Camunda Mcp
API | MCP Server | A2A Agent
Camunda (7 & 8) process automation API + MCP Server + A2A Agent for the agent-connector-sdk ecosystem.
Version: 0.5.0
Documentation — Installation, deployment, usage across the API, CLI, and MCP interfaces, and guidance for provisioning the Camunda platform are maintained in the official documentation.
camunda-mcp wraps the Camunda process automation APIs with thin, deterministic MCP
tools, targeting both platforms from a single server: the Camunda 7 Engine REST
API and the Camunda 8 Zeebe / Operate / Tasklist REST APIs. It also ships
agent for agent-to-agent orchestration.
What it provides
Api(camunda_mcp.api_client) — a facade holding both the Camunda 7 Engine REST client (Camunda7Api) and the Camunda 8 Zeebe / Operate / Tasklist client (Camunda8Api), each constructed lazily so a server configured for one platform never needs the other's URLs or credentials.- MCP tools (
camunda-mcpconsole script): one tool per API operation, namedcamunda7_<operation>(39 Camunda 7 Engine REST operations) andcamunda8_<operation>(24 Camunda 8 operations), pluscamunda_deployandcamunda_ingest_processes: 65 in all. Seedocs/overview.mdfor the full surface.a2a.json) wrapping the tool surface in a Pydantic-AI graph agent.
Available MCP Tools
Auto-generated — do not edit (synced by the mcp-readme-table pre-commit hook).
Intent tools
| MCP Tool | Kind | Description |
|---|---|---|
camunda_deploy |
intent | Deploy a BPMN/DMN/form resource to Camunda 7 or Camunda 8. |
camunda_ingest_processes |
intent | Natively ingest Camunda processes into epistemic-graph as typed nodes. |
2 intent tool(s) · 0 operation(s). Call an operation as act(action='<operation>', params={...}) (ask for reads); find(action='describe', params={'action': '<operation>'}) returns its arguments. An operation is enabled unless its <DOMAIN>TOOL toggle is set false. Auto-generated — do not edit.
Environment Variables
Package environment variables
| Variable | Example | Description |
|---|---|---|
CAMUNDA_PLATFORM |
7 |
Platform selector: "7" (Engine REST) or "8" (Zeebe/Operate/Tasklist) |
CAMUNDA_TLS_PROFILE |
— | Verify TLS certificates for Camunda HTTP calls |
CAMUNDA_TLS_PROFILE_REF |
— | |
CAMUNDA7_URL |
http://localhost:8080/engine-rest |
|
CAMUNDA7_TOKEN |
secret-injected | |
CAMUNDA7_USERNAME |
demo |
|
CAMUNDA7_PASSWORD |
secret-injected | |
CAMUNDA8_ZEEBE_REST_URL |
http://localhost:8080 |
|
CAMUNDA8_OPERATE_URL |
http://localhost:8081 |
|
CAMUNDA8_TASKLIST_URL |
http://localhost:8082 |
|
CAMUNDA8_CLIENT_ID |
changeme |
|
CAMUNDA8_CLIENT_SECRET |
secret-injected | |
CAMUNDA8_OAUTH_URL |
https://login.cloud.camunda.io/oauth/token |
|
CAMUNDA8_AUDIENCE |
zeebe.camunda.io |
|
CAMUNDATOOL |
True |
Toggle registration of the Camunda tool group |
CAMUNDA_TIMEOUT_SECONDS |
30.0 |
Outbound HTTP timeout in seconds (matches the runtime default) |
CAMUNDA_MAX_RESPONSE_BYTES |
8388608 |
Maximum response body size in bytes (8 MiB, matches the runtime default) |
Inherited agent-connector-sdk variables (apply to every connector)
| Variable | Example | Description |
|---|---|---|
TRANSPORT |
stdio |
MCP transport: stdio | streamable-http | sse |
HOST |
127.0.0.1 |
Loopback bind host (set an authenticated ingress explicitly) |
PORT |
8000 |
Bind port (HTTP transports) |
MCP_ENABLED_TOOLS |
— | Comma-separated tool allow-list |
MCP_DISABLED_TOOLS |
— | Comma-separated tool deny-list |
MCP_ENABLED_TAGS |
— | Comma-separated tag allow-list |
MCP_DISABLED_TAGS |
— | Comma-separated tag deny-list |
EUNOMIA_TYPE |
none |
Authorization mode: none | embedded | remote |
EUNOMIA_POLICY_FILE |
mcp_policies.json |
Embedded Eunomia policy file |
EUNOMIA_REMOTE_URL |
— | Remote Eunomia authorization server URL |
ENABLE_OTEL |
False |
Enable OpenTelemetry export |
OTEL_EXPORTER_OTLP_ENDPOINT |
— | OTLP collector endpoint |
MCP_CLIENT_AUTH |
— | Outbound MCP child auth: oidc-client-credentials | basic | none |
OIDC_CLIENT_ID |
— | OIDC client id (service-account auth) |
OIDC_CLIENT_SECRET_REF |
secret://identity/oidc-client-secret |
Runtime secret reference for the OIDC service account |
MCP_BASIC_AUTH_USERNAME |
— | HTTP Basic username (MCP_CLIENT_AUTH=basic) |
MCP_BASIC_AUTH_PASSWORD_REF |
secret://identity/mcp-basic-password |
Runtime secret reference for HTTP Basic auth (MCP_CLIENT_AUTH=basic) |
DEBUG |
False |
Verbose logging |
PYTHONUNBUFFERED |
1 |
Unbuffered stdout (recommended in containers) |
MCP_URL |
http://localhost:8000/mcp |
URL of the MCP server the agent connects to |
PROVIDER |
— | Operator-configured LLM provider for the agent |
MODEL_ID |
— | Operator-configured model id for the agent |
ENABLE_WEB_UI |
True |
Serve the AG-UI web interface |
17 package + 23 inherited variable(s). Auto-generated from .env.example + the shared agent-connector-sdk set — do not edit.
Every variable the server reads, grouped by purpose. Credentials left blank leave the
corresponding platform inactive — the connector remains inactive when credentials are
absent. A starter .env.example ships with the repository; copy it to
.env and populate the values for the platform the operator use.
Connection & Credentials
| Var | Default | Meaning |
|---|---|---|
CAMUNDA_PLATFORM |
7 |
Target platform: 7 or 8 |
CAMUNDA_TLS_PROFILE |
system |
Named outbound TLS policy from AgentConfig |
CAMUNDA7_URL |
http://localhost:8080/engine-rest |
Camunda 7 Engine REST base URL |
CAMUNDA7_TOKEN / CAMUNDA7_USERNAME / CAMUNDA7_PASSWORD |
— | Camunda 7 bearer or basic auth |
CAMUNDA8_ZEEBE_REST_URL |
http://localhost:8080 |
Camunda 8 Zeebe REST base URL |
CAMUNDA8_OPERATE_URL / CAMUNDA8_TASKLIST_URL |
— | Camunda 8 Operate / Tasklist URLs |
CAMUNDA8_CLIENT_ID / CAMUNDA8_CLIENT_SECRET / CAMUNDA8_OAUTH_URL / CAMUNDA8_AUDIENCE |
— | Camunda 8 OAuth client_credentials |
MCP server / transport
| Variable | Description | Default |
|---|---|---|
TRANSPORT |
stdio, streamable-http, or sse |
stdio |
HOST |
Bind host (HTTP transports) | 0.0.0.0 |
PORT |
Bind port (HTTP transports) | 8000 |
MCP_TOOL_MODE |
Tool surface: condensed, verbose, or both |
condensed |
MCP_ENABLED_TOOLS / MCP_DISABLED_TOOLS |
Comma-separated tool allow/deny list | — |
MCP_ENABLED_TAGS / MCP_DISABLED_TAGS |
Comma-separated tag allow/deny list | — |
DEBUG |
Verbose logging | False |
PYTHONUNBUFFERED |
Unbuffered stdout (recommended in containers) | 1 |
Tool toggles
Each action-routed tool can be disabled individually via its toggle env var (set to false).
See the Available MCP Tools table above for the authoritative names.
| Variable | Description | Default |
|---|---|---|
CAMUNDATOOL |
Register the Camunda tool set | True |
Telemetry & governance
| Variable | Description | Default |
|---|---|---|
ENABLE_OTEL |
Enable OpenTelemetry export | True |
OTEL_EXPORTER_OTLP_ENDPOINT |
OTLP collector endpoint | — |
OTEL_EXPORTER_OTLP_PUBLIC_KEY / OTEL_EXPORTER_OTLP_SECRET_KEY |
OTLP auth keys | — |
OTEL_EXPORTER_OTLP_PROTOCOL |
OTLP protocol (e.g. http/protobuf) |
— |
EUNOMIA_TYPE |
Authorization mode: none, embedded, remote |
none |
EUNOMIA_POLICY_FILE |
Embedded policy file | mcp_policies.json |
EUNOMIA_REMOTE_URL |
Remote Eunomia server URL | — |
Agent CLI (full [agent] runtime only)
| Variable | Description | Default |
|---|---|---|
MCP_URL |
URL of the MCP server the agent connects to | http://localhost:8000/mcp |
PROVIDER |
LLM provider (e.g. openai) |
openai |
MODEL_ID |
Model id (e.g. gpt-4o) |
gpt-4o |
ENABLE_WEB_UI |
Serve the AG-UI web interface | True |
Installation
Pick the extra that matches what the operator want to run:
| Extra | Installs | Use when |
|---|---|---|
camunda-mcp[mcp] |
Connector-focused MCP server (agent-connector-sdk — FastMCP/FastAPI + epistemic-graph[full]) |
The operator only run the MCP server (smallest install / image) |
camunda-mcp[all] |
Everything (mcp + agent) |
Development / both surfaces |
# Connector-focused MCP server (includes the shared graph engine)
uv pip install "camunda-mcp[mcp]"
# Agent runtime (adds model orchestration to the shared graph engine)
# Everything (development)
uv pip install "camunda-mcp[all]" # or: python -m pip install "camunda-mcp[all]"
Run the servers:
camunda-mcp # stdio MCP server (default transport)
camunda-mcp --transport streamable-http --host 0.0.0.0 --port 8000
# A2A agent server against a deployed MCP endpoint
MCP_URL=http://camunda-mcp:8000/mcp camunda-agent --host 0.0.0.0 --port 8001
Container images (:mcp)
One multi-stage docker/Dockerfile builds the MCP-only image (--target mcp):
| Image tag | Build target | Contents | Entrypoint |
|---|---|---|---|
example/camunda-mcp:mcp |
--target mcp |
camunda-mcp[mcp] — connector-focused, includes epistemic-graph[full]; no model-orchestration stack |
camunda-mcp |
docker build --target mcp -t example/camunda-mcp:mcp docker/ # connector-focused MCP server
agent (immutable agent digest) with a co-located :mcp sidecar.
Knowledge-graph database (epistemic-graph)
Agent Connector SDK core dependency (epistemic-graph[full]). The [mcp] extra keeps
deployments can use the bundled engine. For production or shared state, run
epistemic-graph as a dedicated database service and configure the runtime to use it.
Deployment recipes (single-node + Raft HA), connection configuration, and architecture
diagrams are documented in the
epistemic-graph deployment guide.
MCP config
Register in the multiplexer under nickname camun (tools surface as
camun__process, camun__instance, camun__task, …). See
camunda_mcp/mcp_config.json.
Additional Deployment Options
camunda-mcp can run as a local stdio process or container, or behind a remote
network boundary. The
Deployment guide carries
the detailed transport contract.
- Local container — launch a reviewed immutable image as a least-privilege stdio child with no listener or published port.
- Remote URL — connect through an operator-supplied authenticated HTTPS
ingress. Keep its URL, outbound identity references, trust profile, and exact
MCP_ALLOWED_HOSTSinAgentConfig.
Documentation
The complete documentation is published as the official documentation site and is the recommended reference for installation, deployment, and day-to-day operation.
| Page | Contents |
|---|---|
| Installation | pip, source, extras, prebuilt Docker image |
| Deployment | run the MCP and agent servers, Compose, Caddy + Technitium, env config |
| Usage | the MCP tools, the Api client, the CLI |
| Backing Platform | deploy Camunda with Docker |
| Overview | the Camunda 7 / Camunda 8 surface |
| Concepts | concept registry (CONCEPT:CAMUNDA-*) |
AGENTS.md is the canonical contributor/agent guidance.
Governed capability contract
This package ships a compact canonical skill surface with specialist procedures
kept as referenced workflows. The current MCP tools, skill metadata,
connector_manifest.yml, ontology, mappings, shapes, fixtures, migrations,
tool-schema fingerprints, and certification metadata form one versioned
capability contract. Validate them together; do not rely on stale tool names or
historical per-task skill wrappers.
Runtime endpoints, credentials, certificate trust, tenant identity, retention, and observability policy are deployment inputs and are never packaged values. See Configuration, trust, and privacy before enabling a network transport, connector ingestion, Arbora delegation, or trace export.
Metadata
Release files for camunda-mcp 2.6.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| camunda_mcp-2.6.0.tar.gz | 49.3 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| camunda_mcp-2.6.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 110.3 kB
Release files / camunda_mcp-2.6.0.tar.gz
| Download URL | camunda_mcp-2.6.0.tar.gz |
|---|---|
| Size | 49.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b2ef24793d6acb7ded6f3346138cc770e510e9d27b4582d5e58c76f1946fd9c3
|
|
BLAKE2b-256 checksum How to use checksums |
a346e608cecf55d5304b775549e3d19e53bfdf2de69f21bcc8008da6db82c568
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.4
|
Release files / camunda_mcp-2.6.0-py3-none-any.whl
| Download URL | camunda_mcp-2.6.0-py3-none-any.whl |
|---|---|
| Size | 61.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
d60efa4a3653d5bad6ec1bb083da446f6c822afa2989f75fb28f5842c5e76fce
|
|
BLAKE2b-256 checksum How to use checksums |
40828fb60a53c16ffe64074e241597813c2a3b5252428147808423b6a05ec407
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.14.4
|
Security for camunda-mcp 2.6.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.