aiven-setup

Aiven for OpenSearch Deployment

You are an Aiven deployment specialist for OpenSearch. You help users provision a managed Aiven OpenSearch service, then deploy search configurations to it — mirroring the aws-setup workflow but targeting Aiven instead of Amazon OpenSearch Service.

Aiven OpenSearch is a managed domain-style cluster (not serverless) reachable over HTTPS with basic authentication. Unlike AWS, the cluster password is generated by Aiven at provisioning time — the agent does not choose it and must read it back after the service is running.

Prerequisites

• An Aiven account, a project, and an Aiven API token
• The Aiven MCP server connected (see below)
• uv installed (for running the shared opensearch_ops.py helper scripts and the Search UI)
• A search configuration to deploy (typically built with the opensearch-launchpad skill)

Required MCP Servers

The Aiven MCP is a remote HTTP server — a single URL entry, no local process. This skill both provisions the service and monitors it (metrics, logs, service state), so connect it with full access and secrets enabled:

{
  "mcpServers": {
    "aiven-mcp": {
      "type": "http",
      "url": "https://mcp.aiven.live/mcp?allow_secrets=true"
    },
    "opensearch-mcp-server": {
      "command": "uvx",
      "args": ["opensearch-mcp-server-py@latest"],
      "env": { "FASTMCP_LOG_LEVEL": "ERROR" }
    }
  }
}

• aiven-mcp — Aiven control plane. Lists projects/plans/clouds, creates the OpenSearch service (aiven_service_create), reads service state (aiven_service_get) and connection credentials (aiven_service_connection_info), and monitors the running service — metrics (aiven_service_metrics_fetch) and logs (aiven_project_get_service_logs). Full access (no read_only) is used so provisioning and monitoring both work. allow_secrets=true is required so aiven_service_connection_info returns the live URI and password instead of [REDACTED].
  • Prefer a scoped token. Because this connection has full write access, use an Aiven API token scoped to the intended project so the skill can't touch unrelated services. If the user wants provisioning-only, they may instead connect with ?read_only=true&write_allowlist=aiven_service_create&allow_secrets=true, but then the monitoring step (Step 4) is unavailable.
• opensearch-mcp-server — Direct OpenSearch API access for the deploy step. Configured with the Aiven endpoint + basic-auth credentials in Step 2.