Konflux DevLake MCP Server
by
Enables natural‑language querying of Konflux DevLake databases by converting plain English questions into validated, secure SQL queries and returning structured data.
Konflux DevLake MCP Server Overview
What is Konflux DevLake MCP Server about?
The server acts as a bridge between AI assistants and a Konflux DevLake database, allowing users to ask questions in everyday language and receive precise, structured results. It translates natural language into safe SQL, supports OIDC authentication, and offers specialized tools for incidents, deployments, and pull‑request retest analysis.
How to use Konflux DevLake MCP Server?
- Python (development): Install dependencies with
pip install -r requirements.txtand start the server using thekonflux-devlake-mcp.pyscript with appropriate flags (e.g.,--transport http --host 0.0.0.0 --port 3000). - Docker (production): Build the image (
docker build -t konflux-devlake-mcp:latest .) and run it, supplying database credentials and optional environment variables for timeouts, logging, and OIDC settings. - Configuration: Parameters can be passed via command‑line arguments or environment variables such as
DB_HOST,DB_PORT,OIDC_ENABLED, and various timeout variables. Health checks are available atGET /health.
Key features of Konflux DevLake MCP Server
- Natural‑language to SQL conversion with built‑in injection protection.
- Dedicated tools for incident deduplication, deployment tracking, and PR retest analysis, returning data in the token‑efficient TOON format.
- Flexible transport (HTTP or stdio) and graceful shutdown handling.
- Comprehensive logging and configurable high‑timeout defaults for long‑running LLM requests.
- Optional OIDC authentication with Red Hat SSO/Keycloak and LDAP‑based role enforcement.
- Dockerized deployment and easy local execution via Python.
Use cases of Konflux DevLake MCP Server
- Data analysts: Query DevLake metrics without writing SQL.
- DevOps teams: Monitor incidents, deployments, and PR retest patterns through conversational interfaces.
- AI assistants: Provide LLMs with secure, validated access to DevLake data for automated reporting.
- Business intelligence: Generate quick insights and visualizations from raw DevLake tables.
- Quality assurance: Identify flaky tests and excessive manual retests to improve CI/CD stability.
FAQ
Q: Which transport protocols are supported?
A: Both HTTP and stdio (--transport http|stdio).
Q: How are security concerns handled? A: The server validates and sanitizes every generated query, detects potential SQL injection, supports optional OIDC/JWT authentication, and enforces LDAP‑based RBAC for administrator‑only tools.
Q: What is TOON format? A: A compact, human‑readable serialization that reduces token usage by 30‑60 % compared with JSON, used for incident and PR retest tool responses.
Q: Can I run the server locally without Docker? A: Yes, install Python dependencies and start the script with the required flags.
Q: How do I configure timeouts for LLM connections?
A: Set environment variables like SERVER_TIMEOUT_KEEP_ALIVE, DB_READ_TIMEOUT, etc., or rely on the high default values (e.g., 600 s keep‑alive).
Konflux DevLake MCP Server's README
Konflux DevLake MCP Server
A MCP server that enables natural language querying of Konflux DevLake databases. This server acts as a bridge between AI assistants and your DevLake database, allowing you to ask questions in plain language and get structured data back.
Documentation
- Full Architecture Documentation - Complete system architecture and design patterns
- Documentation Index - Visual diagrams and documentation catalog
- Architecture Diagrams - System diagrams in Mermaid format
Quick Start
Option 1: Python (Development)
- Install dependencies:
pip install -r requirements.txt
- Start the server:
python konflux-devlake-mcp.py --transport http --host 0.0.0.0 --port 3000 --db-host localhost --db-port 3306 --db-user root --db-password password --db-database lake
Option 2: Docker (Production)
- Build the Docker image:
docker build -t konflux-devlake-mcp:latest .
- Run the container:
docker run -d \
--name konflux-mcp-server \
-p 3000:3000 \
-e DB_HOST=your_db_host \
-e DB_PORT=3306 \
-e DB_USER=root \
-e DB_PASSWORD=your_password \
-e DB_DATABASE=lake \
-e LOG_LEVEL=INFO \
konflux-devlake-mcp:latest
- Push to registry (if needed):
docker tag konflux-devlake-mcp:latest quay.io/flacatus/mcp-lake:1.0.0
docker push quay.io/flacatus/mcp-lake:1.0.0
Configuration
Command Line Arguments
| Argument | Description | Example |
|---|---|---|
--transport |
Transport protocol (stdio/http) | --transport http |
--host |
Server host | --host 0.0.0.0 |
--port |
Server port | --port 3000 |
--db-host |
Database host | --db-host localhost |
--db-port |
Database port | --db-port 3306 |
--db-user |
Database username | --db-user root |
--db-password |
Database password | --db-password your_password |
--db-database |
Database name | --db-database lake |
--log-level |
Logging level | --log-level INFO |
Timeout Configuration
The server includes configurable timeout settings optimized for LLM connections:
| Environment Variable | Description | Default |
|---|---|---|
SERVER_TIMEOUT_KEEP_ALIVE |
HTTP keep-alive timeout in seconds | 600 (10 minutes) |
SERVER_TIMEOUT_GRACEFUL_SHUTDOWN |
Graceful shutdown timeout in seconds | 120 (2 minutes) |
DB_CONNECT_TIMEOUT |
Database connection timeout in seconds | 60 (1 minute) |
DB_READ_TIMEOUT |
Database read timeout in seconds | 600 (10 minutes) |
DB_WRITE_TIMEOUT |
Database write timeout in seconds | 120 (2 minutes) |
These high default values ensure that long-running LLM requests and complex database queries don't timeout prematurely.
OIDC Authentication (Red Hat SSO / Keycloak)
The server supports OIDC authentication for securing MCP endpoints. When enabled, all requests to /mcp endpoints require a valid token.
| Environment Variable | Description | Default |
|---|---|---|
OIDC_ENABLED |
Enable OIDC authentication | false |
OIDC_ISSUER_URL |
OIDC issuer URL (e.g., https://sso.redhat.com/auth/realms/redhat-external) |
- |
OIDC_CLIENT_ID |
OIDC client ID / audience | - |
OIDC_REQUIRED_SCOPES |
Comma-separated list of required scopes | - |
OIDC_JWKS_CACHE_TTL |
JWKS cache TTL in seconds | 3600 |
OIDC_SKIP_PATHS |
Comma-separated paths to skip auth | /health,/security |
OIDC_VERIFY_SSL |
Verify SSL certificates | true |
OIDC_OFFLINE_TOKEN_ENABLED |
Accept offline tokens (server exchanges for access token) | false |
OIDC_TOKEN_EXCHANGE_CLIENT_ID |
Client ID for token exchange (defaults to OIDC_CLIENT_ID) |
- |
OIDC_ACCESS_TOKEN_CACHE_BUFFER |
Seconds before expiry to refresh access token | 60 |
Example: Enable Red Hat SSO authentication with access tokens
export OIDC_ENABLED=true
export OIDC_ISSUER_URL="https://sso.redhat.com/auth/realms/redhat-external"
export OIDC_CLIENT_ID="cloud-services"
Example: Enable offline token mode (server handles token exchange)
export OIDC_ENABLED=true
export OIDC_ISSUER_URL="https://sso.redhat.com/auth/realms/redhat-external"
export OIDC_CLIENT_ID="cloud-services"
export OIDC_OFFLINE_TOKEN_ENABLED=true
export OIDC_TOKEN_EXCHANGE_CLIENT_ID="cloud-services"
With offline token mode, clients can use their long-lived offline token directly. The server automatically exchanges it for a short-lived access token and caches the result.
Clients must include the Authorization: Bearer <token> header. The token can be either:
- A JWT access token (validated directly)
- An offline token (exchanged for access token when
OIDC_OFFLINE_TOKEN_ENABLED=true)
When OIDC is enabled, the server also enforces LDAP/Rover-based RBAC. The offline token is
used only for token exchange; its claims are not used for identity or authorization. The
The LDAP user ID is derived from the final component of the validated exchanged access token's
sub claim, which must use the f:<idp-id>:<username> format. Members of devlakemcpadmin receive administrator
access, while other authenticated users receive restricted access. The execute_query tool
is administrator-only.
| Environment Variable | Description | Default |
|---|---|---|
LDAP_SERVER_URL |
IPA LDAP server URL, or a comma-separated list of replicas to fail over between | the six ldaps://s{1,2}.idm-001.prod.{us-east-1.aws,rdu2.dc,iad2.dc}.redhat.com replicas |
LDAP_BASE_DN |
LDAP base DN | dc=ipa,dc=redhat,dc=com |
LDAP_USER_BASE_DN |
User search base DN | cn=users,cn=accounts,dc=ipa,dc=redhat,dc=com |
LDAP_CACHE_TTL |
Group membership cache lifetime in seconds | 300 |
LDAP_ADMIN_GROUP |
Rover group mapped to administrator access | devlakemcpadmin |
LDAP_BIND_DN |
IPA LDAP service-account bind DN | - |
LDAP_BIND_PASSWORD |
IPA LDAP service-account password | - |
LDAP_BIND_DN and LDAP_BIND_PASSWORD should be provided through a Kubernetes Secret.
Environment Variables (Alternative)
export DB_HOST=localhost
export DB_PORT=3306
export DB_USER=root
export DB_PASSWORD=your_password
export DB_DATABASE=lake
export TRANSPORT=http
export SERVER_HOST=0.0.0.0
export SERVER_PORT=3000
export LOG_LEVEL=INFO
# Timeout Configuration (for LLM connections)
export SERVER_TIMEOUT_KEEP_ALIVE=600 # HTTP keep-alive timeout in seconds (default: 600)
export SERVER_TIMEOUT_GRACEFUL_SHUTDOWN=120 # Graceful shutdown timeout in seconds (default: 120)
export DB_CONNECT_TIMEOUT=60 # Database connection timeout in seconds (default: 60)
export DB_READ_TIMEOUT=600 # Database read timeout in seconds (default: 600)
export DB_WRITE_TIMEOUT=120 # Database write timeout in seconds (default: 120)
Then run:
python konflux-devlake-mcp.py
Help Command
python konflux-devlake-mcp.py --help
Available Tools
This server provides several specialized tools for working with your DevLake data:
- Database Tools: Connect to your database, list available databases and tables, execute custom SQL queries, and get detailed table schemas
- Incident Analysis: Get unique incidents with automatic deduplication, analyze incident patterns, and track resolution times. Returns data in TOON format for token efficiency.
- Deployment Tracking: Monitor deployment data with advanced filtering, track deployment frequency, and analyze service distribution
- PR Retest Analysis: Comprehensive analysis of pull requests that required manual retest commands (
/retestor/rerun). Provides detailed statistics including:- Total count of manual retest comments (excluding bot comments)
- Number of PRs affected and average retests per PR
- Top PRs with most retests (including PR title, URL, duration, changes, and status)
- Analysis of root causes and failure patterns
- Breakdown by PR category (bug fixes, features, dependencies, etc.)
- Timeline visualization data
- Actionable recommendations to reduce retest frequency
- Returns data in TOON format for token efficiency
Features
- Natural Language Processing: Convert plain English questions into SQL queries automatically
- Security First: Built-in SQL injection detection and comprehensive query validation to protect your data
- DevLake Integration: Specialized tools for analyzing incident, deployment, and PR retest data from Konflux DevLake
- Token-Efficient Responses: Uses TOON format for tool responses (incident tools and PR retest tools), reducing token consumption by 30-60% compared to JSON
- Project & Repository Filtering: Advanced filtering capabilities for analyzing data by DevLake project and repository name
- Flexible Transport: Support for both HTTP and stdio transport protocols with graceful error handling
- Comprehensive Logging: Detailed logging with rotation, error tracking, and intelligent filtering of expected disconnection errors
- LLM-Optimized Timeouts: High default timeout values (10 minutes keep-alive) to support long-running LLM requests and database queries
- Configurable Timeouts: All timeout settings are configurable via environment variables for different deployment scenarios
- Enhanced Error Handling: Graceful handling of client disconnections (
ClosedResourceError) and server shutdowns (CancelledError) without noisy error logs
Security
Your data security is our priority:
- OIDC Authentication: Optional JWT-based authentication via Red Hat SSO / Keycloak
- SQL Injection Protection: Automatic detection and prevention of potential SQL injection attacks
- Query Validation: Every query is validated and sanitized before execution
- Data Masking: Sensitive information is automatically masked in query results
- Access Control: Database-level access control ensures only authorized operations are performed
Response Format
The server uses TOON format (Token-Optimized Object Notation) for tool responses to reduce token consumption:
- Incident Tools: All responses use TOON format (30-60% token reduction vs JSON)
- PR Retest Analysis Tool: All responses use TOON format (30-60% token reduction vs JSON)
- Deployment Tools: Currently use JSON format
- Database Tools: Currently use JSON format
TOON format is a compact, human-readable serialization format that significantly reduces token costs when working with LLMs while maintaining full data fidelity.
Monitoring
Keep track of your server's health and performance:
- Application Logs:
logs/konflux_devlake_mcp_server.log- General server activity and operations - Error Logs:
logs/konflux_devlake_mcp_server_error.log- Detailed error information for troubleshooting - Health Check:
GET http://localhost:3000/health- Monitor server status and connectivity - Error Handling: The server gracefully handles client disconnections and server shutdowns without logging expected errors (e.g.,
ClosedResourceError,CancelledError)
Testing
Use Makefile to easily run local tests on MCP tools (requires docker engine and LLM API key):
make install
make test-unit
make test-integration
make test-e2e
make test-all
Linting & pre-commit
Automatically run linters when making a commit:
make install
pre-commit install
pre-commit run --all-files
Configured tools:
- black (python formatting)
- flake8 (python style/lint)
- yamllint (YAML validation)
Contributing
We welcome contributions to improve this project:
- Fork the repository
- Create a feature branch for your changes
- Make your improvements and add tests
- Submit a pull request with a clear description of your changes
Use Cases
This MCP server is particularly useful for:
- Data Analysts: Quickly query DevLake data without writing complex SQL
- DevOps Teams: Monitor incidents and deployments through natural language queries
- AI Assistants: Enable AI tools to access and analyze your DevLake data with optimized token usage
- Business Intelligence: Generate reports and insights from your DevLake database
- Development Teams: Debug and analyze application performance data, identify PR retest patterns, and optimize CI/CD workflows
- Quality Assurance: Analyze PR retest frequency, identify flaky tests, and improve test reliability
Recent Updates
Version 1.0.0+ Features
- PR Retest Analysis Tool: New comprehensive tool for analyzing pull requests that required manual retest commands
- TOON Format Support: Incident tools and PR retest tools now use TOON format for 30-60% token reduction
- Enhanced Timeout Configuration: High default timeouts (10 minutes) optimized for LLM connections
- Improved Error Handling: Graceful handling of client disconnections and server shutdowns
- Database Timeout Settings: Configurable timeouts for database connections to handle long-running queries
- Project & Repository Filtering: Enhanced filtering capabilities for precise data analysis
Konflux DevLake MCP Server Reviews
Login Required
Please log in to share your review and rating for this MCP.
Similar MCP Servers like Konflux DevLake MCP Server
Explore related MCPs that share similar capabilities and solve comparable challenges
MindsDB
Officialby mindsdb
Enables humans, AI agents, and applications to retrieve highly accurate answers across large‑scale data sources, unifying heterogeneous databases, warehouses, and SaaS platforms.
Vizro
by mckinsey
Build high-quality data visualization apps quickly using a low-code toolkit that leverages Plotly, Dash, and Pydantic.
MCP Server Chart
by antvis
Offers over 25 AntV chart types for automated chart generation and data analysis, callable via MCP tools, CLI, HTTP, SSE, or streamable transports.
Dbt Mcp Server
by dbt-labs
Provides a Model Context Protocol server that exposes a rich set of dbt‑related tools—SQL execution, semantic‑layer queries, discovery APIs, dbt CLI commands, admin operations, code generation, lineage analysis, and product documentation retrieval—so AI agents can safely interact with dbt projects and platforms.
Mcp Server Data Exploration
by reading-plus-ai
A versatile tool that enables interactive data exploration through prompts, CSV loading, and script execution.
Wren Engine
by Canner
Provides a semantic engine that lets MCP clients and AI agents query enterprise data with contextual understanding, precise calculations, and built‑in governance.
Google Analytics MCP Server
by surendranb
Provides natural‑language access to Google Analytics 4 data via MCP, exposing over 200 dimensions and metrics for Claude, Cursor and other compatible clients.
OpenAnalytics
by OpenLabs-so
Provides privacy‑first, cookieless web analytics with revenue attribution and an MCP server, enabling self‑hosted tracking without cookies or cross‑site identifiers.
BigQuery MCP Server
by ergut
Provides secure, read‑only access to BigQuery datasets, allowing large language models to query and analyze data through a standardized interface.