LoginSign Up
← Back to all sparks
A

Aiven

DEVOPS
Velocity5.0

Managed open-source data infrastructure platform for databases, streaming and search

aiven.io ↗

Aiven gives admins a kill switch for the AI clients now reading its control plane

managed-databasesmcpaccess-controlkafkapostgresql
◆Current state
Aiven's changelog splits cleanly between managed-engine version work and console-level governance. The past month is mostly maintenance — PostgreSQL minors, TimescaleDB 2.29.2, Karapace 6.2.x — running alongside a slower stream of controls that give organization admins finer authority over what users and clients may do. The newest entry lets an admin force every MCP connection in the organization to read-only, so clients such as Cursor and Claude Code can inspect services but cannot create, modify or delete them.
◆Where it's heading
Aiven is treating AI clients as a class of principal rather than as an integration. MCP arrived in early availability in June and became a documented path for AI assistants in July; the next move was not more MCP capability but a policy that constrains it, placed in the same Authentication panel as the rest of the organization's identity settings. Read next to the audit-log permission being split into project:event_logs:read, the direction is a permission model being resegmented finely enough to describe non-human callers.
◆Prediction
Expect the MCP surface to gain more admin-side policy — per-service or per-role scoping rather than one org-wide read-only switch — before it gains broader tool coverage.

◆Recent moves

  1. 1d ago

    Restrict MCP connections to read-only operations

    Organization admins can restrict every MCP connection in the organization to read-only, letting AI clients view services and resources but not create, modify or delete them, with no user-level override in client configuration. This governs the MCP surface Aiven opened in June rather than extending it, and it sits alongside the audit-log permission rework as part of the same authority-model tightening.

    View source ↗
  2. 5d ago

    OpenSearch® sink connector for Aiven for Apache Kafka® Connect upgraded to version 3.2.0

    The OpenSearch sink connector moves to 3.2.0 and can now write into an existing index, index alias, or data stream instead of creating a new index per Kafka topic. That removes a real operational constraint for teams whose OpenSearch layout is already defined, and it is typical of how Aiven advances its Kafka Connect surface — engine upgrades that carry one concrete configuration gain.

    View source ↗
  3. 6d ago

    Set the Karapace version on Aiven for Apache Kafka®

    Kafka services can now pin a specific Karapace version through the Console, CLI or API, with the latest version applied through maintenance if none is set. Version pinning is control handed back to the user — compatibility testing and rollback become the customer's decision rather than the maintenance window's.

    View source ↗
  4. 7d ago

    TimescaleDB 2.29.2 for Aiven for PostgreSQL® released

    TimescaleDB 2.29.2 becomes available for Aiven for PostgreSQL, carrying upstream performance work and bug fixes. This is routine extension tracking, the background hum underneath the governance work that actually moves the product.

    View source ↗
  5. 15d ago

    Aiven for PostgreSQL® upgraded to 18.6, 17.11, 16.15, 15.19, and 14.24

    PostgreSQL moves to minors 18.6, 17.11, 16.15, 15.19 and 14.24, applied to existing instances through the standard rolling maintenance cycle. Upstream patch tracking that requires nothing from the user.

    View source ↗
  6. 16d ago

    View project audit logs permission deprecated

    The project:audit_logs:read permission is deprecated with a 30 October 2026 sunset and replaced by project:event_logs:read, granting the same access to the project events endpoint. A rename with a migration deadline attached, and part of the same permission-model resegmentation the MCP read-only policy belongs to.

    View source ↗