugSession requires user confirmation before starting. The session must complete before data can be analyzed.

Performs operations on active tracing sessions for debugging and analysis. Use this tool to monitor debug session progress and wait for completion, identify which plugin adds the most latency, analyze request and response flow through gateway, filter traces by specific plugins to isolate issues, or generate performance summary reports.

Available operations:

• fetch_status: Returns session status ("in_progress", "completed", "timed_out", "cancelled", or "pending")
• summarize_session: Returns aggregated span-level metrics, latency analysis, and bottleneck identification
• compact_traces: Returns detailed trace data in compacted format with optional filtering
• compressed_traces: Returns unique traces in compacted format
• stop_session: Stops an active session immediately

Return value varies by operation.

Searches Kong documentation and knowledge base for configuration guidance and best practices. Use this tool to find plugin configuration examples, look up best practices for rate limiting or authentication, search for troubleshooting steps for specific errors, get guidance on gateway deployment patterns, or learn about new features and capabilities.

Returns: Plain text documentation excerpts with configuration examples and procedures.

Many tools follow a hierarchical dependency pattern where entity identifiers are required to access nested resources:

control_plane_id (root level)
├── consumer_id
├── consumer_group_id
├── service_id
├── route_id
├── plugin_id
├── vault_id
└── debug_session_id

Start with GetControlPlane to identify the correct control plane, then use the control_plane_id for downstream operations.