Launched with initial support for Datadog, Grafana Labs, and Dash0, the read-only server gives an agent what’s valid, what’s running, and what’s happening at a Traefik gateway, so it can write configuration that works on the release in use, prove who can reach what, and explain why the gateway did what it did

Traefik Labs ntroduced the Traefik MCP Server, a read-only Model Context Protocol server that grounds AI agents in three sources at once: what’s valid, from the exact schema of the Traefik release in use; what’s running, from the gateway’s live configuration; and what’s happening, from the traces, metrics, and logs in Datadog, the Grafana stack , or Dash0. It works in any MCP client engineers already use, from the day a gateway is set up to the years it runs in production.

AI agents can already write configuration and read telemetry, and for simple problems that is enough. However, a configuration that looks right is not the same as one the running release accepts, and a wrong answer that looks right is the one that gets applied. The hard problems live in configuration, which never reaches a telemetry backend. Which route took this request, and why? Which keys and routes exist that nobody has used? Will this fix work before it ships? The same questions now apply to AI traffic: which route lets a caller choose its own model, what one incoming request actually cost, and which guard was in front of it.

From Day 0 Setup to Day 2 Operations

Deploying a gateway takes an afternoon. Running it takes years. On Day 0, the agent writes routes, middlewares, and migrated NGINX annotations against the exact release, and checks which metrics the gateway should emit and which actually reach the team’s backend. On Day 1, it proves who can reach what: which routes have no authentication, which keys nobody has used, and which guard stands in front of each AI route. On Day 2, where platform teams spend years, it explains why traffic went where it did and proposes a validated change. Every one of those answers needs telemetry and configuration read together, and today they live apart: the telemetry in an observability backend, the configuration in the gateway. The Traefik MCP Server joins them, so an agent sees what happened and why in one view. What used to mean an engineer combing through configuration becomes a validated answer in minutes.

“Having an MCP server is not the news. What an agent can do with it is,” said Sudeep Goswami, CEO of Traefik Labs. “Our customers run their gateways for years, and every question in that time is as much about configuration as about telemetry. This server gives an agent both, from the first route it writes to the incident it explains years later, and because it is read-only, platform teams can finally let an agent near the ingress layer.”

Read. Join. Validate.

Read what’s running. Routers, services, middlewares, health checks, and certificates from the running Traefik Proxy or Traefik Hub gateway, plus APIs, plans, and applications on Traefik Hub API Management, and on Traefik Hub AI Gateway, the AI routes, the models each one may reach, and the guards, token budgets, and quotas standing in front of them.

Join it with what’s happening. Traces, metrics, and access logs from Datadog, Grafana, or Dash0 store the team runs, each matched to the router, middleware, or service that produced it. That includes AI traffic: the OpenTelemetry GenAI semantic convention series the gateway emits and prices itself, by model, provider, and application, next to the guard decisions and the refusals that produced them. The agent never has to guess which configuration a trace is talking about.

Validate against what’s valid. The server ships with a catalog of the deployed Traefik Proxy and Traefik Hub release: every provider, CRD, and middleware with its fields and defaults, the API Management and AI Gateway configuration, and every metric with the name it takes in each backend. The agent writes using that catalog instead of from what it remembers about gateways in general, and validates every configuration it produces before showing it to anyone. Applying it stays with the team’s own process: GitOps, CI, or a person. Because the catalog ships inside the server, it also works on Day 0 and in air-gapped clusters.

“Telemetry can tell you which route answered. The configuration tells you why that route was chosen,” said Emile Vauge, founder and CTO of Traefik Labs. “The agent knows every Traefik concept the way Traefik defines it, and it validates each line against that schema before it shows you one. An assistant that is right about gateways is a demo. An assistant that is right about your gateway is a colleague.”

“Traefik sees every request that enters your cluster, one of the richest signals a platform team can collect, and our integration brings it into Datadog next to everything else you monitor. Now the data flows back the other way: an agent can work with the Datadog MCP Server and the Traefik MCP Server side by side, drawing the metrics, logs and traces it needs from Datadog. Configuration problems are among the hardest runtime issues to track down because the symptom rarely points to the cause. With the telemetry and the Traefik configuration in front of the same agent, that cause is finally in view,” said Uday Tennety, Head of Technology Partnerships at Datadog.

“We built Dash0 on OpenTelemetry so that AI agents could reason over telemetry without translation. The Traefik MCP Server is the natural counterpart: it adds the gateway’s live configuration and a schema to validate against, so an agent explains a routing decision instead of guessing at it. Together they answer questions neither side could answer alone,” said Michele Mancioppi, Chief Architect at Dash0.

Availability

The Traefik MCP Server is generally available today on Docker Hub and GitHub Container Registry. A Traefik Hub token licensed for the Traefik MCP Server unlocks it, and once unlocked, it reads both Traefik Proxy, the open source proxy, and Traefik Hub gateways. Learn more at traefik.io/solutions/traefik-mcp-server. Traefik Labs is demonstrating the server this week at AGNTCon/MCPCon in San Jose, California booth #10.