MCP Server (For AI Assistants)

AetherLake includes a built-in Model Context Protocol (MCP) server, allowing AI assistants like Claude, Cursor, or Windsurf to directly interact with your data platform.

Supported Tools

• get_platform_status: Check the health of all AetherLake components.
• get_service_logs: Fetch real-time logs from any service (e.g., Trino, Airflow).
• restart_service: Safely restart a specific component.
• query_trino: Execute SQL queries against your Data Lakehouse.
• list_catalogs: View Iceberg catalogs via Apache Polaris.
• list_airflow_dags / trigger_airflow_dag: Manage your data pipelines.

Configuring Claude Desktop

Add the following to your claude_desktop_config.json. Trino serves HTTPS only; point TRINO_URL at the in-cluster service (when the MCP server runs in the cluster) or a local port-forward of the TLS port, and authenticate as the mcp service user:

# Keep this running while the MCP server is used:
kubectl port-forward -n aetherlake svc/core-data-stack-trino 8443:8443

# One-time: the mcp user's password (randomly generated by install.sh)
kubectl get secret aetherlake-credentials -n aetherlake \
  -o jsonpath='{.data.trino-mcp-password}' | base64 -d

# One-time: Node must trust the self-signed AetherLake CA. Export it and
# start the MCP server with NODE_EXTRA_CA_CERTS pointing at the file:
kubectl get secret aetherlake-root-ca -n cert-manager \
  -o jsonpath='{.data.ca\.crt}' | base64 -d > ~/.aetherlake-ca.crt

{
  "mcpServers": {
    "aetherlake": {
      "command": "node",
      "args": ["/path/to/AetherLake/mcp-server/dist/index.js"],
      "env": {
        "AETHERLAKE_NAMESPACE": "aetherlake",
        "TRINO_URL": "https://localhost:8443",
        "TRINO_BASIC_AUTH": "mcp:<trino-mcp-password>",
        "NODE_EXTRA_CA_CERTS": "/Users/<you>/.aetherlake-ca.crt",
        "POLARIS_URL": "http://polaris.aetherlake.local",
        "AIRFLOW_URL": "http://airflow.aetherlake.local",
        "AIRFLOW_AUTH": "admin:your-airflow-password"
      }
    }
  }
}

Make sure to run npm install and npm run build in the mcp-server directory first.

Environment variables

Variable	Default	Description
AETHERLAKE_NAMESPACE	aetherlake	Kubernetes namespace to operate against
TRINO_URL	http://trino.aetherlake.local	Trino coordinator base URL. The ingress host is gated by Keycloak SSO (oauth2-proxy), which non-interactive clients cannot pass, and Trino itself only accepts authenticated TLS — use https://core-data-stack-trino:8443 in-cluster or an 8443 port-forward
TRINO_BASIC_AUTH	(required for Trino tools)	user:password for Trino's PASSWORD (file) authenticator — Trino rejects unauthenticated requests. Use mcp:<trino-mcp-password>; the mcp user is read-only (Trino — Authorization)
NODE_EXTRA_CA_CERTS	(unset)	Path to the AetherLake root CA (aetherlake-root-ca secret in cert-manager), required for https:// Trino URLs
POLARIS_URL	http://polaris.aetherlake.local	Apache Polaris REST catalog base URL
AIRFLOW_URL	http://airflow.aetherlake.local	Airflow webserver base URL
AIRFLOW_AUTH	(required for Airflow tools)	Airflow basic-auth user:password, used for DAG operations

NOTE

AIRFLOW_AUTH has no default. The Airflow tools (list_airflow_dags, trigger_airflow_dag) return a clear error until it is set.