Tyk API Management MCP Server: Tokens, Users, Analytics

Overview

The Tyk API Management MCP (Model Context Protocol) server is a lightweight service that exposes Tyk dashboard functionality as a set of programmable tools. It is intended to be used alongside LLMs, automation pipelines, and developer tooling to manage API tokens, users, and basic analytics without directly interacting with the full dashboard UI. By providing a consistent API surface and a chat-capable endpoint, the MCP server enables contextual, programmatic operations across an organization’s APIs.

In practice, the MCP server sits between consumers (scripts, bots, or LLM agents) and the Tyk Dashboard. It handles authentication to Tyk, normalizes responses, and exposes a small set of well-scoped tools: token lifecycle operations, user management, analytics queries, and a conversational endpoint to ask questions about API usage and configuration. This reduces the need for wide dashboard permissions for service accounts and simplifies integration into CI/CD and DevOps workflows.

Features

• Token management: create, rotate, revoke, and list API keys and credentials.
• User management: list users, fetch details, sync roles, and audit user access.
• Analytics queries: fetch basic metrics (requests, errors, latency) by API, date range, or app.
• Chat endpoint: semantically query analytics and metadata to power conversational assistants or LLM agents.
• Role-based access: configure which MCP tools are available to callers via service keys.
• Simple deployment: docker-compose and environment-driven configuration.

Installation / Configuration

Prerequisites:

• Docker and docker-compose (recommended) or a Go/Node runtime if building from source.
• A Tyk Dashboard instance reachable by the MCP server.
• A Tyk Dashboard API key (admin or a key with the required scopes).

Example docker-compose.yml (basic):

version: "3.7"
services:
  mcp:
    image: tyktechnologies/tyk-dashboard-mcp:latest
    ports:
      - "8080:8080"
    environment:
      - TYK_DASHBOARD_URL=https://tyk-dashboard.example.com
      - TYK_DASHBOARD_SECRET=YOUR_TYK_DASHBOARD_SECRET
      - MCP_PORT=8080
      - MCP_ALLOWED_KEYS=svc-key-1,svc-key-2
    restart: unless-stopped

Sample environment variables

# URL for your Tyk Dashboard API
TYK_DASHBOARD_URL=https://tyk-dashboard.example.com

# Dashboard API secret (or a service key with appropriate permissions)
TYK_DASHBOARD_SECRET=changeme

# Port to listen on
MCP_PORT=8080

# Comma-separated service keys that may call MCP tools
MCP_ALLOWED_KEYS=svc-key-1,svc-key-2

# Optional: logging level, storage path, AI model settings
LOG_LEVEL=info
STORAGE_PATH=/data/mcp

Running locally (if distributed as a binary):

# build (if source available)
go build -o mcp ./cmd/mcp
./mcp --config ./config.yml

Available Tools / Resources

The MCP server exposes a small set of HTTP tools. Endpoints below are illustrative — consult your deployed server’s /openapi or /docs endpoint for exact schemas.

Example: list tokens (curl)

curl -H "Authorization: Bearer svc-key-1" \
  "http://localhost:8080/mcp/tokens?api_id=1234"

Example: analytics query (curl)

curl -X POST -H "Authorization: Bearer svc-key-1" \
  -H "Content-Type: application/json" \
  -d '{"api_id":"1234","from":"2026-04-01","to":"2026-04-07","metrics":["requests","errors","latency"]}' \
  http://localhost:8080/mcp/analytics

Example: chat query

curl -X POST -H "Authorization: Bearer svc-key-1" \
  -H "Content-Type: application/json" \
  -d '{"query":"Which API had the highest 95th percentile latency last week?"}' \
  http://localhost:8080/mcp/chat

Use Cases

• CI/CD Token Rotation: Automate API key rotation for service accounts by calling the /mcp/tokens endpoint from your deployment pipeline, minimizing manual dashboard access.
• Developer Self-Service: Provide internal developer tools that call /mcp/users to list and audit user roles and permissions, enabling fast onboarding checks.
• Analytics-driven Alerts: Schedule regular queries to /mcp/analytics to detect spikes in errors or latency and trigger alerts in your monitoring system.
• Conversational Ops Assistant: Integrate /mcp/chat with an LLM agent to allow non-experts to ask questions like “Which API keys expire in the next 7 days?” or “Show me the top 5 APIs by traffic for April,” returning actionable results without exposing dashboard credentials.

Tips and Next Steps

• Start in read-only mode by granting dashboard keys with limited scopes while you test integrations.
• Use the health and metrics endpoints to integrate MCP into your observability stack.
• If you plan to connect an LLM, ensure the chat endpoint is rate-limited and audited; redact sensitive tokens from logs.
• Check the repository (https://github.com/TykTechnologies/tyk-dashboard-mcp) for deployment templates, OpenAPI specs, and example agent configurations.