@confluentinc/mcp-confluent 1.2.1 → 1.3.0

package/README.md

@@ -1,547 +1,214 @@
-# mcp-confluent
+# Confluent MCP Server
 
 [![npm version](https://img.shields.io/npm/v/@confluentinc/mcp-confluent.svg)](https://www.npmjs.com/package/@confluentinc/mcp-confluent)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
-An [MCP server](https://modelcontextprotocol.io/) that enables AI assistants to interact with Confluent Cloud through natural language. It provides 37+ tools across Kafka, Flink SQL, Schema Registry, Connectors, Tableflow, and more -- usable from any MCP-compatible client including Claude Desktop, Claude Code, Cursor, VS Code, Goose, and Gemini CLI.
+An open-source [MCP server](https://modelcontextprotocol.io/) that enables AI assistants to interact with Confluent Cloud, Confluent Platform, and standalone Apache Kafka deployments through natural language.
+It provides 50+ tools across Kafka, Flink SQL, Schema Registry, Connectors, Tableflow, and more -- usable from any MCP-compatible client including Claude Desktop, Claude Code, Cursor, VS Code, Goose, and Gemini CLI.
 
-<a href="https://glama.ai/mcp/servers/@confluentinc/mcp-confluent">
-  <img width="380" height="200" src="https://glama.ai/mcp/servers/@confluentinc/mcp-confluent/badge" alt="mcp-confluent MCP server" />
-</a>
-
-[![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/confluentinc/mcp-confluent)
-
-## Demo
-
-### Goose CLI
-
-![Goose CLI Demo](assets/goose-cli-demo.gif)
+## Quick Start
 
-### Claude Desktop
+> **Prerequisites:** [Node.js 22+](https://nodejs.org/).
+> If you want to interact with [Confluent Cloud](https://confluent.cloud/), you need to create an account first.
 
-![Claude Desktop Demo](assets/claude-desktop-demo.gif)
+1. Generate a quick `config.yaml` file in your project root:
 
-## Quick Start
+```bash
+npx @confluentinc/mcp-confluent --init-config
+```
 
-> **Prerequisites:** [Node.js 22+](https://nodejs.org/) and a [Confluent Cloud](https://confluent.cloud/) account.
+2. Edit the `config.yaml` file with your connection details, then:
 
 ```bash
-# Install and run
-npx -y @confluentinc/mcp-confluent -e /path/to/.env
+npx @confluentinc/mcp-confluent --config ./config.yaml
 ```
 
-Or install the [npm package](https://www.npmjs.com/package/@confluentinc/mcp-confluent) directly. See [Getting Started](#getting-started) for full setup instructions and [Configuring MCP Clients](#configuring-claude-desktop) for integration with your preferred AI tool.
+See [Getting Started](#getting-started) for full setup instructions and [Configuring MCP Clients](#configuring-mcp-clients) for integration with your preferred AI tool.
 
 ## Table of Contents
 
 - [Quick Start](#quick-start)
 - [Available Tools](#available-tools)
+  - [Always Available](#always-available-tools)
   - [Confluent Cloud](#available-tools-for-confluent-cloud)
-  - [Local Confluent](#available-tools-for-local-confluent)
-- [User Guide](#user-guide)
-  - [Getting Started](#getting-started)
-  - [Configuration](#configuration)
-  - [Authentication for HTTP/SSE Transports](#authentication-for-httpsse-transports)
-  - [Environment Variables Reference](#environment-variables-reference)
-  - [Usage](#usage)
-  - [Configuring MCP Clients](#configuring-claude-desktop)
-  - [CLI Usage](#mcp-confluent-cli-usage)
-- [Flink Example Workflows](#flink-example-workflows)
-- [Developer Guide](#developer-guide)
-  - [Local Development with an MCP Client](#local-development-with-an-mcp-client)
+  - [Local deployments](#available-tools-for-local-deployments)
+- [Getting Started](#getting-started)
+- [Configuration](#configuration)
+- [OAuth Authentication for Confluent Cloud](#oauth-authentication-for-confluent-cloud)
+- [CLI Usage](#cli-usage)
+- [Configuring MCP Clients](#configuring-mcp-clients)
+- [Telemetry](#telemetry)
 - [Troubleshooting](#troubleshooting)
+- [Contributing](#contributing)
 
 ## Available Tools
 
-Only the tools whose required environment variables are configured will be enabled. You can also list all available tools via the CLI:
+Tools are auto-enabled based on which service blocks are present in your resolved configuration; see [CONFIGURATION.md](CONFIGURATION.md#tool-enablement-which-block-lights-up-what) for the full block-to-tool mapping.
+
+You can list all available tools via the CLI:
 
 ```bash
 npx -y @confluentinc/mcp-confluent --list-tools
 ```
 
+### Always-Available Tools
+
+These tools need no service blocks or authentication — they're enabled even on a bare config, regardless of which deployment the rest of your config targets.
+
+| Category          | Tools                                         | Description                                               |
+| ----------------- | --------------------------------------------- | --------------------------------------------------------- |
+| **Documentation** | `search-product-docs`, `get-product-doc-page` | Search Confluent product docs and fetch full page content |
+| **Diagnostics**   | `explain-disabled-tools`                      | Explain why specific tools are absent from `tools/list`   |
+
 ### Available Tools for Confluent Cloud
 
-These tools require endpoints and authentication against specific Confluent Cloud components. Refer to [`.env.example`](.env.example) for the full set of configuration variables.
-
-| Category                    | Tools                                                                                                                                                                                               | Description                                                       |
-| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
-| **Kafka**                   | `list-topics`, `create-topics`, `delete-topics`, `produce-message`, `consume-messages`, `alter-topic-config`, `get-topic-config`                                                                    | Manage topics, produce/consume messages, configure topic settings |
-| **Flink SQL**               | `create-flink-statement`, `list-flink-statements`, `read-flink-statement`, `delete-flink-statements`, `get-flink-statement-exceptions`                                                              | Create and manage Flink SQL statements                            |
-| **Flink Catalog**           | `list-flink-catalogs`, `list-flink-databases`, `list-flink-tables`, `describe-flink-table`, `get-flink-table-info`                                                                                  | Explore Flink catalogs, databases, and table schemas              |
-| **Flink Diagnostics**       | `check-flink-statement-health`, `detect-flink-statement-issues`, `get-flink-statement-profile`                                                                                                      | Health checks, issue detection, and query profiling               |
-| **Connectors**              | `list-connectors`, `read-connector`, `create-connector`, `delete-connector`                                                                                                                         | Manage Kafka Connect connectors                                   |
-| **Schema Registry**         | `list-schemas`, `delete-schema`                                                                                                                                                                     | List, inspect, and delete data schemas                            |
-| **Catalog & Tags**          | `search-topics-by-tag`, `search-topics-by-name`, `create-topic-tags`, `delete-tag`, `remove-tag-from-entity`, `add-tags-to-topic`, `list-tags`                                                      | Organize and search topics using tags                             |
-| **Environments & Clusters** | `list-environments`, `read-environment`, `list-clusters`                                                                                                                                            | Discover Confluent Cloud resources                                |
-| **Tableflow**               | `create-tableflow-topic`, `list-tableflow-topics`, `read-tableflow-topic`, `update-tableflow-topic`, `delete-tableflow-topic`, `list-tableflow-regions`                                             | Manage Tableflow-enabled topics                                   |
-| **Tableflow Catalog**       | `create-tableflow-catalog-integration`, `list-tableflow-catalog-integrations`, `read-tableflow-catalog-integration`, `update-tableflow-catalog-integration`, `delete-tableflow-catalog-integration` | Manage Tableflow catalog integrations (e.g., AWS Glue)            |
-| **Metrics**                 | `list-available-metrics`, `query-metrics`                                                                                                                                                           | Discover and query Confluent Cloud operational metrics            |
-| **Billing**                 | `list-billing-costs`                                                                                                                                                                                | Query billing and cost data                                       |
-
-### Available Tools for Local Confluent
-
-These tools only require Kafka or Schema Registry endpoints - no Confluent Cloud API key/secret is needed. Ideal for local development with Docker Compose or self-managed clusters.
-
-```properties
-# minimal .env for local development
-BOOTSTRAP_SERVERS="localhost:9092"
-SCHEMA_REGISTRY_ENDPOINT="http://localhost:8081"
-```
+These tools require endpoints and authentication against specific Confluent Cloud components.
+Refer to [`config.example.yaml`](config.example.yaml) for the full set of configuration variables.
+Categories marked with ¹ also work with [OAuth authentication](#oauth-authentication-for-confluent-cloud) — sign in via your browser instead of provisioning API keys.
+
+| Category                                     | Tools                                                                                                                                                                                               | Description                                                       |
+| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------- |
+| **Kafka** ¹                                  | `list-topics`, `create-topics`, `delete-topics`, `produce-message`, `consume-messages`, `alter-topic-config`, `get-topic-config`                                                                    | Manage topics, produce/consume messages, configure topic settings |
+| **Flink SQL**                                | `create-flink-statement`, `list-flink-statements`, `read-flink-statement`, `delete-flink-statements`, `get-flink-statement-exceptions`                                                              | Create and manage Flink SQL statements                            |
+| **Flink Catalog**                            | `list-flink-catalogs`, `list-flink-databases`, `list-flink-tables`, `describe-flink-table`, `get-flink-table-info`                                                                                  | Explore Flink catalogs, databases, and table schemas              |
+| **Flink Diagnostics**                        | `check-flink-statement-health`, `detect-flink-statement-issues`, `get-flink-statement-profile`                                                                                                      | Health checks, issue detection, and query profiling               |
+| **Connectors**                               | `list-connectors`, `read-connector`, `create-connector`, `delete-connector`                                                                                                                         | Manage Kafka Connect connectors                                   |
+| **Schema Registry** ¹                        | `list-schemas`, `delete-schema`                                                                                                                                                                     | List, inspect, and delete data schemas                            |
+| **Catalog & Tags**                           | `search-topics-by-tag`, `search-topics-by-name`, `create-topic-tags`, `delete-tag`, `remove-tag-from-entity`, `add-tags-to-topic`, `list-tags`                                                      | Organize and search topics using tags                             |
+| **Organizations, Environments & Clusters** ¹ | `list-organizations`, `list-environments`, `read-environment`, `list-clusters`                                                                                                                      | Discover Confluent Cloud resources                                |
+| **Tableflow**                                | `create-tableflow-topic`, `list-tableflow-topics`, `read-tableflow-topic`, `update-tableflow-topic`, `delete-tableflow-topic`, `list-tableflow-regions`                                             | Manage Tableflow-enabled topics                                   |
+| **Tableflow Catalog**                        | `create-tableflow-catalog-integration`, `list-tableflow-catalog-integrations`, `read-tableflow-catalog-integration`, `update-tableflow-catalog-integration`, `delete-tableflow-catalog-integration` | Manage Tableflow catalog integrations (e.g., AWS Glue)            |
+| **Metrics**                                  | `list-available-metrics`, `query-metrics`                                                                                                                                                           | Discover and query Confluent Cloud operational metrics            |
+| **Billing** ¹                                | `list-billing-costs`                                                                                                                                                                                | Query billing and cost data                                       |
+
+¹ Also available under OAuth — see [OAuth Authentication for Confluent Cloud](#oauth-authentication-for-confluent-cloud) for setup and caveats.
+Categories not marked currently require a `direct` connection with static API keys; OAuth migration is in progress.
+
+### Available Tools for local deployments
+
+These tools only require Kafka or Schema Registry endpoints - no Confluent Cloud API key/secret is needed.
+Ideal for local development with self-managed clusters, including Confluent Platform.
+
+```yaml
+# minimal config.yaml for local development
+connections:
+  local:
+    type: direct
+    kafka:
+      bootstrap_servers: "localhost:9092"
+    schema_registry:
+      endpoint: "http://localhost:8081"
+```
+
+Ready-to-use variants live in [`sample_configs/`](sample_configs/).
 
 | Category            | Tools                                                                                  | Description                             |
 | ------------------- | -------------------------------------------------------------------------------------- | --------------------------------------- |
 | **Kafka**           | `list-topics`, `create-topics`, `delete-topics`, `produce-message`, `consume-messages` | Manage topics, produce/consume messages |
 | **Schema Registry** | `list-schemas`, `delete-schema`                                                        | List, inspect, and delete data schemas  |
 
-## User Guide
-
-### Getting Started
+## Getting Started
 
-#### Prerequisites
+### Prerequisites
 
 - **Node.js 22 or later** -- we recommend using [NVM](https://github.com/nvm-sh/nvm) to manage versions:
   ```bash
   nvm install 22
   nvm use 22
   ```
-- A **Confluent Cloud** account with appropriate API keys
-
-#### Setup
-
-1. **Create a `.env` file:** Copy the provided `.env.example` file to `.env` in the root of your project:
-   ```bash
-   cp .env.example .env
-   ```
-2. **Populate the `.env` file:** Fill in the necessary values for your Confluent Cloud environment. See the [Configuration](#configuration) section for details on each variable.
-
-### Configuration
-
-Copy `.env.example` to `.env` in the root directory and fill in your values. See the example structure below:
-
-<details>
-<summary>Example .env file structure</summary>
-
-```properties
-# .env file
-BOOTSTRAP_SERVERS="pkc-v12gj.us-east4.gcp.confluent.cloud:9092"
-KAFKA_API_KEY="..."
-KAFKA_API_SECRET="..."
-KAFKA_REST_ENDPOINT="https://pkc-v12gj.us-east4.gcp.confluent.cloud:443"
-KAFKA_CLUSTER_ID=""
-KAFKA_ENV_ID="env-..."
-FLINK_ENV_ID="env-..."
-FLINK_ORG_ID=""
-FLINK_REST_ENDPOINT="https://flink.us-east4.gcp.confluent.cloud"
-FLINK_ENV_NAME=""
-FLINK_DATABASE_NAME=""
-FLINK_API_KEY=""
-FLINK_API_SECRET=""
-FLINK_COMPUTE_POOL_ID="lfcp-..."
-TABLEFLOW_API_KEY=""
-TABLEFLOW_API_SECRET=""
-CONFLUENT_CLOUD_API_KEY=""
-CONFLUENT_CLOUD_API_SECRET=""
-CONFLUENT_CLOUD_REST_ENDPOINT="https://api.confluent.cloud"
-SCHEMA_REGISTRY_API_KEY="..."
-SCHEMA_REGISTRY_API_SECRET="..."
-SCHEMA_REGISTRY_ENDPOINT="https://psrc-zv01y.northamerica-northeast2.gcp.confluent.cloud"
-```
-
-</details>
-
-#### Prerequisites & Setup for Tableflow Commands
-
-In order to leverage **Tableflow commands** to interact with your data ecosystem and successfully execute these Tableflow commands and manage resources (e.g., interacting with data storage like AWS S3 and metadata catalogs like AWS Glue), certain **IAM (Identity and Access Management) permissions** and configurations are essential.
-
-It is crucial to set up the necessary roles and policies in your cloud environment (e.g., AWS) and link them correctly within Confluent Cloud. This ensures your Flink SQL cluster, which powers Tableflow, has the required authorization to perform operations on your behalf.
-
-Please refer to the following Confluent Cloud documentation for detailed instructions on setting up these permissions and integrating with custom storage and Glue:
+- A local environment with Kafka or Schema Registry running, or a **Confluent Cloud** account with appropriate API keys or login credentials if [using OAuth to authenticate](#oauth-authentication-for-confluent-cloud).
 
-- **Confluent Cloud Tableflow Quick Start with Custom Storage & Glue:**
-  [https://docs.confluent.io/cloud/current/topics/tableflow/get-started/quick-start-custom-storage-glue.html](https://docs.confluent.io/cloud/current/topics/tableflow/get-started/quick-start-custom-storage-glue.html)
+### General Setup Steps
 
-Ensuring these prerequisites are met will prevent authorization errors when the `mcp-server` attempts to provision or manage Tableflow-enabled tables.
+This MCP server is designed to be used with various MCP clients, such as Claude Desktop, Copilot, or Goose CLI/Desktop.
+The specific configuration and interaction will depend on the client you are using.
 
-### Authentication for HTTP/SSE Transports
+The MCP server can authenticate to Confluent Cloud via **OAuth (PKCE)** in addition to static API keys defined in the YAML config.
+See [OAuth Authentication For Confluent Cloud](#oauth-authentication-for-confluent-cloud) for more details.
 
-When using HTTP or SSE transports, the MCP server requires API key authentication to prevent unauthorized access and protect against DNS rebinding attacks. This is **enabled by default**.
+The general steps to configure (if not using OAuth) and run this MCP are:
 
-#### Generating an API Key
-
-Generate a secure API key using the built-in utility:
+1. **Create a configuration file:** Copy the provided [`config.yaml` example](https://github.com/confluentinc/mcp-confluent/blob/main/config.example.yaml) file to the root of your project.
+   You can use the CLI to bootstrap one in your current directory — no git checkout required:
 
 ```bash
-npx @confluentinc/mcp-confluent --generate-key
-```
-
-This will output a 64-character key generated using secure cryptography:
-
-```
-Generated MCP API Key:
-================================================================
-a1b2c3d4e5f6...your-64-char-key-here...
-================================================================
-
-```
-
-#### Configuring Authentication
-
-Add the generated key to your `.env` file:
-
-```properties
-# MCP Server Authentication (required for HTTP/SSE transports)
-MCP_API_KEY=your-generated-64-char-key-here
+npx @confluentinc/mcp-confluent --init-config
 ```
 
-#### Making Authenticated Requests
-
-Include the API key in the `cflt-mcp-api-Key` header for all HTTP/SSE requests:
-
-```bash
-curl -H "cflt-mcp-api-Key: your-api-key" http://localhost:8080/mcp
-```
+2. **Populate the file:** Fill in the necessary values for your Confluent Cloud environment.
+   See [CONFIGURATION.md](CONFIGURATION.md) for the full reference; only fill in the service blocks you need (each one enables a group of tools).
 
-#### DNS Rebinding Protection
-
-The server includes additional protections against DNS rebinding attacks:
-
-- **Host Header Validation**: Only requests with allowed Host headers are accepted
-
-Configure allowed hosts if needed:
-
-```properties
-# Allow additional hosts (comma-separated)
-MCP_ALLOWED_HOSTS=localhost,127.0.0.1,myhost.local
-```
-
-#### Additional security to prevent internet exposure of MCP server
-
-- **Localhost Binding**: Server binds to `127.0.0.1` by default (not `0.0.0.0`)
-
-#### Disabling Authentication (Development Only)
-
-For local development, you can disable authentication:
-
-```bash
-# Via CLI flag
-npx @confluentinc/mcp-confluent -e .env --transport http --disable-auth
-
-# Or via environment variable
-MCP_AUTH_DISABLED=true
-```
-
-> [!WARNING]
-> Never disable authentication in production or when the server is network-accessible.
-
-### Environment Variables Reference
-
-| Variable                      | Description                                                                                                                                                                                                                                                       | Default Value                           | Required |
-| ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------- | -------- |
-| HTTP_HOST                     | Host to bind for HTTP transport. Defaults to localhost only for security.                                                                                                                                                                                         | "127.0.0.1"                             | Yes      |
-| HTTP_MCP_ENDPOINT_PATH        | HTTP endpoint path for MCP transport (e.g., '/mcp') (string)                                                                                                                                                                                                      | "/mcp"                                  | Yes      |
-| HTTP_PORT                     | Port to use for HTTP transport (number (min: 0))                                                                                                                                                                                                                  | 8080                                    | Yes      |
-| LOG_LEVEL                     | Log level for application logging (trace, debug, info, warn, error, fatal)                                                                                                                                                                                        | "info"                                  | Yes      |
-| MCP_API_KEY                   | API key for HTTP/SSE authentication. Generate using `--generate-key`. Required when auth is enabled.                                                                                                                                                              |                                         | No\*     |
-| MCP_AUTH_DISABLED             | Disable authentication for HTTP/SSE transports. WARNING: Only use in development environments.                                                                                                                                                                    | false                                   | No       |
-| MCP_ALLOWED_HOSTS             | Comma-separated list of allowed Host header values for DNS rebinding protection.                                                                                                                                                                                  | "localhost,127.0.0.1"                   | No       |
-| SSE_MCP_ENDPOINT_PATH         | SSE endpoint path for establishing SSE connections (e.g., '/sse', '/events') (string)                                                                                                                                                                             | "/sse"                                  | Yes      |
-| SSE_MCP_MESSAGE_ENDPOINT_PATH | SSE message endpoint path for receiving messages (e.g., '/messages', '/events/messages') (string)                                                                                                                                                                 | "/messages"                             | Yes      |
-| BOOTSTRAP_SERVERS             | List of Kafka broker addresses in the format host1:port1,host2:port2 used to establish initial connection to the Kafka cluster (string)                                                                                                                           |                                         | No       |
-| CONFLUENT_CLOUD_API_KEY       | Master API key for Confluent Cloud platform administration, enabling management of resources across your organization (string (min: 1))                                                                                                                           |                                         | No       |
-| CONFLUENT_CLOUD_API_SECRET    | Master API secret paired with CONFLUENT_CLOUD_API_KEY for comprehensive Confluent Cloud platform administration (string (min: 1))                                                                                                                                 |                                         | No       |
-| CONFLUENT_CLOUD_REST_ENDPOINT | Base URL for Confluent Cloud's REST API services (default)                                                                                                                                                                                                        |                                         | No       |
-| FLINK_API_KEY                 | Authentication key for accessing Confluent Cloud's Flink services, including compute pools and SQL statement management (string (min: 1))                                                                                                                         |                                         | No       |
-| FLINK_API_SECRET              | Secret token paired with FLINK_API_KEY for authenticated access to Confluent Cloud's Flink services (string (min: 1))                                                                                                                                             |                                         | No       |
-| FLINK_COMPUTE_POOL_ID         | Unique identifier for the Flink compute pool, must start with 'lfcp-' prefix (string)                                                                                                                                                                             |                                         | No       |
-| FLINK_DATABASE_NAME           | Name of the associated Kafka cluster used as a database reference in Flink SQL operations (string (min: 1))                                                                                                                                                       |                                         | No       |
-| FLINK_ENV_ID                  | Unique identifier for the Flink environment, must start with 'env-' prefix (string)                                                                                                                                                                               |                                         | No       |
-| FLINK_ENV_NAME                | Human-readable name for the Flink environment used for identification and display purposes (string (min: 1))                                                                                                                                                      |                                         | No       |
-| FLINK_ORG_ID                  | Organization identifier within Confluent Cloud for Flink resource management (string (min: 1))                                                                                                                                                                    |                                         | No       |
-| FLINK_REST_ENDPOINT           | Base URL for Confluent Cloud's Flink REST API endpoints used for SQL statement and compute pool management (string)                                                                                                                                               |                                         | No       |
-| KAFKA_API_KEY                 | Authentication credential (username) required to establish secure connection with the Kafka cluster (string (min: 1))                                                                                                                                             |                                         | No       |
-| KAFKA_API_SECRET              | Authentication credential (password) paired with KAFKA_API_KEY for secure Kafka cluster access (string (min: 1))                                                                                                                                                  |                                         | No       |
-| KAFKA_CLUSTER_ID              | Unique identifier for the Kafka cluster within Confluent Cloud ecosystem (string (min: 1))                                                                                                                                                                        |                                         | No       |
-| KAFKA_ENV_ID                  | Environment identifier for Kafka cluster, must start with 'env-' prefix (string)                                                                                                                                                                                  |                                         | No       |
-| KAFKA_REST_ENDPOINT           | REST API endpoint for Kafka cluster management and administration (string)                                                                                                                                                                                        |                                         | No       |
-| SCHEMA_REGISTRY_API_KEY       | Authentication key for accessing Schema Registry services to manage and validate data schemas (string (min: 1))                                                                                                                                                   |                                         | No       |
-| SCHEMA_REGISTRY_API_SECRET    | Authentication secret paired with SCHEMA_REGISTRY_API_KEY for secure Schema Registry access (string (min: 1))                                                                                                                                                     |                                         | No       |
-| SCHEMA_REGISTRY_ENDPOINT      | URL endpoint for accessing Schema Registry services to manage data schemas (string)                                                                                                                                                                               |                                         | No       |
-| TABLEFLOW_API_KEY             | Authentication key for accessing Confluent Cloud's Tableflow services (string (min: 1))                                                                                                                                                                           |                                         | No       |
-| TABLEFLOW_API_SECRET          | Authentication secret paired with TABLEFLOW_API_KEY for secure Tableflow access (string (min: 1))                                                                                                                                                                 |                                         | No       |
-| TELEMETRY_ENDPOINT            | Base URL for Confluent Cloud Telemetry API (metrics)                                                                                                                                                                                                              | "https://api.telemetry.confluent.cloud" | No       |
-| TELEMETRY_API_KEY             | Optional API key for telemetry access. Falls back to CONFLUENT_CLOUD_API_KEY if not set. (See [Metrics API authentication docs](https://docs.confluent.io/cloud/current/monitoring/metrics-api.html#create-an-api-key-to-authenticate-to-the-metrics-api).)       |                                         | No       |
-| TELEMETRY_API_SECRET          | Optional API secret for telemetry access. Falls back to CONFLUENT_CLOUD_API_SECRET if not set. (See [Metrics API authentication docs](https://docs.confluent.io/cloud/current/monitoring/metrics-api.html#create-an-api-key-to-authenticate-to-the-metrics-api).) |                                         | No       |
-
-### Usage
-
-This MCP server is designed to be used with various MCP clients, such as Claude Desktop or Goose CLI/Desktop. The specific configuration and interaction will depend on the client you are using. However, the general steps are:
-
-1. **Start the Server:** You can run the MCP server in one of two ways:
-   - **From source:** Follow the instructions in the [Developer Guide](#developer-guide) to build and run the server from source. This typically involves:
+3. **Start the Server:** You can run the MCP server in one of two ways:
+   - **From source:** Follow the instructions in the [Contributing Guide](CONTRIBUTING.md) to build and run the server from source.
+        This typically involves:
      - Installing dependencies (`npm install`)
      - Building the project (`npm run build` or `npm run dev`)
-   - **With npx:** You can start the server directly using npx (no build required):
+   - **With npx:** You can start the server directly using npx, no build required:
 
      ```bash
-     npx -y @confluentinc/mcp-confluent -e /path/to/confluent-mcp-server/.env
+     npx @confluentinc/mcp-confluent --config /path/to/myconfig.yaml
      ```
 
-2. **Configure your MCP Client:** Each client will have its own way of specifying the MCP server's address and any required credentials. You'll need to configure your client (e.g., Claude, Goose) to connect to the address where this server is running (likely `localhost` with a specific port). The port the server runs on may be configured by an environment variable.
-
-3. **Start the MCP Client:** Once your client is configured to connect to the MCP server, you can start your mcp client and on startup - it will stand up an instance of this MCP server locally. This instance will be responsible for managing data schemas and interacting with Confluent Cloud on your behalf.
-
-4. **Interact with Confluent through the Client:** Once the client is connected, you can use the client's interface to interact with Confluent Cloud resources. The client will send requests to this MCP server, which will then interact with Confluent Cloud on your behalf.
-
-### Configuring Claude Desktop
-
-See [here](https://modelcontextprotocol.io/quickstart/user) for more details about installing Claude Desktop and MCP servers.
-
-To configure Claude Desktop to use this MCP server:
-
-1. **Open Claude Desktop Configuration**
-   - On Mac: `~/Library/Application\ Support/Claude/claude_desktop_config.json`
-   - On Windows: `%APPDATA%\Claude\claude_desktop_config.json`
-
-2. **Edit Configuration File**
-   - Open the config file in your preferred text editor
-   - Add or modify the configuration using one of the following methods:
-
-   <details>
-   <summary>Option 1: Run from source</summary>
-
-   ```json
-   {
-     "mcpServers": {
-       "confluent": {
-         "command": "node",
-         "args": [
-           "/path/to/confluent-mcp-server/dist/index.js",
-           "--env-file",
-           "/path/to/confluent-mcp-server/.env"
-         ]
-       }
-     }
-   }
-   ```
-
-   </details>
-
-   <details>
-   <summary>Option 2: Run from npx</summary>
-
-   ```json
-   {
-     "mcpServers": {
-       "confluent": {
-         "command": "npx",
-         "args": [
-           "-y",
-           "@confluentinc/mcp-confluent",
-           "-e",
-           "/path/to/confluent-mcp-server/.env"
-         ]
-       }
-     }
-   }
-   ```
-
-   </details>
-
-   Replace `/path/to/confluent-mcp-server/` with the actual path where you've installed this MCP server.
-
-3. **Restart Claude Desktop**
-   - Close and reopen Claude Desktop for the changes to take effect
-   - The MCP server will automatically start when Claude Desktop launches
-
-Now Claude Desktop will be configured to use your local MCP server for Confluent interactions.
-
-![Claude Tools](assets/claude-tools.png)
-
-### Configuring Goose CLI
-
-See [here](https://block.github.io/goose/docs/quickstart#install-an-extension) for detailed instructions on how to install the Goose CLI.
-
-Once installed, follow these steps:
-
-1. **Run the Configuration Command:**
-
-   ```bash
-   goose configure
-   ```
-
-2. **Follow the Interactive Prompts:**
-   - Select `Add extension`
-   - Choose `Command-line Extension`
-   - Enter `mcp-confluent` as the extension name
-   - Choose one of the following configuration methods:
-
-   <details>
-   <summary>Option 1: Run from source</summary>
-
-   ```bash
-   node /path/to/confluent-mcp-server/dist/index.js --env-file /path/to/confluent-mcp-server/.env
-   ```
-
-   </details>
+4. **Configure your MCP Client:** Each client (e.g., Claude, Goose) will have its own way of specifying the MCP server's address and any required credentials.
+   You'll need to [configure your client](#configuring-mcp-clients) to connect to the address where this server is running (likely `localhost` with a specific port).
+   The port the server runs on is set via `server.http.port` in `config.yaml`.
 
-   <details>
-   <summary>Option 2: Run from npx</summary>
+5. **Start your MCP Client:** Once your client is configured to connect to the MCP server, you can start your MCP client and on startup it will stand up an instance of this MCP server locally.
+   This instance will be responsible for managing data schemas and interacting with resources on your behalf.
 
-   ```bash
-   npx -y @confluentinc/mcp-confluent -e /path/to/confluent-mcp-server/.env
-   ```
+6. **Interact with your resources through the Client:** Once the client is connected and configured, you can use the client's interface to interact with Confluent Cloud or local resources.
+   The client will send requests to this MCP server, which will then interact with the available connections on your behalf.
 
-   </details>
+## Configuration
 
-Replace `/path/to/confluent-mcp-server/` with the actual path where you've installed this MCP server.
+The full configuration reference — YAML schema, every service block, env-var interpolation, OAuth and HTTP/SSE auth setup, the (deprecated) legacy env-var table, and tool-to-block mapping — lives in [CONFIGURATION.md](CONFIGURATION.md).
 
-![Goose Configure](assets/goose-configure.png)
+> **Compatibility note.** This release ships full parity between YAML (`-c config.yaml`) and the legacy env-var path (`-e config.env`) for a single connection.
+> The env-var-only path will emit a startup warning in a near-future release and be removed a release or two later.
+> Multi-connection support (next release) will be YAML-only.
+> See [CONFIGURATION.md → Two paths, one configuration](CONFIGURATION.md#two-paths-one-configuration).
 
-### Configuring Gemini CLI
+### Prerequisites & setup for Tableflow commands
 
-For detailed information about Gemini CLI extensions and MCP servers, please refer to the official documentation:
+Tableflow tools interact with cloud storage (e.g. AWS S3) and a metadata catalog (e.g. AWS Glue) on your behalf via the Flink runtime in Confluent Cloud.
+The Flink runtime needs IAM permissions on your cloud account, and those have to be granted and linked into Confluent Cloud before any Tableflow tool will succeed.
 
-- [Gemini CLI Extensions](https://github.com/google-gemini/gemini-cli/blob/main/docs/extension.md)
-- [Gemini CLI MCP Server Tools](https://github.com/google-gemini/gemini-cli/blob/main/docs/tools/mcp-server.md)
+Follow the **[Tableflow quick start with custom storage & Glue](https://docs.confluent.io/cloud/current/topics/tableflow/get-started/quick-start-custom-storage-glue.html)** to set up the roles, policies, and provider integrations.
+Skipping this step leads to authorization errors when mcp-confluent tries to provision or manage Tableflow-enabled tables.
 
-Here's how to get `mcp-confluent` running with Gemini CLI:
+## OAuth Authentication for Confluent Cloud
 
-1. **Install Gemini CLI:**
-   If you haven't already, install the Gemini CLI. You can find installation instructions on the [official GitHub repository](https://github.com/google-gemini/gemini-cli).
+The MCP server can authenticate to Confluent Cloud via **OAuth (PKCE)** instead of static API keys.
+On the first tool call that needs Confluent access, the server opens your browser to the Confluent Cloud sign-in page; subsequent tool calls reuse the resulting session.
+No API keys to provision.
 
-2. **Install the `mcp-confluent` Extension:**
-
-   ```bash
-   gemini extensions install https://github.com/confluentinc/mcp-confluent
-   # Navigate to the root directory of this project (where `gemini-extension.json` is located) and run:
-   # gemini extensions install .
-   ```
-
-   This command registers the `mcp-confluent` server with Gemini CLI and creates a dedicated directory for it under `~/.gemini/extensions/mcp-confluent`.
-
-3. **Provide Environment Variables:**
-   The extension requires your Confluent Cloud credentials and configuration to be available in a `.env` file.
-   - First, ensure you have a correctly populated `.env` file in the root of this project. For instructions, see the [Configuration](#configuration) section.
-   - Next, copy your `.env` file into the extension's directory so Gemini CLI can access it (the Gemini extension expects the `.env` file at `${extensionPath}${pathSeparator}.env`; see [the variables documentation](https://github.com/google-gemini/gemini-cli/blob/main/docs/extensions/reference.md#variables) for details):
-
-   ```bash
-   cp .env ~/.gemini/extensions/mcp-confluent/.env
-   ```
-
-4. **Verify and Use:**
-   You can now start using the Confluent tools via Gemini CLI. To verify that the tools are available, you can list them:
-
-   ```bash
-   gemini -l
-   # or `gemini extensions list`
-   ```
-
-   And here's an example of invoking a tool:
-
-   ```bash
-
-   gemini
-   ....
-
-   🟢 mcp-confluent (from mcp-confluent) - Ready (24 tools)
-   ....
-
-   Using: 1 MCP server (ctrl+t to toggle)
-   ╭───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
-   │ > list topics                                                                                                                                             │
-   ╰───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
-
-   ╭────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
-   │ ✓  list-topics (mcp-confluent MCP Server) {}                                                                                                       │
-   │                                                                                                                                                    │
-   │    Kafka topics:                                                                                                                                   │
-   │    products_summarized,products,topic_8,products_summarized_with_embeddings,elastic_minimized,user_message_related_products,user_message_embeddin  │
-   │    gs,dlq-lcc-d3738o,user_message,elastic                                                                                          │
-   ╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
-   ✦ Okay, I see the following topics: products_summarized, products, topic_8, products_summarized_with_embeddings, elastic_minimized,
-     user_message_related_products, user_message_embeddings, dlq-lcc-d3738o, user_message, and elastic.
-
-   ```
-
-### Configuring Claude Code
-
-[Claude Code](https://docs.anthropic.com/en/docs/claude-code) supports MCP servers natively. Add the server to your project configuration:
+### Setup
 
 ```bash
-claude mcp add confluent -- npx -y @confluentinc/mcp-confluent -e /path/to/.env
+npx @confluentinc/mcp-confluent --init-oauth-config
+# edit ./config.yaml if needed, then:
+npx @confluentinc/mcp-confluent --config ./config.yaml
 ```
 
-Or add it to your `.mcp.json` file directly:
+`--init-oauth-config` drops a starter [`config.oauth.example.yaml`](config.oauth.example.yaml) into `./config.yaml`.
+The whole file is essentially:
 
-```json
-{
-  "mcpServers": {
-    "confluent": {
-      "command": "npx",
-      "args": ["-y", "@confluentinc/mcp-confluent", "-e", "/path/to/.env"]
-    }
-  }
-}
+```yaml
+connections:
+  ccloud-oauth:
+    type: oauth
 ```
 
-### Configuring Cursor
+See [CONFIGURATION.md → Authentication modes](CONFIGURATION.md#authentication-modes) for the full schema and ergonomics.
 
-Add the MCP server to your Cursor configuration at `~/.cursor/mcp.json`:
+The ¹-marked categories in [Available Tools for Confluent Cloud](#available-tools-for-confluent-cloud) work under OAuth today; everything else still needs a `direct` connection with static API keys.
 
-```json
-{
-  "mcpServers": {
-    "confluent": {
-      "command": "npx",
-      "args": ["-y", "@confluentinc/mcp-confluent", "-e", "/path/to/.env"]
-    }
-  }
-}
-```
-
-See the [Cursor MCP documentation](https://docs.cursor.com/context/model-context-protocol) for more details.
+## CLI Usage
 
-### Configuring VS Code
+The MCP server provides a flexible command line interface (CLI) for advanced control.
+The CLI lets you pick the config file, transports, and fine-tune which tools are enabled or blocked.
 
-Add the MCP server to your VS Code user settings (`settings.json`) or workspace `.vscode/mcp.json`:
-
-```json
-{
-  "mcp": {
-    "servers": {
-      "confluent": {
-        "command": "npx",
-        "args": ["-y", "@confluentinc/mcp-confluent", "-e", "/path/to/.env"]
-      }
-    }
-  }
-}
-```
-
-See the [VS Code MCP documentation](https://code.visualstudio.com/docs/copilot/chat/mcp-servers) for more details.
-
-### Configuring Windsurf
-
-Add the MCP server to your Windsurf configuration at `~/.codeium/windsurf/mcp_config.json`:
-
-```json
-{
-  "mcpServers": {
-    "confluent": {
-      "command": "npx",
-      "args": ["-y", "@confluentinc/mcp-confluent", "-e", "/path/to/.env"]
-    }
-  }
-}
-```
-
-See the [Windsurf MCP documentation](https://docs.windsurf.com/windsurf/mcp) for more details.
-
-### mcp-confluent CLI Usage
-
-The MCP server provides a flexible command line interface (CLI) for advanced configuration and control. The CLI allows you to specify environment files, transports, and fine-tune which tools are enabled or blocked.
-
-#### Basic Usage
+### Basic Usage
 
 You can view all CLI options and help with:
 
@@ -567,7 +234,6 @@ Options:
   --allow-tools-file <file>        File with tool names to allow (one per line). Used only if --allow-tools is not provided. Allow-list is applied before block-list.
   --block-tools-file <file>        File with tool names to block (one per line). Used only if --block-tools is not provided. Block-list is applied after allow-list.
   --list-tools                     Print the final set of enabled tool names (with descriptions) after allow/block filtering and exit. Does not start the server.
-  --disable-confluent-cloud-tools  Disable all tools that require Confluent Cloud REST APIs (cloud-only tools).
   --disable-auth                   Disable authentication for HTTP/SSE transports. WARNING: Only use in development environments.
   --allowed-hosts <hosts>          Comma-separated list of allowed Host header values for DNS rebinding protection.
   --generate-key                   Generate a secure API key for MCP_API_KEY and print it to stdout, then exit.
@@ -576,10 +242,10 @@ Options:
 
 </details>
 
-#### Example: Deploy using all transports
+### Example: Deploy using all transports
 
 ```bash
-npx @confluentinc/mcp-confluent -e .env --transport http,sse,stdio
+npx @confluentinc/mcp-confluent -c config.yaml --transport http,sse,stdio
 ```
 
 <details>
@@ -598,31 +264,31 @@ npx @confluentinc/mcp-confluent -e .env --transport http,sse,stdio
 
 </details>
 
-#### Example: Allow Only Specific Tools
+### Example: Allow Only Specific Tools
 
 ```bash
-npx @confluentinc/mcp-confluent -e .env --allow-tools produce-message,consume-messages
+npx @confluentinc/mcp-confluent -c config.yaml --allow-tools produce-message,consume-messages
 ```
 
 Only the specified tools will be enabled; all others will be disabled.
 
-#### Example: Block Certain Tools
+### Example: Block Certain Tools
 
 ```bash
-npx @confluentinc/mcp-confluent -e .env --block-tools produce-message,consume-messages
+npx @confluentinc/mcp-confluent -c config.yaml --block-tools produce-message,consume-messages
 ```
 
 All tools except the specified ones will be enabled.
 
-#### Example: Use Tool Lists from Files
+### Example: Use Tool Lists from Files
 
 You can also maintain allow/block lists in files (one tool name per line):
 
 ```bash
-npx -y @confluentinc/mcp-confluent -e .env --allow-tools-file allow.txt --block-tools-file block.txt
+npx -y @confluentinc/mcp-confluent -c config.yaml --allow-tools-file allow.txt --block-tools-file block.txt
 ```
 
-#### Example: List All Available Tools
+### Example: List All Available Tools
 
 ```bash
 npx -y @confluentinc/mcp-confluent --list-tools
@@ -678,340 +344,57 @@ list-tableflow-catalog-integrations: Retrieve a sorted, filtered, paginated list
 read-tableflow-catalog-integration: Make a request to read a catalog integration.
 update-tableflow-catalog-integration: Make a request to update a catalog integration.
 delete-tableflow-catalog-integration: Make a request to delete a tableflow catalog integration.
+list-organizations: List Confluent Cloud organizations the current credentials can see. Paginated; if the response includes a nextPageToken, pass it back as pageToken to fetch additional pages.
+explain-disabled-tools: Call when the user asks why a tool is missing or unavailable (e.g., "why can't I list Kafka topics?", "where are the Flink tools?"). Returns disabled tools grouped by the config gap each one is waiting on, so you can tell the user the exact YAML block or field to add. Prefer this over guessing about credentials, network, or auth.
 ```
 
 </details>
 
-> **Tip:** The allow-list is applied before the block-list. If neither is provided, all tools are enabled by default.
-
-## Flink Example Workflows
-
-Examples of how the Flink tools (see [Available Tools](#available-tools)) work together in practice.
-
-#### Deduplication Workflow
-
-```
-User: "I want to deduplicate events from my_topic"
-        ↓
-Claude: Uses describe-flink-table → gets schema (event_id, user_id, ...)
-        ↓
-Claude: "Which field should I deduplicate on?"
-        ↓
-User: "event_id"
-        ↓
-Claude: Generates SQL using ROW_NUMBER() pattern
-        ↓
-Claude: Uses create-flink-statement → submits query
-        ↓
-Claude: Uses check-flink-statement-health → monitors status
-        ↓
-Claude: "Running successfully!"
-```
-
-#### Debugging a Failed Statement
-
-```
-User: "My statement xyz is failing. What's wrong?"
-        ↓
-Claude: Uses get-flink-statement-exceptions → gets error details
-        ↓
-Claude: Uses detect-flink-statement-issues → analyzes status, exceptions, metrics
-        ↓
-Claude: Uses get-flink-statement-profile → gets task-level metrics
-        ↓
-Claude: "The statement has high backpressure on task 'Sink'. Try increasing parallelism..."
-```
-
-## Metrics Example Workflows
-
-The `list-available-metrics` and `query-metrics` tools work together to let AI assistants monitor your Confluent Cloud resources. The discovery tool ensures the assistant uses valid metric names and filter fields rather than guessing.
-
-#### Kafka Topic Throughput
-
-```
-User: "What's the throughput on topic sensor-readings over the last hour?"
-        ↓
-Claude: Uses list-available-metrics(resource_type: "kafka") → discovers metric names & filters
-        ↓
-Claude: Uses query-metrics(metric: "io.confluent.kafka.server/received_bytes",
-        filter: {"metric.topic": "sensor-readings"}) → gets time-series data
-        ↓
-Claude: "sensor-readings is receiving ~14.3 KB/min steadily over the last hour."
-```
-
-#### Flink Compute Pool Utilization
-
-```
-User: "How many CFUs is my Flink compute pool using?"
-        ↓
-Claude: Uses list-available-metrics(resource_type: "compute_pool") → discovers CFU metrics
-        ↓
-Claude: Uses query-metrics(metric: "io.confluent.flink/compute_pool_utilization/current_cfus",
-        filter: {"resource.compute_pool.id": "lfcp-..."}, granularity: "PT1H",
-        interval: "<7-day range>") → gets usage trend
-        ↓
-Claude: "Your compute pool is using 1 CFU consistently."
-```
-
-#### Consumer Lag Monitoring
-
-```
-User: "Is there any consumer lag on the sensor-readings topic?"
-        ↓
-Claude: Uses query-metrics(metric: "io.confluent.kafka.server/consumer_lag_offsets",
-        filter: {"metric.topic": "sensor-readings"},
-        group_by: ["metric.consumer_group_id"]) → gets lag per consumer group
-        ↓
-Claude: "Consumer group 'analytics' has 1,200 offsets of lag."
-```
-
-> **Note:** Kafka server metrics (e.g., `io.confluent.kafka.server/received_bytes`) require `CONFLUENT_CLOUD_API_KEY` and `CONFLUENT_CLOUD_API_SECRET`. The `KAFKA_CLUSTER_ID` environment variable is auto-injected as a filter when querying Kafka metrics. Flink compute pool metrics report at hourly granularity, so queries may need a wider time window than the default 1 hour.
-
-## Developer Guide
-
-### Project Structure
-
-```sh
-/
-├── src/                    # Source code
-│   ├── index.ts                # Main entry point
-│   ├── cli.ts                  # CLI argument parsing
-│   ├── env.ts                  # Environment initialization
-│   ├── env-schema.ts           # Environment variable schema (Zod)
-│   ├── logger.ts               # Logger configuration
-│   ├── confluent/              # Confluent integration
-│   │   ├── client-manager.ts       # API client management
-│   │   ├── schema-registry-helper.ts
-│   │   └── tools/
-│   │       ├── base-tools.ts        # Base handler class
-│   │       ├── tool-factory.ts      # Tool registry
-│   │       ├── tool-name.ts         # Tool name enum
-│   │       └── handlers/
-│   │           ├── billing/         # Billing tools
-│   │           ├── catalog/         # Catalog & tag tools
-│   │           ├── clusters/        # Cluster tools
-│   │           ├── connect/         # Connector tools
-│   │           ├── environments/    # Environment tools
-│   │           ├── flink/           # Flink SQL, catalog & diagnostics tools
-│   │           ├── kafka/           # Kafka topic & message tools
-│   │           ├── metrics/         # Telemetry API metrics tools
-│   │           ├── schema/          # Schema Registry tools
-│   │           ├── search/          # Search tools
-│   │           └── tableflow/       # Tableflow topic & catalog tools
-│   └── mcp/                    # MCP protocol and transport logic
-│       └── transports/
-│           ├── http.ts              # HTTP transport
-│           ├── sse.ts               # SSE transport
-│           ├── stdio.ts             # STDIO transport
-│           ├── auth.ts              # Authentication middleware
-│           └── manager.ts           # Transport manager
-├── dist/                   # Compiled output
-├── openapi.json            # OpenAPI specification for Confluent Cloud
-├── .env.example            # Example environment variables
-├── README.md               # This file
-└── package.json            # Node.js project metadata and dependencies
-```
-
-### Building and Running
-
-1. **Install Dependencies:**
-
-   ```bash
-   npm install
-   ```
-
-2. **Development Mode (watch for changes):**
-
-   ```bash
-   npm run dev
-   ```
-
-   This command compiles the TypeScript code to JavaScript and automatically rebuilds when changes are detected in the `src/` directory.
-
-3. **Production Build (one-time compilation):**
-
-   ```bash
-   npm run build
-   ```
-
-4. **Start the Server:**
-
-   ```bash
-   npm run start
-   ```
-
-### Docker
-
-#### Prerequisites
-
-Before you begin, ensure you have the following installed on your system:
-
-Docker Desktop (or Docker Engine and Docker Compose): <https://www.docker.com/products/docker-desktop>
-
-##### Environment Variables
-
-The MCP server requires several environment variables to connect to Confluent Cloud and other relevant services. These should be provided in the `.env` file in the root directory of this project. Or you can add them directly in the `docker-compose.yml`
-
-#### Building and Running with Docker
-
-Here's how to build your Docker image and run it in different modes.
-
-1. **Navigate to your project directory.** Open your terminal or command prompt and change to the directory containing the `Dockerfile`.
-
-   ```bash
-   cd /path/to/repo/mcp-confluent
-   ```
-
-2. **Build the Docker image.**
+> **Tip:** The allow-list is applied before the block-list.
+> If neither is provided, all tools are enabled by default.
 
-   This command creates the `mcp-server` image based on the `Dockerfile` in the current directory.
+## Configuring MCP Clients
 
-   ```bash
-   docker build -t mcp-server .
-   ```
+Please refer to the following guides for step-by-step instructions on setting up and using this MCP server with your preferred client:
 
-3. **Run the container**
-   - `--rm`: **Automatically removes the container** when it exits. This helps keep your system clean.
-   - `-i`: Keeps **STDIN open** (runs the server using stdio transport by default).
-   - `-d`: Runs the container in **detached mode** (in the background).
-   - `-p 8080:8080`: **Maps port 8080** on your host machine to port 8080 inside the container. The default HTTP_PORT is 8080; adjust if you've configured a different port.
-
-   ```bash
-   docker run --rm -i -d -p 8080:8080 mcp-server
-   ```
-
-   (Optional)
-   - `-t` **Transport Mode** to enable http transport
-
-   ```bash
-   docker run --rm -d -p 8080:8080 mcp-server -t http
-   ```
-
-#### Building and Running with Docker Compose
-
-1. **Navigate to the project root:**
-   Open your terminal or command prompt and change to the directory containing Dockerfile and docker-compose.yml.
-
-   ```bash
-   cd /path/to/repo/mcp-confluent
-   ```
-
-2. **Build and run the service:**
-   Docker Compose will build the Docker image (if not already built) and start the mcp-server service.
-
-   ```bash
-   docker compose up --build
-   ```
-
-   The --build flag ensures that Docker Compose rebuilds the image before starting the container. You can omit this flag on subsequent runs if you haven't changed the Dockerfile or source code.
-
-   The server will be accessible on <http://localhost:8080> (or the port specified in HTTP_PORT in your .env file).
-
-3. **Stopping the Server**
-   To stop the running MCP server and remove the containers, press Ctrl+C in the terminal where docker compose up is running.
-
-   Alternatively, in a new terminal from the project root, you can run:
-
-   ```bash
-   docker compose down
-   ```
-
-   This command stops and removes the containers, networks, and volumes created by docker compose up.
-
-### Testing
-
-#### MCP Inspector
-
-For testing MCP servers, you can use [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) which is an interactive developer tool for testing and debugging MCP servers.
-
-```bash
-# make sure you've already built the project either in dev mode or by running npm run build
-npx @modelcontextprotocol/inspector node  $PATH_TO_PROJECT/dist/index.js --env-file $PATH_TO_PROJECT/.env
-```
-
-### Local Development with an MCP Client
-
-While the [MCP Inspector](#mcp-inspector) is useful for ad-hoc tool testing, this setup lets you develop against a real MCP client (Claude Code, Cursor, etc.) with full server log visibility. By default, MCP clients spawn the server as a child process using stdio transport, which makes server logs difficult to observe. Running the server in HTTP mode gives you direct access to logs while the client interacts with it normally.
-
-After building the project (see [Building and Running](#building-and-running)):
-
-#### 1. Start the server in HTTP mode
-
-```bash
-npm run start:http -- --disable-auth
-```
-
-> [!WARNING]
-> Never disable authentication in production or when the server is network-accessible.
-
-This starts the server on `http://127.0.0.1:8080/mcp` (the defaults for `HTTP_HOST`, `HTTP_PORT`, and `HTTP_MCP_ENDPOINT_PATH`) with authentication disabled for local development.
-
-#### 2. Point your MCP client at the running server
-
-Instead of the default stdio configuration, configure your assistant's MCP settings to connect via HTTP. For example, in `.mcp.json`:
-
-```json
-{
-  "mcpServers": {
-    "confluent-dev": {
-      "type": "http",
-      "url": "http://127.0.0.1:8080/mcp"
-    }
-  }
-}
-```
-
-This replaces the typical `command`/`args` config that spawns a stdio child process.
-
-> [!IMPORTANT]
-> After restarting the MCP server, you may also need to restart or reconnect your MCP client so it picks up the new server process. For example, in Claude Code use the `/mcp` command to reconnect.
-
-#### 3. Observe server logs
-
-All server logs are written to stderr via pino and will appear directly in the terminal where you started the server. Set `LOG_LEVEL=debug` for more verbose output. To capture logs to a file instead:
-
-```bash
-npm run start:http -- --disable-auth 2>server.log
-```
-
-Then tail in a separate terminal:
-
-```bash
-tail -f server.log
-```
-
-### Adding a New Tool
-
-1. Add a new enum to the enum class `ToolName`.
-2. Add your new tool to the handlers map in the `ToolFactory` class.
-3. Create a new file, exporting the class that extends `BaseToolHandler`.
-   1. Implement the `handle` method of the base class.
-   2. Implement the `getToolConfig` method of the base class.
-4. Once satisfied, add it to the set of `enabledTools` in `index.ts`.
-
-### Generating Types
-
-```bash
-# as of v7.5.2 there is a bug when using allOf w/ required https://github.com/openapi-ts/openapi-typescript/issues/1474. need --empty-objects-unknown flag to avoid it
-npx openapi-typescript ./openapi.json -o ./src/confluent/openapi-schema.d.ts --empty-objects-unknown
-```
+- [Claude Code](docs/configuring-claude-code.md)
+- [Claude Desktop](docs/configuring-claude-desktop.md)
+- [Cursor](docs/configuring-cursor.md)
+- [Gemini CLI](docs/configuring-gemini-cli.md)
+- [Goose CLI](docs/configuring-goose-cli.md)
+- [VS Code](docs/configuring-vs-code.md)
+- [Windsurf](docs/configuring-windsurf.md)
 
 ## Telemetry
 
-This MCP server collects anonymous usage data to help make improvements. No personally identifiable information is collected. You can opt out by setting `DO_NOT_TRACK=true` in your environment. See [telemetry.md](telemetry.md) for full details on what is collected.
+This MCP server collects usage data to help make improvements.
+You can opt out by setting `DO_NOT_TRACK=true` in your environment.
+See [telemetry.md](telemetry.md) for full details on what is collected.
 
 ## Troubleshooting
 
-**"Node.js version not supported"** -- This project requires Node.js 22 or later. Check your version with `node -v` and upgrade if needed.
+**"Node.js version not supported"** -- This project requires Node.js 22 or later.
+Check your version with `node -v` and upgrade if needed.
+
+**Tools not appearing** -- Each tool requires specific service blocks in your `config.yaml`.
+Run `--list-tools` to see which tools are active, or invoke the `explain-disabled-tools` MCP tool from your client for a per-tool reason.
+The block-to-tool mapping lives in [CONFIGURATION.md](CONFIGURATION.md#tool-enablement-which-block-lights-up-what).
+
+**Authentication errors on HTTP/SSE** -- Generate an API key with `npx @confluentinc/mcp-confluent --generate-key` and add it to your `config.yaml` under `server.auth.api_key`.
+See [CONFIGURATION.md → HTTP/SSE transport security](CONFIGURATION.md#httpsse-transport-security).
 
-**Tools not appearing** -- Ensure the required environment variables for those tools are set in your `.env` file. Tools are only enabled when their dependencies are configured. Run `--list-tools` to see which tools are active.
+**Connection refused / port conflicts** -- The default HTTP port is 8080.
+Set `server.http.port` in your `config.yaml` to change it.
 
-**Authentication errors on HTTP/SSE** -- Generate an API key with `npx @confluentinc/mcp-confluent --generate-key` and add it to your `.env` file as `MCP_API_KEY`. See [Authentication for HTTP/SSE Transports](#authentication-for-httpsse-transports).
+**Tableflow authorization errors** -- Tableflow tools require specific IAM permissions in your cloud environment.
+See [Prerequisites & setup for Tableflow commands](#prerequisites--setup-for-tableflow-commands).
 
-**Connection refused / port conflicts** -- The default HTTP port is 8080. If it's already in use, set a different port via `HTTP_PORT` in your `.env` file.
+## Contributing
 
-**Tableflow authorization errors** -- Tableflow tools require specific IAM permissions in your cloud environment. See [Prerequisites & Setup for Tableflow Commands](#prerequisites--setup-for-tableflow-commands).
+Bug reports and feedback is appreciated in the form of Github Issues.
+For guidelines on contributing please see [CONTRIBUTING.md](CONTRIBUTING.md)
 
-### Contributing
+### Pre-release testing
 
-Bug reports and feedback is appreciated in the form of Github Issues. For guidelines on contributing please see [CONTRIBUTING.md](CONTRIBUTING.md)
+To run the MCP server against a pre-release version for beta testing or early feedback, download the release tarball file to a local directory.
+Then, when running any of the `npx` commands above, replace `@confluentinc/mcp-confluent` with the path to that tarball, e.g. `npx @~path/to/my/tarball --list-tools`