Download and install EMQX from the official release page for your platform; start the broker with emqx start and verify it is running with emqx_ctl status; the EMQX Dashboard is available at http://localhost:18083 with default credentials that must be changed immediately
Enable TLS on the MQTT SSL listener by placing CA, server certificate, and server key files in the etc/certs/ directory; edit the listener.ssl.default section in emqx.conf (or via the Dashboard) to set cacertfile, certfile, keyfile, and verify = verify_peer for mutual TLS
Configure authentication: for simple setups use the built-in password-based authenticator via the Dashboard under Access Control > Authentication; for production use an external database (MySQL, PostgreSQL, Redis) or JWT authentication plugin to centralize credential management
Set up authorization (ACL rules) to restrict which clients can publish or subscribe to which topics; rules can be stored in files, a database, or evaluated by a webhook — default-deny is the safest starting posture
Enable clustering for high availability by configuring the cluster discovery mechanism (e.g., static, DNS, or etcd) in emqx.conf; join nodes with emqx_ctl cluster join <node@host>; EMQX replicates session state and routing tables across cluster nodes
Monitor broker health via the Dashboard metrics panel or Prometheus endpoint (/api/v5/prometheus/stats with API key auth); watch connected_clients, messages.dropped, and authentication.failure counts as primary health signals
Known gotchas
The default EMQX Dashboard admin password must be changed immediately after installation; the default credentials are publicly documented and exploitation of exposed dashboards is a known attack vector
EMQX's default configuration permits anonymous connections; always set allow_anonymous = false and configure an authenticator before exposing the broker outside a trusted network
Clustering EMQX nodes requires low-latency network between nodes (typically co-located or same-region); high inter-node latency causes session sync delays and can lead to duplicate message delivery during network partitions
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp