Agentic Data Plane
Preview

rpk ai mcp-server create

Create an MCP server.

Choose the backend by setting flags from one group; the group you use selects it: remote, managed. Setting flags from two groups is an error.

This command was introduced in ai version 0.2.28.

Usage

rpk ai mcp-server create [flags]

Examples

This section provides examples of how to use rpk ai mcp-server create.

rpk ai mcp-server create my-mcp-server \
  --remote.url https://mcp.example.com/sse \
  --remote.transport sse

Flags

Value Type Description

--enabled

bool

Whether this server is active and discoverable. (true when set; pass --enabled=false to disable).

--description

string

Human-readable description shown in help text and UIs.

--code-mode

bool

Enable code mode: adds {name}_search and {name}_execute tools alongside existing tools. (true when set; pass --code-mode=false to disable).

--data-policies

stringArray

Data policies shaping this server’s tool calls (see MCPServer.data_policies). (repeatable; protojson object; replaces the full list on update).

--response-format

string

Output format for tool results (token optimization). (one of: jton, toon).

--tags

stringArray

Arbitrary key/value metadata tags (see MCPServer.tags). (repeatable key=value; replaces the full map on update). (New in 0.2.33)

--remote.url

string

Endpoint URL of the remote MCP server. (required in its group) (alias: --url).

--remote.transport

string

MCP transport protocol. SSE for server-sent events, Streamable HTTP for newer bidirectional protocol. (one of: sse, streamable-http; required in its group) (alias: --transport).

--remote.none

bool

None. (selects this auth mode; takes no value).

--remote.token-passthrough

bool

Token passthrough. (selects this auth mode; takes no value).

--remote.static-key.key-secret-ref

string

Secret store reference for the API key. (required in its group).

--remote.static-key.header-name

string

HTTP header name for the API key. Defaults to 'Authorization'.

--remote.service-account-oauth.client-id

string

OAuth client ID from the provider’s developer console. (required in its group).

--remote.service-account-oauth.client-secret-ref

string

Secret store reference for the OAuth client secret. (required in its group).

--remote.service-account-oauth.token-url

string

OAuth token endpoint URL for exchanging credentials. (required in its group).

--remote.service-account-oauth.scopes

strings

OAuth scopes to request when obtaining tokens. (repeatable; replaces the full list on update).

--remote.user-oauth.provider-name

string

OAuth provider that manages tokens for this server’s users. Leave empty to set OAuth up automatically from the server URL.

--remote.user-oauth.required-scopes

strings

Minimum OAuth scopes a user’s connection must have. Insufficient scopes return a scope_upgrade_required error. (repeatable; replaces the full list on update).

--remote.user-oauth.injection.header-name

string

HTTP header name for the token. Defaults to 'Authorization'.

--remote.user-oauth.injection.header-prefix

string

Value prefix before the token. Defaults to 'Bearer'. Set empty for no prefix.

--remote.user-oauth.client-id

string

OAuth client ID from the vendor console. Only for automatic setup of a server without dynamic client registration; leave empty otherwise.

--remote.user-oauth.client-secret-ref

string

Secret-store reference for the OAuth client secret (confidential apps only). Leave empty for public PKCE clients.

--remote.user-oauth.automatic-setup

bool

Ask the gateway to set OAuth up for this server instead of attaching an existing provider. (true when set; pass --remote.user-oauth.automatic-setup=false to disable).

--managed.config

types

Type-specific configuration for the managed MCP server. (protojson with an "@type": a short type name (run the resource’s types command) or a full type URL).

-f, --filename

string

manifest to create from (YAML or JSON; "-" for stdin); flags override file values.

--dry-run

bool

print the request that would be sent (with the computed update mask) and exit without calling the server.

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.