iunera/druid-mcp-server

Druid MCP Server

A comprehensive Model Context Protocol (MCP) server for Apache Druid that provides extensive tools, resources, and prompts for managing and analyzing Druid clusters.

Developed by iunera - Advanced AI and Data Analytics Solutions

Overview

This MCP server implements a feature-based architecture where each package represents a distinct functional area of Druid management. The server provides three main types of MCP components:

• Tools - Executable functions for performing operations
• Resources - Data providers for accessing information
• Prompts - AI-assisted guidance templates

Video Walkthrough

Learn how to integrate AI agents with Apache Druid using the MCP server. This tutorial demonstrates time series data exploration, statistical analysis, and data ingestion using natural language with AI assistants like Claude, ChatGPT, and Gemini.

Click the thumbnail above to watch the video on YouTube

Features

• Spring AI MCP Server integration
• Tool-based architecture for MCP protocol compliance
• Tool-based Architecture: Complete MCP protocol compliance with automatic JSON schema generation
• Multiple Transport Modes: STDIO, SSE, and Streamable HTTP support including Oauth
• Real-time Communication: Server-Sent Events with streaming capabilities
• Comprehensive error handling
• Customizable Prompt Templates: AI-assisted guidance with template customization
• Comprehensive Error Handling: Graceful error handling with meaningful responses

Architecture & Organization

• Feature-based Package Organization: Each package represents a distinct Druid management area
• Auto-discovery: Automatic registration of tools, resources, and prompts via annotations
• Enterprise Ready: Production-grade configuration and security features

MCP Inspector Interface

When connected to an MCP client, you can inspect the available tools, resources, and prompts through the MCP inspector interface:

Available Tools

The tools interface shows all available Druid management functions organized by feature areas including data management, ingestion management, and monitoring & health.

Available Resources

The resources interface displays all accessible Druid data sources and metadata that can be retrieved through the MCP protocol.

Available Prompts

The prompts interface shows all AI-assisted guidance templates available for various Druid management tasks and data analysis workflows.

Quick Start

MCP Configuration for LLMs

A ready-to-use MCP configuration file is provided at mcp-servers-config.json that can be used with LLM clients to connect to this Druid MCP server.

Examples

The configuration includes both transport options:

• : STDIO-based streaming connection via command-line.
• : HTTP-based streaming connection via Server-Sent Events.
• Modern single-endpoint HTTP transport per MCP 2025-06-18.

Docker examples using environment variables:

# Run with SSE Transport (HTTP-based, default)
docker run -p 8080:8080 \
  -e DRUID_ROUTER_URL=http://your-druid-router:8888 \
  iunera/druid-mcp-server:latest

# OR run with STDIO Transport (recommended for LLM clients)
docker run --rm -i \
  -e SPRING_AI_MCP_SERVER_STDIO=true \
  -e SPRING_MAIN_WEB_APPLICATION_TYPE=none \
  -e LOGGING_PATTERN_CONSOLE= \
  -e DRUID_ROUTER_URL=http://your-druid-router:8888 \
  iunera/druid-mcp-server:latest

Prerequisites

• Java 24
• Maven 3.6+
• Apache Druid cluster running with router on port 8888

Build and Run

# Build the application
mvn clean package -DskipTests

# Run the application
java -jar target/druid-mcp-server-1.4.0.jar

The server will start on port 8080 by default.

For detailed build instructions, testing, Docker setup, and development guidelines, see .

Security & Authentication

• Streamable HTTP and SSE transports are secured with OAuth 2.0 by default.
• Clients must send a valid Bearer token in the Authorization header when connecting.
• Example: Authorization: Bearer YOUR_JWT_TOKEN

Environment Variables

• DRUID_MCP_SECURITY_OAUTH2_ENABLED:
  • Description: Enables or disables OAuth2 security for client authentication.
  • Type: Boolean
  • Default: true (OAuth2 is enabled by default as per the text above)
  • Usage: Set to false to disable OAuth2 authentication. When disabled, clients can access the server without providing OAuth2 tokens.

• For enterprise SSO integration (OpenID Connect, Azure AD, Keycloak, etc.), please send an inquiry to consulting@iunera.com and see Contact & Support.

Installation from Maven Central

If you prefer to use the pre-built JAR without building from source, you can download and run it directly from Maven Central.

Prerequisites

• Java 24 JRE only

Download and Run

Download the JAR from Maven Central https://repo.maven.apache.org/maven2/com/iunera/druid-mcp-server/

# Run with SSE Transport (HTTP-based, default)
java -jar target/druid-mcp-server-1.4.0.jar

# OR run with STDIO Transport (recommended for LLM clients)
java -Dspring.ai.mcp.server.stdio=true \
     -Dspring.main.web-application-type=none \
     -Dlogging.pattern.console= \
     -jar target/druid-mcp-server-1.4.0.jar

For Developers

For detailed development information including build instructions, testing guidelines, architecture details, and contributing guidelines, see .

Available Tools by Feature

The MCP server auto-discovers all tools via annotations. In Read-only mode, any tool that would modify the Druid cluster is not registered and will not appear in the MCP client. The lists below reflect the current implementation.

Data Management

Ingestion Management

Monitoring & Health

Basic Security

Available Resources by Feature

Available Prompts by Feature

Environment Variables Configuration

The application can be configured using environment variables, which is the recommended approach for production environments. Below is a comprehensive list of supported environment variables derived from the application.yaml configuration file.

Druid Connection

• DRUID_ROUTER_URL: The URL of the Druid router.
• DRUID_AUTH_USERNAME: The username for Druid authentication.
• DRUID_AUTH_PASSWORD: The password for Druid authentication.
• DRUID_SSL_ENABLED: Enables or disables SSL for Druid connections (true/false).
• DRUID_SSL_SKIP_VERIFICATION: Skips SSL certificate verification (true/false).

MCP Server Configuration

• DRUID_MCP_SECURITY_OAUTH2_ENABLED: Enables or disables OAuth2 security for client authentication (true/false).
• DRUID_MCP_READONLY_ENABLED: Enables or disables read-only mode (true/false).
• DRUID_EXTENSION_DRUID_BASIC_SECURITY_ENABLED: Enables or disables the basic security feature (true/false). When disabled, basic security tools are not registered.
• SPRING_AI_MCP_SERVER_NAME: The name of the MCP server.
• SPRING_AI_MCP_SERVER_PROTOCOL: The protocol used by the MCP server (e.g., streamable).

General Server Configuration

• SERVER_PORT: The port the server listens on.
• SERVER_SERVLET_SESSION_COOKIE_NAME: The name of the session cookie.
• SPRING_APPLICATION_NAME: The name of the application.
• SPRING_CONFIG_IMPORT: Imports additional configuration files.
• SPRING_MAIN_BANNER_MODE: The mode for the startup banner (e.g., off).

Logging

• LOGGING_FILE_NAME: The name of the log file.
• LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY: The log level for Spring Security (e.g., DEBUG).

SSL-Encrypted Cluster with Authentication

This section provides comprehensive guidance on connecting to SSL-encrypted Druid clusters with username and password authentication.

Prerequisites

• SSL-enabled Druid cluster with HTTPS endpoints
• Valid username and password credentials for Druid authentication
• SSL certificates properly configured (or ability to skip verification for testing)

Configuration Methods

Method 1: Environment Variables (Recommended for Production)

Set the following environment variables before starting the MCP server:

# Druid cluster URL with HTTPS
export DRUID_ROUTER_URL="https://your-druid-cluster.example.com:8888"

# Authentication credentials
export DRUID_AUTH_USERNAME="your-username"
export DRUID_AUTH_PASSWORD="your-password"

# SSL configuration
export DRUID_SSL_ENABLED="true"
export DRUID_SSL_SKIP_VERIFICATION="false"  # Use "true" only for testing

# Start the MCP server
java -jar target/druid-mcp-server-1.4.0.jar

Method 2: Runtime System Properties

Pass configuration as JVM system properties:

java -Ddruid.router.url="https://your-druid-cluster.example.com:8888" \
     -Ddruid.auth.username="your-username" \
     -Ddruid.auth.password="your-password" \
     -Ddruid.ssl.enabled=true \
     -Ddruid.ssl.skip-verification=false \
     -jar target/druid-mcp-server-1.4.0.jar

SSL Configuration Options

Production SSL Setup

For production environments with valid SSL certificates:

export DRUID_ROUTER_URL="https://druid-prod.company.com:8888"
export DRUID_SSL_ENABLED="true"
export DRUID_SSL_SKIP_VERIFICATION="false"

The server will use the system's default truststore to validate SSL certificates.

Authentication Methods

The MCP server supports HTTP Basic Authentication with username and password:

• Username: Set via DRUID_AUTH_USERNAME or druid.auth.username
• Password: Set via DRUID_AUTH_PASSWORD or druid.auth.password

The credentials are automatically encoded using Base64 and sent with each request using the Authorization: Basic header.

MCP Client Configuration with SSL

Update your mcp-servers-config.json to include environment variables:

{
  "mcpServers": {
    "druid-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "-e",
        "SPRING_AI_MCP_SERVER_STDIO=true",
        "-e",
        "SPRING_MAIN_WEB_APPLICATION_TYPE=none",
        "-e",
        "LOGGING_PATTERN_CONSOLE=",
        "-e",
        "DRUID_ROUTER_URL",
        "-e",
        "DRUID_AUTH_USERNAME",
        "-e",
        "DRUID_AUTH_PASSWORD",
        "-e",
        "DRUID_SSL_ENABLED",
        "-e",
        "DRUID_SSL_SKIP_VERIFICATION",
        "-e",
        "DRUID_MCP_READONLY_ENABLED",
        "iunera/druid-mcp-server:1.4.0"
      ],
      "env": {
        "DRUID_ROUTER_URL": "http://host.docker.internal:8888",
        "DRUID_AUTH_USERNAME": "",
        "DRUID_AUTH_PASSWORD": "",
        "DRUID_SSL_ENABLED": "false",
        "DRUID_SSL_SKIP_VERIFICATION": "true",
        "DRUID_MCP_READONLY_ENABLED": "false"
      }
    }
  }
}

MCP Prompt Customization

The server provides extensive prompt customization capabilities through the prompts.properties file located in src/main/resources/.

Prompt Configuration Structure

The prompts.properties file contains:

1. Global Settings: Enable/disable prompts and set watermarks
2. Feature Toggles: Control which prompts are available
3. Custom Variables: Organization-specific information
4. Template Definitions: Full prompt templates for each feature

Overriding Prompts

You can override any prompt template using Java system properties with the -D flag:

Method 1: System Properties (Runtime Override)

java -Dprompts.druid-data-exploration.template="Your custom template here" \
     -jar target/druid-mcp-server-1.4.0.jar

Method 2: Custom Properties File

1. Create a custom properties file (e.g., custom-prompts.properties):

# Custom prompt template
prompts.druid-data-exploration.template=My custom data exploration prompt:\n\
1. Custom step one\n\
2. Custom step two\n\
{datasource_section}\n\
Environment: {environment}

2. Load it at runtime:

java -Dspring.config.additional-location=classpath:custom-prompts.properties \
     -jar target/druid-mcp-server-1.4.0.jar

Available Prompt Variables

All prompt templates support these variables:

Prompt Template Examples

Custom Data Exploration Prompt

prompts.druid-data-exploration.template=Welcome to {organizationName} Druid Analysis!\n\n\
Please help me explore our data:\n\
{datasource_section}\n\
Environment: {environment}\n\
Contact: {contactInfo}\n\n\
{watermark}

Custom Query Optimization Prompt

prompts.druid-query-optimization.template=Query Performance Analysis for {organizationName}\n\n\
Query to optimize: {query}\n\n\
Please provide:\n\
1. Performance bottleneck analysis\n\
2. Optimization recommendations\n\
3. Best practices for our {environment} environment\n\n\
{watermark}

Disabling Specific Prompts

You can disable individual prompts by setting their enabled flag to false:

mcp.prompts.data-exploration.enabled=false
mcp.prompts.query-optimization.enabled=false

Or disable all prompts globally:

mcp.prompts.enabled=false

MCP Integration

This server uses Spring AI's MCP Server framework and supports both STDIO and SSE transports. The tools, resources, and prompts are automatically registered and exposed through the MCP protocol.

Transport Modes

The Druid MCP Server supports multiple transport modes compliant with MCP 2025-06-18 specification:

Streamable HTTP Transport (Recommended and Default - New in MCP 2025-06-18)

The new Streamable HTTP transport provides enhanced performance and scalability with support for multiple concurrent clients:

# Default configuration with Streamable HTTP

java -Dspring.ai.mcp.server.stdio=true \
     -Dspring.main.web-application-type=none \
     -Dlogging.pattern.console= \
     -jar target/druid-mcp-server-1.4.0.jar
# Server available at http://localhost:8080/mcp (configurable endpoint)

Note: The -Dspring.ai.mcp.server.protocol option is deprecated and no longer required. STREAMABLE is the default protocol and is configured in application.properties. If you previously set this flag, you can safely remove it.

Features:

• Single Endpoint: One HTTP endpoint handles both POST and GET requests
• Multiple Clients: Support for concurrent client connections
• Optional SSE Streaming: Server-Sent Events for real-time updates
• Enhanced Security: Origin header validation and authentication
• Backwards Compatibility: Automatic fallback for older MCP clients
• Keep-alive: Configurable connection health monitoring

Security

• The Streamable HTTP and SSE modes are secured with OAuth by default. Your MCP client must obtain and send a valid bearer token when connecting.
• For enterprise SSO integration (OpenID Connect, Azure AD, Keycloak, etc.), please send an inquiry to consulting@iunera.com and see Contact & Support.

STDIO Transport (Command-line Integration)

Perfect for LLM clients and desktop applications:

java -Dspring.ai.mcp.server.stdio=true \
     -Dspring.main.web-application-type=none \
     -Dlogging.pattern.console= \
     -jar target/druid-mcp-server-1.4.0.jar

Legacy SSE Transport (Deprecated)

Still supported for backwards compatibility. It is no longer the default and may be removed in a future version.

Note: The SSE endpoint is secured with OAuth by default. Clients must include a valid bearer token when connecting. For SSO integration support, see Contact & Support.

java -jar target/druid-mcp-server-1.4.0.jar
# Server available at http://localhost:8080/sse

Read-only Mode

Read-only mode prevents any operation that could mutate your Druid cluster while still allowing safe read operations and SQL queries. When enabled:

• All HTTP GET requests are allowed
• HTTP POST is allowed only to the exact path /druid/v2/sql (for SELECT and other read-only SQL)
• Any other HTTP method (PUT, PATCH, DELETE) is blocked
• Any other POST endpoint (e.g. ingestion/task endpoints) is blocked
• MCP write tools are not registered, so they will not appear in your MCP client’s tool list

Enable Read-only Mode

You can enable it using any of the following methods:

1. application.properties

druid.mcp.readonly.enabled=true

2. Environment variable

export DRUID_MCP_READONLY_ENABLED=true

3. JVM system property

java -Ddruid.mcp.readonly.enabled=true -jar target/druid-mcp-server-1.4.0.jar

4. Docker

docker run --rm -p 8080:8080 \
  -e DRUID_ROUTER_URL=http://your-druid-router:8888 \
  -e DRUID_MCP_READONLY_ENABLED=true \
  iunera/druid-mcp-server:latest

What changes in read-only mode?

• Tools that would modify the cluster are disabled and won’t be listed by the MCP client. Examples include:
  • Segment state changes (enableSegment, disableSegment)
  • Datasource deletion (killDatasource)
  • Retention rule edits (editRetentionRulesForDatasource)
  • Compaction config edits (editCompactionConfigForDatasource, deleteCompactionConfigForDatasource)
  • Lookup changes (createOrUpdateLookup, deleteLookup)
  • Supervisor control (suspendSupervisor, startSupervisor, terminateSupervisor)
  • Task control (killTask)
  • Multi-stage SQL task operations (queryDruidMultiStage, queryDruidMultiStageWithContext, getMultiStageQueryTaskStatus, cancelMultiStageQueryTask)
  • Ingestion spec submission and templates (createIngestionSpec, createBatchIngestionTemplate)
  • Basic security changing tools (e.g., createAuthenticationUser, deleteAuthenticationUser, setUserPassword, createAuthorizationUser, deleteAuthorizationUser, createRole, deleteRole, setRolePermissions, assignRoleToUser, unassignRoleFromUser)
• Read-only-safe tools remain available, including SQL queries (queryDruidSql), metadata and status lookups, health diagnostics, task and segment inspection, etc.

🐳

Complete Docker Compose configuration for running a full Apache Druid cluster locally. Perfect for development, testing, and learning about Druid cluster architecture.

Features:

• Full Druid cluster with all components (Coordinator, Broker, Historical, MiddleManager, Router)
• PostgreSQL metadata storage and ZooKeeper coordination
• Pre-configured with sample data and ingestion examples
• Integrated Druid MCP Server for immediate testing

~~## Related Projects

This Druid MCP Server is part of a comprehensive ecosystem of Apache Druid tools and extensions developed by iunera. These complementary projects enhance different aspects of Druid cluster management and data ingestion:

🔧 Druid Cluster Configuration

Advanced configuration management and deployment tools for Apache Druid clusters. This project provides:

• Automated Cluster Setup: Streamlined configuration templates for different deployment scenarios
• Configuration Management: Best practices and templates for production Druid clusters
• Deployment Automation: Tools and scripts for consistent cluster deployments
• Environment-Specific Configs: Optimized configurations for development, staging, and production environments

Integration with Druid MCP Server: The cluster configurations provided by this project work seamlessly with the monitoring and management capabilities of the Druid MCP Server, enabling comprehensive cluster lifecycle management.

📊 Code Ingestion Druid Extension

A specialized Apache Druid extension for ingesting and analyzing code-related data and metrics. This extension enables:

• Code Metrics Ingestion: Specialized parsers for code analysis data and software metrics
• Developer Analytics: Tools for analyzing code quality, complexity, and development patterns
• CI/CD Integration: Seamless integration with continuous integration and deployment pipelines
• Custom Data Formats: Support for various code analysis tools and formats

Integration with Druid MCP Server: This extension expands the ingestion capabilities that can be managed through the MCP server's ingestion management tools, providing specialized support for code analytics use cases.

Why Use These Together?

• Complete Ecosystem: From cluster setup to specialized data ingestion and management
• Consistent Architecture: All projects follow similar design principles and integration patterns
• Enhanced Capabilities: Each project extends different aspects of the Druid ecosystem
• Production Ready: Battle-tested configurations and extensions for enterprise deployments

Roadmap

• Druid Auto Compaction: Intelligent automatic compaction configuration
• MCP Auto Completion: Enhanced autocomplete functionality with sampling using McpComplete
• MCP Notifications: Real-time notifications for MCP operations
• Proper Observability: Comprehensive metrics and tracing
• Enhanced Monitoring: Advanced cluster monitoring and alerting capabilities
• Advanced Analytics: Machine learning-powered insights and recommendations
• Kubernetes Support: Proper deployment on Kubernetes

About iunera

This Druid MCP Server is developed and maintained by iunera, a leading provider of advanced AI and data analytics solutions.

iunera specializes in:

• AI-Powered Analytics: Cutting-edge artificial intelligence solutions for data analysis
• Enterprise Data Platforms: Scalable data infrastructure and analytics platforms (Druid, Flink, Kubernetes, Kafka, Spring)
• Model Context Protocol (MCP) Solutions: Advanced MCP server implementations for various data systems
• Custom AI Development: Tailored AI solutions for enterprise needs

As veterans in Apache Druid iunera deployed and maintained a large number of solutions based on Apache Druid in productive enterprise grade scenarios.

Need Expert Apache Druid Consulting?

Maximize your return on data with professional Druid implementation and optimization services. From architecture design to performance tuning and AI integration, our experts help you navigate Druid's complexity and unlock its full potential.

Get Expert Druid Consulting →

Need Enterprise MCP Server Development Consulting?

ENTERPRISE AI INTEGRATION & CUSTOM MCP (MODEL CONTEXT PROTOCOL) SERVER DEVELOPMENT

Iunera specializes in developing production-grade AI agents and enterprise-grade LLM solutions, helping businesses move beyond generic AI chatbots. They build secure, scalable, and future-ready AI infrastructure, underpinned by the Model Context Protocol (MCP), to connect proprietary data, legacy systems, and external APIs to advanced AI models.

Get Enterprise MCP Server Development Consulting →

For more information about our services and solutions, visit www.iunera.com.

Contact & Support

Need help? Let

• Website: https://www.iunera.com
• Professional Services: Contact us through email for Apache Druid enterprise consulting, support and custom development
• Open Source: This project is open source and community contributions are welcome

© 2024 iunera. Licensed under the Apache License 2.0.