Milvus MCP Server

The Milvus MCP server connects AI assistants to a Milvus vector database. Anyone using Milvus for semantic search, recommendations, or retrieval-augmented generation can use it to browse collections, test search queries, insert data, and check the state of the database in conversation, without writing a separate script with the Python client. According to GitHub the project lives in the zilliztech organization, the company behind Milvus, is licensed under Apache 2.0, is not archived, and was last updated in August 2026. The README does not explicitly call it official; that classification rests on the organization.

What is the Milvus MCP server?

According to milvus.io, Milvus is an open-source vector database for generative AI applications. It stores embeddings, meaning sequences of numbers that describe the content of a text or image, and finds the entries most similar to a query. The MCP server is a small intermediary: it runs in Python on your machine, connects through the address of your Milvus instance, and exposes its functions to the assistant as tools. The README lists twelve tools in total.

What can the assistant do with it?

The tools fall into three groups. Search includes milvus_text_search, milvus_vector_search, milvus_hybrid_search, milvus_text_similarity_search, and milvus_query. With them you check whether a collection returns sensible hits for a question, combine vector and full-text search, or filter by fields. For managing collections there are milvus_list_collections, milvus_create_collection, milvus_load_collection, milvus_release_collection, and milvus_get_collection_info. For the data itself there are milvus_insert_data and milvus_delete_entities. According to the README the text similarity search requires Milvus 2.6.0 or later and an embedding function configured on the Milvus server.

Transports and configuration

By default the server works over stdio, that is, as a local process the client starts. It also supports SSE and Streamable HTTP; the README recommends the latter for production, optionally in stateless mode. The connection is set through --milvus-uri or the environment variables MILVUS_URI, MILVUS_TOKEN (optional, for authentication), and MILVUS_DB (default: default). Note a pitfall from the README: a .env file in the source directory takes priority over command-line arguments.

Setup

You need Python 3.10 or newer, a running Milvus instance, and the uv tool. The README describes starting from a cloned repository with uv run src/mcp_server_milvus/server.py --milvus-uri http://localhost:19530; a Dockerfile is included in the repository. In the configuration examples for Claude Desktop and Cursor you must replace the placeholder for the path to uv and the project folder with your own paths. The documentation contains small inconsistencies, such as a reference to a different start file in the SSE example, so check commands against the actual file name.

Security and limits

The server cannot only read but also create collections, insert data, and delete entries. For experiments use a test instance or an account with narrowly scoped permissions, not your production data. The server has no sign-in of its own; if you expose it over SSE or HTTP, run it only in a protected network. Retrieved entries enter the language model's context and thereby reach the model provider.

Costs

The MCP server is free and open source. According to the vendor Milvus itself is open source and can be self-hosted without a license fee, in which case you carry operation and scaling yourself. If you prefer a managed service, Zilliz Cloud offers a hosted Milvus variant; we could not verify plans and terms and refer to the official Zilliz pricing page.

Who is the Milvus MCP server for?

It is worthwhile for developers who already use or are evaluating Milvus: for quickly trying out collections, checking search quality with a new embedding, and answering questions such as "Why does this query return no hits?". A coding agent that builds retrieval features into an application also benefits from access to a real development instance. Anyone not using Milvus gains nothing from it, and for unattended production use with write permissions particular care is needed.

Python 3.10 or newer, the uv tool, a running Milvus instance, and an MCP-capable client; for text similarity search Milvus 2.6.0 or later with a configured embedding function.

The Milvus MCP server runs locally and controls a Milvus instance. This guide walks through the setup.

Step 1: Prerequisites

You need Python 3.10 or newer, the uv tool, a running Milvus instance (according to milvus.io, for example Milvus Lite, Standalone, or Zilliz Cloud), and an MCP-capable client.

Get the repository

Clone the zilliztech/mcp-server-milvus repository from GitHub and change into the project folder.

Step 2: Start the server

Start the server with uv run src/mcp_server_milvus/server.py --milvus-uri http://localhost:19530. Adjust the address to your instance. For a protected instance also set the environment variable MILVUS_TOKEN; choose the database through MILVUS_DB.

uv run src/mcp_server_milvus/server.py --milvus-uri http://localhost:19530

Step 3: Register in Claude Desktop or Cursor

Under mcpServers add an entry with the command uv. Replace the placeholders for the path to uv and the project folder with your own paths and restart the client.

Choose a transport

The default is stdio. To run it as a separate service the server offers --sse and --streamable-http with --port; the README recommends Streamable HTTP for production. Run such endpoints only in a protected network.

Step 4: First requests

Ask the assistant to list the collections and fetch information about one collection. Load the collection before searching, then try a vector or text search.

Caution with write access

The server can insert data and delete entries. Work with a test instance or an account with narrowly scoped permissions.

Through the optional MILVUS_TOKEN of the Milvus instance; the server itself has no sign-in of its own.

Read and write access to the connected database within the scope of the credentials: collections can be created, loaded, and released, and data can be inserted and deleted.

The server runs locally and talks only to the configured Milvus instance. Retrieved entries and search results enter the AI client context and therefore reach the model provider.

Accidentally deleting entries, inserting wrong data into production collections, a server reachable unprotected over SSE or HTTP, and a .env file that silently overrides command-line values.