feat(mcp): add Event Bus MCP server

.github/workflows/ci.yml

@@ -58,6 +58,19 @@ jobs:
           go-flags: "-mod=vendor"
           working-directory: auth-callout
 
+  go-lint-mcp:
+    name: Go Lint (mcp/dsx-exchange-mcp)
+    runs-on: linux-amd64-cpu4
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate MCP embedded schemas
+        run: make -C mcp/dsx-exchange-mcp sync-specs
+      - uses: NVIDIA/dsx-github-actions/.github/actions/go-lint@07b465c2147fcbda4836cb869263577ea4719273 # v1.16.1
+        with:
+          go-version: "1.25.5"
+          go-flags: "-mod=vendor"
+          working-directory: mcp/dsx-exchange-mcp
+
   unit-test:
     name: Unit Test (auth-callout)
     runs-on: linux-amd64-cpu4
@@ -99,6 +112,29 @@ jobs:
         working-directory: local/mqttbs
         run: go test ./...
 
+  unit-test-mcp:
+    name: Unit Test (mcp/dsx-exchange-mcp)
+    runs-on: linux-amd64-cpu4
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate MCP embedded schemas
+        run: make -C mcp/dsx-exchange-mcp sync-specs
+      - uses: NVIDIA/dsx-github-actions/.github/actions/go-test@07b465c2147fcbda4836cb869263577ea4719273 # v1.16.1
+        with:
+          go-version: "1.25.5"
+          go-flags: "-mod=vendor"
+          test-flags: "-v -count=1 -timeout=10m"
+          working-directory: mcp/dsx-exchange-mcp
+
+
+  schema-sync-mcp:
+    name: Schema Sync (mcp/dsx-exchange-mcp)
+    runs-on: linux-amd64-cpu4
+    steps:
+      - uses: actions/checkout@v4
+      - name: Verify MCP embedded schemas can be generated
+        run: make -C mcp/dsx-exchange-mcp verify-specs
+
   third-party-licenses:
     name: Third-Party Licenses
     runs-on: linux-amd64-cpu4
@@ -108,7 +144,9 @@ jobs:
         with:
           go-version: "1.25.5"
           cache: true
-          cache-dependency-path: auth-callout/go.sum
+          cache-dependency-path: |
+            auth-callout/go.sum
+            mcp/dsx-exchange-mcp/go.sum
       - name: Regenerate THIRD_PARTY_LICENSES.csv via Makefile
         # Uses auth-callout/scripts/regenerate-third-party-licenses.sh which
         # filters local packages and applies multi-license overrides.
@@ -133,6 +171,20 @@ jobs:
           platforms: linux/amd64
           push: "false"
 
+  docker-build-mcp:
+    name: Docker Build (mcp/dsx-exchange-mcp)
+    runs-on: linux-amd64-cpu4
+    steps:
+      - uses: actions/checkout@v4
+      - uses: NVIDIA/dsx-github-actions/.github/actions/docker-build@07b465c2147fcbda4836cb869263577ea4719273 # v1.16.1
+        with:
+          image: dsx-exchange-mcp
+          tags: ci-validation
+          context: .
+          dockerfile: mcp/dsx-exchange-mcp/Dockerfile
+          platforms: linux/amd64
+          push: "false"
+
   codeql-scan:
     name: CodeQL SAST
     runs-on: linux-amd64-cpu4
@@ -147,6 +199,8 @@ jobs:
         with:
           go-version: "1.25.5"
           cache: false
+      - name: Generate MCP embedded schemas
+        run: make -C mcp/dsx-exchange-mcp sync-specs
       - uses: NVIDIA/dsx-github-actions/.github/actions/codeql-scan@07b465c2147fcbda4836cb869263577ea4719273 # v1.16.1
         with:
           languages: go
@@ -187,6 +241,24 @@ jobs:
         with:
           image: dsx-exchange-auth-callout:scan-validation
 
+  security-container-scan-mcp:
+    name: Container Scan (mcp/dsx-exchange-mcp)
+    needs: docker-build-mcp
+    runs-on: linux-amd64-cpu4
+    steps:
+      - uses: actions/checkout@v4
+      - uses: NVIDIA/dsx-github-actions/.github/actions/docker-build@07b465c2147fcbda4836cb869263577ea4719273 # v1.16.1
+        with:
+          image: dsx-exchange-mcp
+          tags: scan-validation
+          context: .
+          dockerfile: mcp/dsx-exchange-mcp/Dockerfile
+          platforms: linux/amd64
+          push: "false"
+      - uses: NVIDIA/dsx-github-actions/.github/actions/security-container-scan@07b465c2147fcbda4836cb869263577ea4719273 # v1.16.1
+        with:
+          image: dsx-exchange-mcp:scan-validation
+
   helm-validate-auth-callout:
     name: Helm Validate (auth-callout)
     runs-on: linux-amd64-cpu4
@@ -209,18 +281,32 @@ jobs:
           # Full dependency build happens on GitLab publish pipeline.
           template: "false"
 
+  helm-validate-mcp:
+    name: Helm Validate (mcp/dsx-exchange-mcp)
+    runs-on: linux-amd64-cpu4
+    steps:
+      - uses: actions/checkout@v4
+      - uses: NVIDIA/dsx-github-actions/.github/actions/helm-validate@07b465c2147fcbda4836cb869263577ea4719273 # v1.16.1
+        with:
+          chart-path: mcp/dsx-exchange-mcp/deploy/helm/dsx-exchange-mcp
+
   e2e-kind:
     name: E2E (Kind)
     needs:
       - license-headers
       - go-lint
+      - go-lint-mcp
       - unit-test
       - unit-test-local-mqtt
       - unit-test-local-mqttbs
+      - unit-test-mcp
+      - schema-sync-mcp
       - third-party-licenses
       - docker-build
+      - docker-build-mcp
       - helm-validate-auth-callout
       - helm-validate-nats-event-bus
+      - helm-validate-mcp
     uses: ./.github/workflows/e2e-kind.yml
 
   slack-notify:
@@ -230,16 +316,22 @@ jobs:
       - commitlint
       - license-headers
       - go-lint
+      - go-lint-mcp
       - unit-test
       - unit-test-local-mqtt
       - unit-test-local-mqttbs
+      - unit-test-mcp
+      - schema-sync-mcp
       - third-party-licenses
       - docker-build
+      - docker-build-mcp
       - codeql-scan
       - trufflehog-scan
       - security-container-scan
+      - security-container-scan-mcp
       - helm-validate-auth-callout
       - helm-validate-nats-event-bus
+      - helm-validate-mcp
       - e2e-kind
     runs-on: linux-amd64-cpu4
     environment: notifications

.gitignore

@@ -8,3 +8,5 @@
 /local/nats/secrets/
 
 .vscode/
+.cursor/
+.gocache/

Makefile

@@ -1,7 +1,7 @@
 # Copyright 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 
-.PHONY: add-license-headers check check-license-headers clean-e2e dummy-bms help install-e2e-prereqs skaffold-dev test test-dev third-party-licenses
+.PHONY: add-license-headers check check-license-headers clean-e2e dummy-bms help install-e2e-prereqs mcp-build mcp-lint mcp-sync-specs mcp-test skaffold-dev test test-dev third-party-licenses
 
 add-license-headers: ## Add SPDX license headers across repository sources
 	bash scripts/license.sh fix
@@ -14,6 +14,7 @@ check: ## Run static validation checks
 	helm lint auth-callout/deploy
 	helm template --dependency-update --repository-config local/helm/repositories.yaml nats-event-bus deploy/nats-event-bus >/dev/null
 	helm lint deploy/nats-event-bus
+	helm lint mcp/dsx-exchange-mcp/deploy/helm/dsx-exchange-mcp
 
 clean-e2e: ## Delete local Kind clusters and generated e2e artifacts
 	$(MAKE) -C local clean
@@ -24,12 +25,25 @@ dummy-bms: ## Publish looping dummy BMS data to the local CSC MQTT broker
 install-e2e-prereqs: ## Install tools required by local Kind e2e workflows
 	$(MAKE) -C local install-e2e-prereqs
 
+mcp-build: ## Build the DSX Exchange MCP server
+	$(MAKE) -C mcp/dsx-exchange-mcp build
+
+mcp-lint: ## Run DSX Exchange MCP static checks
+	$(MAKE) -C mcp/dsx-exchange-mcp lint
+
+mcp-sync-specs: ## Refresh the DSX Exchange MCP embedded schema copy
+	$(MAKE) -C mcp/dsx-exchange-mcp sync-specs
+
+mcp-test: ## Run DSX Exchange MCP unit tests
+	$(MAKE) -C mcp/dsx-exchange-mcp test
+
 test: ## Run the full validation suite
 	$(MAKE) check
 	$(MAKE) -C auth-callout test
 	cd auth-callout/tests && go test -short ./...
 	cd local/mqtt-client && go test ./pkg/... ./internal/... ./cmd/...
 	cd local/mqttbs && go test ./...
+	$(MAKE) -C mcp/dsx-exchange-mcp test
 	$(MAKE) -C local test
 
 test-dev: ## Run local e2e tests against an already running local stack

README.md

@@ -12,6 +12,7 @@ DSX Exchange provides the repository pieces needed to describe, deploy, and vali
 - `auth-callout`: NATS auth callout service for OAuth2, mTLS, NKey, and no-auth profiles.
 - `deploy`: Helm chart for the NATS event bus deployment.
 - `local`: Kind-based local evaluation environment, Skaffold deployment, MQTT tests, and benchmark tooling.
+- `mcp/dsx-exchange-mcp`: MCP server for DSX Exchange schemas, topic discovery, and read-only MQTT tools.
 
 The event bus itself is schema agnostic. Schemas document externally visible contracts; NATS and the auth callout enforce routing, federation, and authorization behavior.
 
@@ -60,6 +61,7 @@ Run component-specific targets from the directory you are changing, and use
 
 ```bash
 make -C auth-callout test
+make -C mcp/dsx-exchange-mcp test
 make check
 ```
 

THIRD_PARTY_LICENSES.csv

@@ -12,6 +12,7 @@ github.com/go-logr/logr,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-ca
 github.com/go-logr/stdr,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/go-logr/stdr/LICENSE,Apache-2.0
 github.com/go-viper/mapstructure/v2,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/go-viper/mapstructure/v2/LICENSE,MIT
 github.com/golang-jwt/jwt/v5,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/golang-jwt/jwt/v5/LICENSE,MIT
+github.com/google/jsonschema-go/jsonschema,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/mcp/dsx-exchange-mcp/vendor/github.com/google/jsonschema-go/LICENSE,MIT
 github.com/google/uuid,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/google/uuid/LICENSE,BSD-3-Clause
 github.com/gorilla/handlers,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/gorilla/handlers/LICENSE,BSD-3-Clause
 github.com/gorilla/mux,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/gorilla/mux/LICENSE,BSD-3-Clause
@@ -33,6 +34,7 @@ github.com/knadh/koanf/v2,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-
 github.com/minio/highwayhash,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/minio/highwayhash/LICENSE,Apache-2.0
 github.com/mitchellh/copystructure,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/mitchellh/copystructure/LICENSE,MIT
 github.com/mitchellh/reflectwalk,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/mitchellh/reflectwalk/LICENSE,MIT
+github.com/modelcontextprotocol/go-sdk,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/mcp/dsx-exchange-mcp/vendor/github.com/modelcontextprotocol/go-sdk/LICENSE,Apache-2.0
 github.com/munnerz/goautoneg,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/munnerz/goautoneg/LICENSE,BSD-3-Clause
 github.com/nats-io/jwt/v2,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/nats-io/jwt/v2/LICENSE,Apache-2.0
 github.com/nats-io/nats-server/v2,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/nats-io/nats-server/v2/LICENSE,Apache-2.0
@@ -47,13 +49,16 @@ github.com/prometheus/common,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/au
 github.com/prometheus/otlptranslator,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/prometheus/otlptranslator/LICENSE,Apache-2.0
 github.com/prometheus/procfs,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/prometheus/procfs/LICENSE,Apache-2.0
 github.com/santhosh-tekuri/jsonschema/v6,https://github.com/santhosh-tekuri/jsonschema/blob/v6.0.2/LICENSE,Apache-2.0
+github.com/segmentio/asm,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/mcp/dsx-exchange-mcp/vendor/github.com/segmentio/asm/LICENSE,MIT
+github.com/segmentio/encoding,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/mcp/dsx-exchange-mcp/vendor/github.com/segmentio/encoding/LICENSE,MIT
 github.com/spf13/cobra,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/spf13/cobra/LICENSE.txt,Apache-2.0
 github.com/spf13/pflag,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/spf13/pflag/LICENSE,BSD-3-Clause
 github.com/synadia-io/callout.go,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/synadia-io/callout.go/LICENSE,Apache-2.0
 github.com/uptrace/opentelemetry-go-extra/otelutil,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/uptrace/opentelemetry-go-extra/otelutil/LICENSE,BSD-2-Clause
 github.com/uptrace/opentelemetry-go-extra/otelzap,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/github.com/uptrace/opentelemetry-go-extra/otelzap/LICENSE,BSD-2-Clause
 github.com/valyala/fastrand,https://github.com/valyala/fastrand/blob/v1.1.0/LICENSE,MIT
 github.com/valyala/histogram,https://github.com/valyala/histogram/blob/v1.2.0/LICENSE,MIT
+github.com/yosida95/uritemplate/v3,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/mcp/dsx-exchange-mcp/vendor/github.com/yosida95/uritemplate/v3/LICENSE,BSD-3-Clause
 gitlab-master.nvidia.com/ncp/vmaas/services/pkg/nv-config,Unknown,Apache-2.0
 gitlab-master.nvidia.com/ncp/vmaas/services/pkg/nv-config/internal/providers,Unknown,Apache-2.0
 gitlab-master.nvidia.com/ncp/vmaas/services/pkg/nv-config/internal/watcher,Unknown,Apache-2.0
@@ -88,6 +93,7 @@ golang.org/x/net,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/v
 golang.org/x/oauth2,https://cs.opensource.google/go/x/oauth2/+/v0.33.0:LICENSE,BSD-3-Clause
 golang.org/x/sync/semaphore,https://cs.opensource.google/go/x/sync/+/v0.17.0:LICENSE,BSD-3-Clause
 golang.org/x/sys,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/golang.org/x/sys/LICENSE,BSD-3-Clause
+golang.org/x/sys/cpu,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/mcp/dsx-exchange-mcp/vendor/golang.org/x/sys/LICENSE,BSD-3-Clause
 golang.org/x/sys/unix,https://cs.opensource.google/go/x/sys/+/v0.37.0:LICENSE,BSD-3-Clause
 golang.org/x/text,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/golang.org/x/text/LICENSE,BSD-3-Clause
 golang.org/x/time/rate,https://github.com/NVIDIA/dsx-exchange/blob/HEAD/auth-callout/vendor/golang.org/x/time/LICENSE,BSD-3-Clause

auth-callout/scripts/regenerate-third-party-licenses.sh

@@ -91,6 +91,8 @@ report_module() {
 report_module "$auth_dir" "-mod=vendor"
 report_module "$repo_dir/local/mqtt-client" ""
 report_module "$repo_dir/local/mqttbs" ""
+make -C "$repo_dir/mcp/dsx-exchange-mcp" sync-specs >/dev/null
+report_module "$repo_dir/mcp/dsx-exchange-mcp" "-mod=vendor"
 
 if [[ -n "${DSX_LICENSE_VERBOSE:-}" && -s "$warnings" ]]; then
 	cat "$warnings" >&2

local/Makefile

@@ -68,6 +68,7 @@ dummy-bms: ## Publish looping dummy BMS data to the CSC MQTT broker
 status: ## Check deployment status
 	@echo "CSC Cluster:"
 	@kubectl get pods -n event-bus --context kind-csc 2>/dev/null || echo "  NATS: Not deployed"
+	@kubectl get pods -n mcp-backends --context kind-csc 2>/dev/null || echo "  MCP: Not deployed"
 	@echo ""
 	@echo "CPC-1 Cluster:"
 	@kubectl get pods -n event-bus --context kind-cpc-1 2>/dev/null || echo "  NATS: Not deployed"

local/README.md

@@ -60,13 +60,14 @@ Use `make skaffold-run` for deploy-only local setup.
 
 ### Skaffold
 
-The root `skaffold.yaml` imports `local/infra/skaffold.yaml` and
-`local/nats/skaffold.yaml`. Skaffold deploys the cluster infrastructure, builds
-the auth-callout image, and installs the event-bus chart. Host scripts still
-handle prerequisites, Kind cluster creation, the local registry, and generated
-NATS secret material. The local Skaffold entrypoints import smaller domain files
-for MetalLB, Envoy Gateway, cert-manager, metrics-server, Prometheus, Keycloak,
-auth-callout image build, secret manifests, and NATS releases.
+The root `skaffold.yaml` imports `local/infra/skaffold.yaml`,
+`local/nats/skaffold.yaml`, and `mcp/dsx-exchange-mcp/skaffold.yaml`. Skaffold
+deploys the cluster infrastructure, builds the auth-callout and MCP images, and
+installs the event-bus and MCP charts. Host scripts still handle prerequisites,
+Kind cluster creation, the local registry, and generated NATS secret material.
+The local Skaffold entrypoints import smaller domain files for MetalLB, Envoy
+Gateway, cert-manager, metrics-server, Prometheus, Keycloak, auth-callout image
+build, secret manifests, NATS releases, and the MCP backend.
 
 For iterative development, keep Skaffold running in one terminal:
 
@@ -165,3 +166,28 @@ make dummy-bms
 The dummy BMS target uses the same local e2e environment and Envoy Gateway
 LoadBalancer path as the functional and performance tests. It publishes to the
 CSC broker at `tcp://172.18.200.1:1883` unless `CSC_BROKER_URL` is overridden.
+
+### DSX Exchange MCP
+
+The local stack also deploys `dsx-exchange-mcp` into the CSC Kind cluster. This
+is a direct backend deployment; it does not install an MCP gateway. It is intended
+for manual MCP client checks against the same local Event Bus services used by
+the e2e tests.
+
+This path uses the normal local Event Bus clusters only: `kind-csc`,
+`kind-cpc-1`, and `kind-cpc-2`. The MCP backend runs as a Helm release in
+`kind-csc` under namespace `mcp-backends`; no separate MCP gateway cluster is
+created or required.
+
+After `make skaffold-run`, expose the MCP backend locally:
+
+```bash
+cd ../mcp/dsx-exchange-mcp
+make port-forward-kind
+```
+
+Configure the MCP client with `http://127.0.0.1:18080/mcp`. The local MCP Kind
+deployment uses the Event Bus noauth path by default, so do not configure an
+MCP bearer token and do not send a dummy token. Schema discovery tools do not
+connect to MQTT. Broker-backed tools connect to the local Event Bus without
+MQTT username/password, matching the local evaluation noauth setup.

mcp/dsx-exchange-mcp/.gitignore

@@ -0,0 +1,21 @@
+/bin/
+/reports/
+*.test
+*.out
+.env
+.idea/
+.vscode/
+.claude/
+context/
+/schema/
+/schemas/.gitignore
+/schemas/README.md
+/schemas/cloud-events-example.yaml
+/schemas/asyncapi/
+/internal/specs/data/*
+!/internal/specs/data/.gitkeep
+
+# Local-only MCP validation helpers and notes; not part of the released server.
+/cmd/dsx-exchange-token-proxy/
+/deploy/local-check/
+/docs/