diff --git a/application/single_app/config.py b/application/single_app/config.py
index 3661cf2b0..7adc43bf2 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -96,7 +96,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.250.215"
+VERSION = "0.250.216"
 IS_DEVELOPMENT = is_development_env_enabled()
 
 SESSION_COOKIE_SAMESITE = os.getenv('SESSION_COOKIE_SAMESITE', 'Lax')
diff --git a/application/single_app/route_backend_plugins.py b/application/single_app/route_backend_plugins.py
index 7e0ae59cb..234dd62fa 100644
--- a/application/single_app/route_backend_plugins.py
+++ b/application/single_app/route_backend_plugins.py
@@ -17,12 +17,21 @@
     build_sql_server_odbc_connection_string,
     connect_with_sql_server_odbc_fallback,
 )
+from semantic_kernel_plugins.rocksdb_plugin import (
+    AUTH_SCHEME_API_KEY,
+    AUTH_SCHEME_BEARER,
+    AUTH_SCHEME_NONE,
+    DEFAULT_API_KEY_HEADER,
+    SUPPORTED_AUTH_SCHEMES,
+    normalize_rocksdb_base_url,
+)
 from functions_settings import get_settings, is_tabular_processing_enabled, update_settings
 from functions_authentication import *
 from functions_appinsights import log_event
 from swagger_wrapper import swagger_route, get_auth_security
 import logging
 import os
+import requests
 from functions_debug import debug_print
 import importlib.util
 from functions_plugins import get_merged_plugin_settings
@@ -456,6 +465,23 @@ def get_plugin_types(allowed_type_filter=None):
                                 },
                                 'metadata': {'description': 'Example Cosmos query plugin'}
                             }
+                        elif 'rocksdb' in module_name.lower():
+                            safe_manifest = {
+                                'endpoint': 'https://rocksdb.example.com/api',
+                                'auth': {'type': 'NoAuth'},
+                                'additionalFields': {
+                                    'base_url': 'https://rocksdb.example.com/api',
+                                    'auth_scheme': AUTH_SCHEME_NONE,
+                                    'column_family': 'default',
+                                    'key_encoding': 'utf8',
+                                    'value_encoding': 'utf8',
+                                    'read_only': True,
+                                    'max_results': 100,
+                                    'max_value_bytes': 32768,
+                                    'timeout': 30,
+                                },
+                                'metadata': {'description': 'Example RocksDB key-value action'}
+                            }
                         elif 'blob_storage' in module_name.lower():
                             safe_manifest = {
                                 'endpoint': 'https://example.blob.core.windows.net',
@@ -2702,3 +2728,143 @@ def request_with_timeout(*args, **kwargs):
                 client.close()
             except Exception:
                 pass
+
+
+@bpap.route('/api/plugins/test-rocksdb-connection', methods=['POST'])
+@swagger_route(security=get_auth_security())
+@login_required
+@user_required
+def test_rocksdb_connection():
+    """Probe a RocksDB HTTP service and confirm it answers with the expected contract."""
+    data = request.get_json(silent=True) or {}
+    user_id = get_current_user_id()
+    auth_scheme = (data.get('auth_scheme') or AUTH_SCHEME_NONE).strip().lower()
+    api_key_header = (data.get('api_key_header') or '').strip() or DEFAULT_API_KEY_HEADER
+    auth_key = (data.get('auth_key') or '').strip()
+    timeout = min(max(int(data.get('timeout', 10) or 10), 1), 30)
+
+    try:
+        base_url = normalize_rocksdb_base_url(data.get('base_url') or '')
+    except ValueError:
+        return jsonify({
+            'success': False,
+            'error': 'The RocksDB service base URL is invalid. Use an http or https URL that includes a host name.'
+        }), 400
+
+    if not base_url:
+        return jsonify({'success': False, 'error': 'A RocksDB service base URL is required.'}), 400
+    if auth_scheme not in SUPPORTED_AUTH_SCHEMES:
+        return jsonify({'success': False, 'error': "Auth scheme must be one of 'none', 'bearer', or 'api_key'."}), 400
+
+    try:
+        existing_plugin = _load_existing_plugin_for_test(data.get('existing_plugin'), user_id)
+    except PermissionError:
+        return jsonify({'success': False, 'error': 'You do not have access to the selected action.'}), 403
+    except LookupError:
+        return jsonify({'success': False, 'error': 'The selected action could not be found.'}), 404
+    except ValueError:
+        return jsonify({'success': False, 'error': 'The selected action reference is invalid.'}), 400
+
+    if auth_scheme != AUTH_SCHEME_NONE:
+        existing_auth = {}
+        if isinstance(existing_plugin, dict) and isinstance(existing_plugin.get('auth'), dict):
+            existing_auth = existing_plugin['auth']
+
+        if auth_key == ui_trigger_word:
+            auth_key = existing_auth.get('key', '')
+        if auth_key == ui_trigger_word:
+            return jsonify({
+                'success': False,
+                'error': 'The stored RocksDB service token could not be resolved for testing. Re-enter the token.'
+            }), 400
+
+        try:
+            auth_key = _resolve_secret_value_for_plugin_test(auth_key, 'auth.key', plugin_label='RocksDB')
+        except ValueError:
+            return jsonify({
+                'success': False,
+                'error': 'The stored RocksDB service token could not be resolved. Re-enter the token.'
+            }), 400
+
+        if not auth_key:
+            return jsonify({
+                'success': False,
+                'error': 'A service token is required when the auth scheme is bearer or api_key.'
+            }), 400
+
+    headers = {'Accept': 'application/json'}
+    if auth_scheme == AUTH_SCHEME_BEARER:
+        headers['Authorization'] = f'Bearer {auth_key}'
+    elif auth_scheme == AUTH_SCHEME_API_KEY:
+        headers[api_key_header] = auth_key
+
+    try:
+        response = requests.get(
+            f'{base_url}/health',
+            headers=headers,
+            timeout=timeout,
+        )
+
+        if response.status_code == 404:
+            # Minimal services may not implement /health, so fall back to a single-item scan.
+            response = requests.post(
+                f'{base_url}/scan',
+                json={'limit': 1},
+                headers=headers,
+                timeout=timeout,
+            )
+
+        if response.status_code in (401, 403):
+            return jsonify({
+                'success': False,
+                'error': 'The RocksDB service rejected the supplied credentials. Verify the auth scheme and token.'
+            }), 403
+
+        if response.status_code >= 400:
+            return jsonify({
+                'success': False,
+                'error': f'The RocksDB service returned HTTP {response.status_code}.'
+            }), 400
+
+        try:
+            response.json()
+        except ValueError:
+            return jsonify({
+                'success': False,
+                'error': 'The RocksDB service returned a non-JSON response. Confirm the base URL points at the service API root.'
+            }), 400
+
+        log_event(
+            '[PLUGINS] RocksDB connection test succeeded',
+            extra={'user_id': user_id, 'auth_scheme': auth_scheme, 'status_code': response.status_code},
+            level=logging.INFO,
+        )
+        return jsonify({
+            'success': True,
+            'message': f'Successfully reached the RocksDB service at {base_url}.'
+        })
+    except requests.exceptions.SSLError:
+        return jsonify({
+            'success': False,
+            'error': 'TLS verification failed for the RocksDB service. Install the issuing certificate authority in the application trust store.'
+        }), 400
+    except requests.exceptions.Timeout:
+        return jsonify({
+            'success': False,
+            'error': f'The RocksDB service did not respond within {timeout} seconds.'
+        }), 400
+    except Exception as exc:
+        log_event(
+            '[PLUGINS] RocksDB connection test failed',
+            extra={
+                'user_id': user_id,
+                'auth_scheme': auth_scheme,
+                'error_type': type(exc).__name__,
+            },
+            level=logging.WARNING,
+            exceptionTraceback=True,
+        )
+        return jsonify({
+            'success': False,
+            'error': 'The RocksDB service could not be reached. Verify the base URL and that the service is running.'
+        }), 400
diff --git a/application/single_app/semantic_kernel_plugins/plugin_health_checker.py b/application/single_app/semantic_kernel_plugins/plugin_health_checker.py
index b3850004f..358f13d43 100644
--- a/application/single_app/semantic_kernel_plugins/plugin_health_checker.py
+++ b/application/single_app/semantic_kernel_plugins/plugin_health_checker.py
@@ -73,6 +73,17 @@
     validate_mcp_endpoint_for_transport,
 )
 from functions_simplechat_operations import SIMPLECHAT_DEFAULT_ENDPOINT
+from semantic_kernel_plugins.rocksdb_plugin import (
+    AUTH_SCHEME_NONE,
+    MAX_RESULTS_CEILING,
+    MAX_TIMEOUT,
+    MAX_VALUE_BYTES_CEILING,
+    ROCKSDB_PLUGIN_TYPE,
+    SUPPORTED_AUTH_SCHEMES,
+    SUPPORTED_KEY_ENCODINGS,
+    SUPPORTED_VALUE_ENCODINGS,
+    normalize_rocksdb_base_url,
+)
 
 
 class PluginHealthChecker:
@@ -346,7 +357,10 @@ def validate_plugin_manifest(manifest: Dict[str, Any], plugin_type: str) -> Tupl
                 errors.append("Cosmos plugin only supports auth.type values 'identity' and 'key'")
             if auth_type == 'key' and not auth.get('key'):
                 errors.append("Cosmos plugin requires auth.key when auth.type='key'")
-        
+
+        elif plugin_type == ROCKSDB_PLUGIN_TYPE:
+            errors.extend(PluginHealthChecker._validate_rocksdb_manifest(manifest))
+
         elif plugin_type == 'log_analytics':
             additional_fields = manifest.get('additionalFields', {})
             if 'workspaceId' not in additional_fields:
@@ -441,7 +455,60 @@ def validate_plugin_manifest(manifest: Dict[str, Any], plugin_type: str) -> Tupl
                 errors.append("Azure Maps plugin requires auth.key with an Azure Maps subscription key")
         
         return len(errors) == 0, errors
-    
+
+    @staticmethod
+    def _validate_rocksdb_manifest(manifest: Dict[str, Any]) -> List[str]:
+        """Validate a RocksDB action manifest against the RocksDB HTTP service contract."""
+        errors: List[str] = []
+        additional_fields = manifest.get('additionalFields', {})
+        if not isinstance(additional_fields, dict):
+            additional_fields = {}
+
+        auth = manifest.get('auth', {}) if isinstance(manifest.get('auth'), dict) else {}
+
+        key_encoding = str(additional_fields.get('key_encoding') or 'utf8').strip().lower()
+        if key_encoding not in SUPPORTED_KEY_ENCODINGS:
+            errors.append("RocksDB plugin key_encoding must be either 'utf8' or 'base64'")
+
+        value_encoding = str(additional_fields.get('value_encoding') or 'utf8').strip().lower()
+        if value_encoding not in SUPPORTED_VALUE_ENCODINGS:
+            errors.append("RocksDB plugin value_encoding must be one of 'utf8', 'base64', or 'json'")
+
+        for field_name, minimum, maximum in (
+            ('max_results', 1, MAX_RESULTS_CEILING),
+            ('max_value_bytes', 1, MAX_VALUE_BYTES_CEILING),
+            ('timeout', 1, MAX_TIMEOUT),
+        ):
+            raw_value = additional_fields.get(field_name)
+            if raw_value in (None, ''):
+                continue
+            try:
+                parsed_value = int(raw_value)
+            except (TypeError, ValueError):
+                errors.append(f"RocksDB plugin additionalFields.{field_name} must be an integer")
+                continue
+            if parsed_value < minimum or parsed_value > maximum:
+                errors.append(
+                    f"RocksDB plugin additionalFields.{field_name} must be between {minimum} and {maximum}"
+                )
+
+        base_url = str(additional_fields.get('base_url') or manifest.get('endpoint') or '').strip()
+        if not base_url:
+            errors.append("RocksDB plugin requires 'base_url' in additionalFields")
+        else:
+            try:
+                normalize_rocksdb_base_url(base_url)
+            except ValueError as validation_error:
+                errors.append(f"RocksDB plugin base_url is invalid: {validation_error}")
+
+        auth_scheme = str(additional_fields.get('auth_scheme') or AUTH_SCHEME_NONE).strip().lower()
+        if auth_scheme not in SUPPORTED_AUTH_SCHEMES:
+            errors.append("RocksDB plugin auth_scheme must be one of 'none', 'bearer', or 'api_key'")
+        elif auth_scheme != AUTH_SCHEME_NONE and not auth.get('key'):
+            errors.append("RocksDB plugin requires auth.key when auth_scheme is 'bearer' or 'api_key'")
+
+        return errors
+
     @staticmethod
     def check_plugin_health(plugin_instance: BasePlugin, plugin_name: str) -> Dict[str, Any]:
         """
diff --git a/application/single_app/semantic_kernel_plugins/rocksdb_plugin.py b/application/single_app/semantic_kernel_plugins/rocksdb_plugin.py
new file mode 100644
index 000000000..2db297b40
--- /dev/null
+++ b/application/single_app/semantic_kernel_plugins/rocksdb_plugin.py
@@ -0,0 +1,902 @@
+# rocksdb_plugin.py
+"""
+RocksDB key-value store plugin for Semantic Kernel.
+
+RocksDB is an embedded C++ library with no native network protocol, so this plugin talks to a
+RocksDB-backed HTTP/JSON service using the SimpleChat RocksDB service contract documented in
+``docs/explanation/features/v0.250.216/ROCKSDB_ACTION.md``. SimpleChat never opens a RocksDB
+database directory itself.
+
+Read operations are always available. Write operations are refused unless the action is
+explicitly configured with ``read_only`` disabled.
+"""
+
+import json
+import logging
+from typing import Any, Dict, List, Optional, Tuple, Union
+from urllib.parse import urlparse
+
+import requests
+from semantic_kernel.functions import kernel_function
+
+from functions_appinsights import log_event, sanitize_log_message
+from semantic_kernel_plugins.base_plugin import BasePlugin
+from semantic_kernel_plugins.plugin_invocation_logger import plugin_function_logger
+
+
+ROCKSDB_PLUGIN_TYPE = "rocksdb"
+
+AUTH_SCHEME_NONE = "none"
+AUTH_SCHEME_BEARER = "bearer"
+AUTH_SCHEME_API_KEY = "api_key"
+SUPPORTED_AUTH_SCHEMES = (AUTH_SCHEME_NONE, AUTH_SCHEME_BEARER, AUTH_SCHEME_API_KEY)
+
+KEY_ENCODING_UTF8 = "utf8"
+KEY_ENCODING_BASE64 = "base64"
+SUPPORTED_KEY_ENCODINGS = (KEY_ENCODING_UTF8, KEY_ENCODING_BASE64)
+
+VALUE_ENCODING_UTF8 = "utf8"
+VALUE_ENCODING_BASE64 = "base64"
+VALUE_ENCODING_JSON = "json"
+SUPPORTED_VALUE_ENCODINGS = (VALUE_ENCODING_UTF8, VALUE_ENCODING_BASE64, VALUE_ENCODING_JSON)
+
+DEFAULT_COLUMN_FAMILY = "default"
+DEFAULT_API_KEY_HEADER = "X-API-Key"
+DEFAULT_MAX_RESULTS = 100
+MAX_RESULTS_CEILING = 1000
+DEFAULT_MAX_VALUE_BYTES = 32768
+MAX_VALUE_BYTES_CEILING = 1048576
+DEFAULT_TIMEOUT = 30
+MAX_TIMEOUT = 300
+ALLOWED_REMOTE_SCHEMES = ("http", "https")
+
+
+def normalize_rocksdb_base_url(base_url: str) -> str:
+    """Normalize a RocksDB service base URL and reject unsupported schemes."""
+    cleaned_url = (base_url or "").strip().rstrip("/")
+    if not cleaned_url:
+        return ""
+
+    parsed_url = urlparse(cleaned_url)
+    if parsed_url.scheme.lower() not in ALLOWED_REMOTE_SCHEMES:
+        raise ValueError("RocksDB service URLs must use the http or https scheme.")
+    if not parsed_url.netloc:
+        raise ValueError("RocksDB service URLs must include a host name.")
+    return cleaned_url
+
+
+class RocksDbResult:
+    """Structured RocksDB plugin result paired with the plugin metadata."""
+
+    def __init__(self, data: Any, metadata: Dict[str, Any]):
+        self.data = data
+        self.metadata = metadata
+
+    def __str__(self) -> str:
+        return str(self.data)
+
+    def __repr__(self) -> str:
+        return f"RocksDbResult(data={self.data!r}, metadata={self.metadata!r})"
+
+
+class RocksDbPlugin(BasePlugin):
+    """RocksDB key-value plugin backed by a RocksDB HTTP/JSON service."""
+
+    def __init__(self, manifest: Optional[Dict[str, Any]] = None):
+        super().__init__(manifest)
+        self.manifest = manifest or {}
+        additional_fields = self.manifest.get("additionalFields", {}) or {}
+        auth = self.manifest.get("auth", {}) or {}
+
+        self.base_url = str(
+            additional_fields.get("base_url") or self.manifest.get("endpoint") or ""
+        ).strip().rstrip("/")
+        self.auth_scheme = self._normalize_choice(
+            additional_fields.get("auth_scheme"), AUTH_SCHEME_NONE
+        )
+        self.api_key_header = (
+            str(additional_fields.get("api_key_header") or "").strip() or DEFAULT_API_KEY_HEADER
+        )
+
+        self.column_family = (
+            str(additional_fields.get("column_family") or "").strip() or DEFAULT_COLUMN_FAMILY
+        )
+        self.key_encoding = self._normalize_choice(
+            additional_fields.get("key_encoding"), KEY_ENCODING_UTF8
+        )
+        self.value_encoding = self._normalize_choice(
+            additional_fields.get("value_encoding"), VALUE_ENCODING_UTF8
+        )
+        self.key_prefix_hints = self._normalize_prefix_hints(
+            additional_fields.get("key_prefix_hints")
+        )
+        self.read_only = self._coerce_bool(additional_fields.get("read_only"), True)
+        self.max_results = self._coerce_int(
+            additional_fields.get("max_results"), DEFAULT_MAX_RESULTS, "max_results"
+        )
+        self.max_value_bytes = self._coerce_int(
+            additional_fields.get("max_value_bytes"), DEFAULT_MAX_VALUE_BYTES, "max_value_bytes"
+        )
+        self.timeout = self._coerce_int(additional_fields.get("timeout"), DEFAULT_TIMEOUT, "timeout")
+
+        self.auth_type = str(auth.get("type") or "NoAuth").strip()
+        self.auth_key = str(auth.get("key") or "").strip()
+        self._metadata = self.manifest.get("metadata", {}) or {}
+        self._http_session = None
+
+        self._validate_configuration()
+
+        log_event(
+            "[ROCKSDB_PLUGIN] Initialized plugin",
+            extra={
+                "column_family": self.column_family,
+                "key_encoding": self.key_encoding,
+                "value_encoding": self.value_encoding,
+                "read_only": self.read_only,
+                "max_results": self.max_results,
+                "max_value_bytes": self.max_value_bytes,
+                "timeout": self.timeout,
+                "auth_scheme": self.auth_scheme,
+                "prefix_hint_count": len(self.key_prefix_hints),
+            },
+            level=logging.INFO,
+        )
+
+    @property
+    def display_name(self) -> str:
+        return "RocksDB"
+
+    @property
+    def metadata(self) -> Dict[str, Any]:
+        user_desc = self._metadata.get(
+            "description",
+            "RocksDB key-value store plugin backed by a RocksDB HTTP service.",
+        )
+        write_desc = (
+            "Write operations are blocked because this action is configured as read-only."
+            if self.read_only
+            else "Write operations are enabled for this action; confirm intent before mutating data."
+        )
+        api_desc = (
+            "This plugin reads an ordered RocksDB key-value store through a RocksDB HTTP service. "
+            "Keys are byte strings sorted lexicographically, so prefix and range scans are the "
+            "efficient access patterns; avoid scanning the whole keyspace. Use get_value for a "
+            "single key, get_values for a batch of keys, and scan_prefix or scan_range to walk a "
+            f"key range. {write_desc}"
+        )
+        return {
+            "name": self._metadata.get("name", "rocksdb_plugin"),
+            "type": ROCKSDB_PLUGIN_TYPE,
+            "description": f"{user_desc}\n\n{api_desc}",
+            "methods": [
+                {
+                    "name": "get_value",
+                    "description": "Read a single value by exact key.",
+                    "parameters": [
+                        {"name": "key", "type": "str", "description": "Exact key to read.", "required": True},
+                        {"name": "column_family", "type": "str", "description": "Optional column family override.", "required": False},
+                    ],
+                    "returns": {"type": "RocksDbResult", "description": "The value plus lookup metadata."},
+                },
+                {
+                    "name": "get_values",
+                    "description": "Read several values in one call using exact keys.",
+                    "parameters": [
+                        {"name": "keys", "type": "List[str] | str", "description": "Keys to read, as a list or JSON array string.", "required": True},
+                        {"name": "column_family", "type": "str", "description": "Optional column family override.", "required": False},
+                    ],
+                    "returns": {"type": "RocksDbResult", "description": "One result entry per requested key."},
+                },
+                {
+                    "name": "key_exists",
+                    "description": "Check whether a key is present without returning its value.",
+                    "parameters": [
+                        {"name": "key", "type": "str", "description": "Exact key to test.", "required": True},
+                        {"name": "column_family", "type": "str", "description": "Optional column family override.", "required": False},
+                    ],
+                    "returns": {"type": "RocksDbResult", "description": "Existence flag for the key."},
+                },
+                {
+                    "name": "scan_prefix",
+                    "description": "List key-value pairs whose keys start with a prefix.",
+                    "parameters": [
+                        {"name": "prefix", "type": "str", "description": "Key prefix to scan.", "required": True},
+                        {"name": "limit", "type": "int", "description": "Optional per-call result cap.", "required": False},
+                        {"name": "column_family", "type": "str", "description": "Optional column family override.", "required": False},
+                    ],
+                    "returns": {"type": "RocksDbResult", "description": "Matching key-value pairs and truncation state."},
+                },
+                {
+                    "name": "scan_range",
+                    "description": "List key-value pairs between an inclusive start key and an exclusive end key.",
+                    "parameters": [
+                        {"name": "start_key", "type": "str", "description": "Inclusive first key of the range.", "required": False},
+                        {"name": "end_key", "type": "str", "description": "Exclusive last key of the range.", "required": False},
+                        {"name": "limit", "type": "int", "description": "Optional per-call result cap.", "required": False},
+                        {"name": "reverse", "type": "bool", "description": "Walk the range in descending key order.", "required": False},
+                        {"name": "column_family", "type": "str", "description": "Optional column family override.", "required": False},
+                    ],
+                    "returns": {"type": "RocksDbResult", "description": "Matching key-value pairs and truncation state."},
+                },
+                {
+                    "name": "list_column_families",
+                    "description": "List the column families available in the configured database.",
+                    "parameters": [],
+                    "returns": {"type": "RocksDbResult", "description": "Available column family names."},
+                },
+                {
+                    "name": "get_database_stats",
+                    "description": "Report size and key-count estimates for the configured database.",
+                    "parameters": [],
+                    "returns": {"type": "RocksDbResult", "description": "Database statistics."},
+                },
+                {
+                    "name": "put_value",
+                    "description": "Write a single key-value pair. Requires the action to allow writes.",
+                    "parameters": [
+                        {"name": "key", "type": "str", "description": "Key to write.", "required": True},
+                        {"name": "value", "type": "Any", "description": "Value to store.", "required": True},
+                        {"name": "column_family", "type": "str", "description": "Optional column family override.", "required": False},
+                    ],
+                    "returns": {"type": "RocksDbResult", "description": "Write confirmation."},
+                },
+                {
+                    "name": "delete_value",
+                    "description": "Delete a single key. Requires the action to allow writes.",
+                    "parameters": [
+                        {"name": "key", "type": "str", "description": "Key to delete.", "required": True},
+                        {"name": "column_family", "type": "str", "description": "Optional column family override.", "required": False},
+                    ],
+                    "returns": {"type": "RocksDbResult", "description": "Delete confirmation."},
+                },
+                {
+                    "name": "write_batch",
+                    "description": "Apply several put and delete operations atomically. Requires the action to allow writes.",
+                    "parameters": [
+                        {"name": "operations", "type": "List[Dict[str, Any]] | str", "description": "Operations as a list or JSON array string, each with op, key, and value.", "required": True},
+                        {"name": "column_family", "type": "str", "description": "Optional column family override.", "required": False},
+                    ],
+                    "returns": {"type": "RocksDbResult", "description": "Batch write confirmation."},
+                },
+            ],
+        }
+
+    def get_functions(self) -> List[str]:
+        return [
+            "get_value",
+            "get_values",
+            "key_exists",
+            "scan_prefix",
+            "scan_range",
+            "list_column_families",
+            "get_database_stats",
+            "put_value",
+            "delete_value",
+            "write_batch",
+        ]
+
+    def set_http_session(self, session: Any) -> None:
+        """Override the HTTP session used for RocksDB service calls."""
+        self._http_session = session
+
+    def build_instruction_context(self) -> str:
+        """Return agent instruction text describing the configured RocksDB store."""
+        hint_lines = [f"- {prefix_hint}" for prefix_hint in self.key_prefix_hints] or [
+            "- No key prefix hints were configured."
+        ]
+        access_line = (
+            "- Access: read-only"
+            if self.read_only
+            else "- Access: reads and writes are enabled"
+        )
+        return (
+            f"### RocksDB Store: {self.base_url}\n"
+            f"- Column family: {self.column_family}\n"
+            f"{access_line}\n"
+            f"- Max results per call: {self.max_results}\n"
+            f"- Key encoding: {self.key_encoding}, value encoding: {self.value_encoding}\n"
+            "- Keys are byte strings sorted lexicographically; prefer prefix and range scans.\n"
+            "- Configured key prefix hints:\n"
+            + "\n".join(hint_lines)
+        )
+
+    @kernel_function(description="Read a single RocksDB value by its exact key. Use this when you already know the full key; use scan_prefix when you only know how the key starts.")
+    @plugin_function_logger("RocksDbPlugin")
+    def get_value(self, key: str, column_family: Optional[str] = None) -> RocksDbResult:
+        try:
+            resolved_family = self._resolve_column_family(column_family)
+            payload = self._remote_request(
+                "POST", "/get", {"key": key, "column_family": resolved_family}
+            )
+            found = bool(payload.get("found", payload.get("value") is not None))
+            value, truncated, byte_length = self._normalize_value(payload.get("value"))
+
+            return self._success(
+                {
+                    "key": key,
+                    "column_family": resolved_family,
+                    "found": found,
+                    "value": value if found else None,
+                    "value_bytes": byte_length,
+                    "value_truncated": truncated,
+                }
+            )
+        except Exception as exc:
+            return self._failure("get_value", exc, {"key": key})
+
+    @kernel_function(description="Read several RocksDB values in one call using their exact keys. Pass the keys as a list or a JSON array string.")
+    @plugin_function_logger("RocksDbPlugin")
+    def get_values(
+        self,
+        keys: Union[str, List[str]],
+        column_family: Optional[str] = None,
+    ) -> RocksDbResult:
+        try:
+            resolved_family = self._resolve_column_family(column_family)
+            normalized_keys = self._normalize_key_list(keys)
+            if not normalized_keys:
+                raise ValueError("At least one key is required.")
+            if len(normalized_keys) > self.max_results:
+                normalized_keys = normalized_keys[: self.max_results]
+
+            payload = self._remote_request(
+                "POST",
+                "/multi_get",
+                {"keys": normalized_keys, "column_family": resolved_family},
+            )
+            remote_results = payload.get("results")
+            if not isinstance(remote_results, list):
+                raise RuntimeError("RocksDB service returned an unexpected multi_get payload.")
+
+            results = []
+            for entry in remote_results:
+                entry_dict = entry if isinstance(entry, dict) else {}
+                found = bool(entry_dict.get("found", entry_dict.get("value") is not None))
+                value, truncated, byte_length = self._normalize_value(entry_dict.get("value"))
+                results.append(
+                    {
+                        "key": entry_dict.get("key"),
+                        "found": found,
+                        "value": value if found else None,
+                        "value_bytes": byte_length,
+                        "value_truncated": truncated,
+                    }
+                )
+
+            return self._success(
+                {
+                    "column_family": resolved_family,
+                    "requested_key_count": len(normalized_keys),
+                    "found_count": sum(1 for entry in results if entry.get("found")),
+                    "results": results,
+                }
+            )
+        except Exception as exc:
+            return self._failure("get_values", exc, {"key_count": self._safe_length(keys)})
+
+    @kernel_function(description="Check whether a RocksDB key exists without returning its value. Use this for cheap existence checks on large values.")
+    @plugin_function_logger("RocksDbPlugin")
+    def key_exists(self, key: str, column_family: Optional[str] = None) -> RocksDbResult:
+        try:
+            resolved_family = self._resolve_column_family(column_family)
+            payload = self._remote_request(
+                "POST", "/exists", {"key": key, "column_family": resolved_family}
+            )
+            exists = bool(payload.get("exists", payload.get("found", False)))
+            return self._success(
+                {"key": key, "column_family": resolved_family, "exists": exists}
+            )
+        except Exception as exc:
+            return self._failure("key_exists", exc, {"key": key})
+
+    @kernel_function(description="List RocksDB key-value pairs whose keys start with a prefix. This is the efficient way to explore a RocksDB store because keys are stored in sorted order.")
+    @plugin_function_logger("RocksDbPlugin")
+    def scan_prefix(
+        self,
+        prefix: str,
+        limit: Optional[int] = None,
+        column_family: Optional[str] = None,
+    ) -> RocksDbResult:
+        try:
+            resolved_family = self._resolve_column_family(column_family)
+            effective_limit = self._resolve_limit(limit)
+            items, truncated = self._scan(
+                column_family=resolved_family,
+                prefix=prefix,
+                start_key=None,
+                end_key=None,
+                limit=effective_limit,
+                reverse=False,
+            )
+            return self._success(
+                {
+                    "column_family": resolved_family,
+                    "prefix": prefix,
+                    "limit": effective_limit,
+                    "item_count": len(items),
+                    "is_truncated": truncated,
+                    "items": items,
+                }
+            )
+        except Exception as exc:
+            return self._failure("scan_prefix", exc, {"prefix": prefix})
+
+    @kernel_function(description="List RocksDB key-value pairs between an inclusive start key and an exclusive end key. Set reverse to walk the range from the highest key downwards.")
+    @plugin_function_logger("RocksDbPlugin")
+    def scan_range(
+        self,
+        start_key: Optional[str] = None,
+        end_key: Optional[str] = None,
+        limit: Optional[int] = None,
+        reverse: bool = False,
+        column_family: Optional[str] = None,
+    ) -> RocksDbResult:
+        try:
+            resolved_family = self._resolve_column_family(column_family)
+            effective_limit = self._resolve_limit(limit)
+            normalized_reverse = self._coerce_bool(reverse, False)
+            items, truncated = self._scan(
+                column_family=resolved_family,
+                prefix=None,
+                start_key=start_key,
+                end_key=end_key,
+                limit=effective_limit,
+                reverse=normalized_reverse,
+            )
+            return self._success(
+                {
+                    "column_family": resolved_family,
+                    "start_key": start_key,
+                    "end_key": end_key,
+                    "reverse": normalized_reverse,
+                    "limit": effective_limit,
+                    "item_count": len(items),
+                    "is_truncated": truncated,
+                    "items": items,
+                }
+            )
+        except Exception as exc:
+            return self._failure(
+                "scan_range", exc, {"start_key": start_key, "end_key": end_key}
+            )
+
+    @kernel_function(description="List the column families available in the configured RocksDB database.")
+    @plugin_function_logger("RocksDbPlugin")
+    def list_column_families(self) -> RocksDbResult:
+        try:
+            payload = self._remote_request("GET", "/column_families")
+            column_families = payload.get("column_families")
+            if not isinstance(column_families, list):
+                raise RuntimeError(
+                    "RocksDB service returned an unexpected column_families payload."
+                )
+
+            return self._success(
+                {
+                    "column_families": column_families,
+                    "configured_column_family": self.column_family,
+                }
+            )
+        except Exception as exc:
+            return self._failure("list_column_families", exc)
+
+    @kernel_function(description="Report size and key-count estimates for the configured RocksDB database.")
+    @plugin_function_logger("RocksDbPlugin")
+    def get_database_stats(self) -> RocksDbResult:
+        try:
+            payload = self._remote_request("GET", "/stats")
+            statistics = payload.get("stats", payload)
+            return self._success(
+                {
+                    "column_family": self.column_family,
+                    "read_only": self.read_only,
+                    "stats": statistics,
+                }
+            )
+        except Exception as exc:
+            return self._failure("get_database_stats", exc)
+
+    @kernel_function(description="Write a single RocksDB key-value pair. This is refused when the action is configured as read-only.")
+    @plugin_function_logger("RocksDbPlugin")
+    def put_value(
+        self,
+        key: str,
+        value: Any,
+        column_family: Optional[str] = None,
+    ) -> RocksDbResult:
+        blocked_result = self._write_guard("put_value")
+        if blocked_result is not None:
+            return blocked_result
+
+        try:
+            resolved_family = self._resolve_column_family(column_family)
+            self._remote_request(
+                "POST",
+                "/put",
+                {"key": key, "value": value, "column_family": resolved_family},
+            )
+
+            log_event(
+                "[ROCKSDB_PLUGIN] Key written",
+                extra={"column_family": resolved_family},
+                level=logging.INFO,
+            )
+            return self._success(
+                {"key": key, "column_family": resolved_family, "written": True}
+            )
+        except Exception as exc:
+            return self._failure("put_value", exc, {"key": key})
+
+    @kernel_function(description="Delete a single RocksDB key. This is refused when the action is configured as read-only.")
+    @plugin_function_logger("RocksDbPlugin")
+    def delete_value(self, key: str, column_family: Optional[str] = None) -> RocksDbResult:
+        blocked_result = self._write_guard("delete_value")
+        if blocked_result is not None:
+            return blocked_result
+
+        try:
+            resolved_family = self._resolve_column_family(column_family)
+            self._remote_request(
+                "POST", "/delete", {"key": key, "column_family": resolved_family}
+            )
+
+            log_event(
+                "[ROCKSDB_PLUGIN] Key deleted",
+                extra={"column_family": resolved_family},
+                level=logging.INFO,
+            )
+            return self._success(
+                {"key": key, "column_family": resolved_family, "deleted": True}
+            )
+        except Exception as exc:
+            return self._failure("delete_value", exc, {"key": key})
+
+    @kernel_function(description="Apply several RocksDB put and delete operations atomically. Each operation needs an op of put or delete, a key, and a value for puts. This is refused when the action is configured as read-only.")
+    @plugin_function_logger("RocksDbPlugin")
+    def write_batch(
+        self,
+        operations: Union[str, List[Dict[str, Any]]],
+        column_family: Optional[str] = None,
+    ) -> RocksDbResult:
+        blocked_result = self._write_guard("write_batch")
+        if blocked_result is not None:
+            return blocked_result
+
+        try:
+            resolved_family = self._resolve_column_family(column_family)
+            normalized_operations = self._normalize_batch_operations(operations)
+            if not normalized_operations:
+                raise ValueError("At least one batch operation is required.")
+            if len(normalized_operations) > self.max_results:
+                raise ValueError(
+                    f"Batch operations are limited to {self.max_results} entries per call."
+                )
+
+            self._remote_request(
+                "POST",
+                "/batch",
+                {"operations": normalized_operations, "column_family": resolved_family},
+            )
+
+            log_event(
+                "[ROCKSDB_PLUGIN] Batch applied",
+                extra={
+                    "column_family": resolved_family,
+                    "operation_count": len(normalized_operations),
+                },
+                level=logging.INFO,
+            )
+            return self._success(
+                {
+                    "column_family": resolved_family,
+                    "operation_count": len(normalized_operations),
+                    "applied": True,
+                }
+            )
+        except Exception as exc:
+            return self._failure("write_batch", exc)
+
+    def _validate_configuration(self) -> None:
+        if self.key_encoding not in SUPPORTED_KEY_ENCODINGS:
+            raise ValueError("RocksDbPlugin key_encoding must be either 'utf8' or 'base64'.")
+        if self.value_encoding not in SUPPORTED_VALUE_ENCODINGS:
+            raise ValueError(
+                "RocksDbPlugin value_encoding must be one of 'utf8', 'base64', or 'json'."
+            )
+        if self.max_results < 1 or self.max_results > MAX_RESULTS_CEILING:
+            raise ValueError(
+                f"RocksDbPlugin max_results must be between 1 and {MAX_RESULTS_CEILING}."
+            )
+        if self.max_value_bytes < 1 or self.max_value_bytes > MAX_VALUE_BYTES_CEILING:
+            raise ValueError(
+                f"RocksDbPlugin max_value_bytes must be between 1 and {MAX_VALUE_BYTES_CEILING}."
+            )
+        if self.timeout < 1 or self.timeout > MAX_TIMEOUT:
+            raise ValueError(
+                f"RocksDbPlugin timeout must be between 1 and {MAX_TIMEOUT} seconds."
+            )
+
+        self.base_url = normalize_rocksdb_base_url(self.base_url)
+        if not self.base_url:
+            raise ValueError("RocksDbPlugin requires base_url for the RocksDB service.")
+        if self.auth_scheme not in SUPPORTED_AUTH_SCHEMES:
+            raise ValueError(
+                "RocksDbPlugin auth_scheme must be one of 'none', 'bearer', or 'api_key'."
+            )
+        if self.auth_scheme != AUTH_SCHEME_NONE and not self.auth_key:
+            raise ValueError(
+                "RocksDbPlugin requires auth.key when auth_scheme is 'bearer' or 'api_key'."
+            )
+
+    def _success(self, payload: Dict[str, Any]) -> RocksDbResult:
+        return RocksDbResult(dict(payload), self.metadata)
+
+    def _failure(
+        self,
+        operation: str,
+        error: Exception,
+        context: Optional[Dict[str, Any]] = None,
+    ) -> RocksDbResult:
+        # Log the error type and a sanitized detail rather than interpolating the raw
+        # exception, because transport exceptions can embed request details.
+        log_event(
+            f"[ROCKSDB_PLUGIN] {operation} failed",
+            extra={
+                "operation": operation,
+                "column_family": self.column_family,
+                "error_type": type(error).__name__,
+            },
+            level=logging.ERROR,
+            exceptionTraceback=True,
+        )
+        payload = {"operation": operation, "error": sanitize_log_message(error)}
+        if context:
+            payload.update(context)
+        return RocksDbResult(payload, self.metadata)
+
+    def _write_guard(self, operation: str) -> Optional[RocksDbResult]:
+        if not self.read_only:
+            return None
+        return RocksDbResult(
+            {
+                "operation": operation,
+                "error": (
+                    f"The '{operation}' operation is blocked because this RocksDB action is "
+                    "configured as read-only."
+                ),
+                "read_only": True,
+            },
+            self.metadata,
+        )
+
+    def _resolve_column_family(self, column_family: Optional[str]) -> str:
+        candidate = str(column_family or "").strip()
+        return candidate or self.column_family
+
+    def _resolve_limit(self, limit: Optional[int]) -> int:
+        if limit in (None, ""):
+            return self.max_results
+        try:
+            requested_limit = int(limit)
+        except (TypeError, ValueError):
+            return self.max_results
+        if requested_limit < 1:
+            return self.max_results
+        return min(requested_limit, self.max_results)
+
+    def _scan(
+        self,
+        column_family: str,
+        prefix: Optional[str],
+        start_key: Optional[str],
+        end_key: Optional[str],
+        limit: int,
+        reverse: bool,
+    ) -> Tuple[List[Dict[str, Any]], bool]:
+        request_payload = {
+            "column_family": column_family,
+            "limit": limit,
+            "reverse": reverse,
+        }
+        if prefix not in (None, ""):
+            request_payload["prefix"] = prefix
+        if start_key not in (None, ""):
+            request_payload["start_key"] = start_key
+        if end_key not in (None, ""):
+            request_payload["end_key"] = end_key
+
+        payload = self._remote_request("POST", "/scan", request_payload)
+        remote_items = payload.get("items")
+        if not isinstance(remote_items, list):
+            raise RuntimeError("RocksDB service returned an unexpected scan payload.")
+
+        items = []
+        for entry in remote_items[:limit]:
+            entry_dict = entry if isinstance(entry, dict) else {}
+            value, truncated, byte_length = self._normalize_value(entry_dict.get("value"))
+            items.append(
+                {
+                    "key": entry_dict.get("key"),
+                    "value": value,
+                    "value_bytes": byte_length,
+                    "value_truncated": truncated,
+                }
+            )
+
+        is_truncated = bool(payload.get("truncated", len(remote_items) > limit))
+        return items, is_truncated
+
+    def _remote_request(
+        self,
+        method: str,
+        path: str,
+        payload: Optional[Dict[str, Any]] = None,
+    ) -> Dict[str, Any]:
+        session = self._http_session
+        if session is None:
+            session = requests.Session()
+            self._http_session = session
+
+        request_payload = None
+        if payload is not None:
+            # The service needs the wire encoding to interpret keys and values correctly.
+            request_payload = dict(payload)
+            request_payload["key_encoding"] = self.key_encoding
+            request_payload["value_encoding"] = self.value_encoding
+
+        response = session.request(
+            method,
+            f"{self.base_url}{path}",
+            json=request_payload,
+            headers=self._build_remote_headers(),
+            timeout=self.timeout,
+        )
+
+        status_code = getattr(response, "status_code", None)
+        if status_code is None or int(status_code) >= 400:
+            raise RuntimeError(
+                f"RocksDB service request to {path} failed with HTTP {status_code}."
+            )
+
+        try:
+            body = response.json()
+        except Exception as decode_error:
+            raise RuntimeError(
+                f"RocksDB service request to {path} returned a non-JSON response."
+            ) from decode_error
+
+        if not isinstance(body, dict):
+            raise RuntimeError(
+                f"RocksDB service request to {path} returned an unexpected payload shape."
+            )
+        return body
+
+    def _build_remote_headers(self) -> Dict[str, str]:
+        headers = {"Accept": "application/json"}
+        if self.auth_scheme == AUTH_SCHEME_BEARER and self.auth_key:
+            headers["Authorization"] = f"Bearer {self.auth_key}"
+        elif self.auth_scheme == AUTH_SCHEME_API_KEY and self.auth_key:
+            headers[self.api_key_header] = self.auth_key
+        return headers
+
+    def _normalize_value(self, value: Any) -> Tuple[Any, bool, int]:
+        """Cap an oversized service value so one record cannot flood the model context."""
+        if value is None:
+            return None, False, 0
+
+        if isinstance(value, str):
+            raw_bytes = value.encode("utf-8", errors="replace")
+        else:
+            raw_bytes = json.dumps(value, default=str).encode("utf-8")
+
+        byte_length = len(raw_bytes)
+        if byte_length <= self.max_value_bytes:
+            return value, False, byte_length
+        return (
+            raw_bytes[: self.max_value_bytes].decode("utf-8", errors="replace"),
+            True,
+            byte_length,
+        )
+
+    def _normalize_key_list(self, keys: Union[str, List[Any]]) -> List[str]:
+        candidate_keys = keys
+        if isinstance(candidate_keys, str):
+            stripped_keys = candidate_keys.strip()
+            if stripped_keys.startswith("["):
+                try:
+                    candidate_keys = json.loads(stripped_keys)
+                except (TypeError, ValueError) as decode_error:
+                    raise ValueError(
+                        "Keys must be a list or a valid JSON array string."
+                    ) from decode_error
+            else:
+                candidate_keys = [
+                    part.strip() for part in stripped_keys.split(",") if part.strip()
+                ]
+
+        if not isinstance(candidate_keys, (list, tuple)):
+            raise ValueError("Keys must be a list or a valid JSON array string.")
+        return [str(single_key) for single_key in candidate_keys if str(single_key).strip()]
+
+    def _normalize_batch_operations(
+        self, operations: Union[str, List[Dict[str, Any]]]
+    ) -> List[Dict[str, Any]]:
+        candidate_operations = operations
+        if isinstance(candidate_operations, str):
+            try:
+                candidate_operations = json.loads(candidate_operations)
+            except (TypeError, ValueError) as decode_error:
+                raise ValueError(
+                    "Batch operations must be a list or a valid JSON array string."
+                ) from decode_error
+
+        if isinstance(candidate_operations, dict):
+            candidate_operations = [candidate_operations]
+        if not isinstance(candidate_operations, (list, tuple)):
+            raise ValueError("Batch operations must be a list or a valid JSON array string.")
+
+        normalized_operations = []
+        for operation in candidate_operations:
+            if not isinstance(operation, dict):
+                raise ValueError("Each batch operation must be an object.")
+            operation_name = str(operation.get("op") or "").strip().lower()
+            if operation_name not in ("put", "delete"):
+                raise ValueError("Batch operations must use an op of 'put' or 'delete'.")
+            if str(operation.get("key") or "").strip() == "":
+                raise ValueError("Each batch operation requires a key.")
+            normalized_operations.append(
+                {
+                    "op": operation_name,
+                    "key": operation.get("key"),
+                    "value": operation.get("value"),
+                }
+            )
+        return normalized_operations
+
+    @staticmethod
+    def _normalize_choice(value: Any, default_value: str) -> str:
+        normalized_value = str(value or "").strip().lower()
+        return normalized_value or default_value
+
+    @staticmethod
+    def _normalize_prefix_hints(prefix_hints: Any) -> List[str]:
+        if prefix_hints in (None, ""):
+            return []
+        if isinstance(prefix_hints, str):
+            candidates = [part.strip() for part in prefix_hints.replace("\n", ",").split(",")]
+        elif isinstance(prefix_hints, (list, tuple)):
+            candidates = [str(part).strip() for part in prefix_hints]
+        else:
+            return []
+        return [candidate for candidate in candidates if candidate]
+
+    @staticmethod
+    def _coerce_bool(value: Any, default_value: bool) -> bool:
+        if value in (None, ""):
+            return default_value
+        if isinstance(value, bool):
+            return value
+        normalized_value = str(value).strip().lower()
+        if normalized_value in ("true", "1", "yes", "on"):
+            return True
+        if normalized_value in ("false", "0", "no", "off"):
+            return False
+        return default_value
+
+    @staticmethod
+    def _coerce_int(value: Any, default_value: int, field_name: str) -> int:
+        if value in (None, ""):
+            return default_value
+        try:
+            return int(value)
+        except (TypeError, ValueError) as convert_error:
+            raise ValueError(
+                f"RocksDbPlugin {field_name} must be an integer."
+            ) from convert_error
+
+    @staticmethod
+    def _safe_length(value: Any) -> Optional[int]:
+        try:
+            return len(value)
+        except TypeError:
+            return None
diff --git a/application/single_app/static/js/plugin_modal_stepper.js b/application/single_app/static/js/plugin_modal_stepper.js
index 4e90e890c..6fd0a7b99 100644
--- a/application/single_app/static/js/plugin_modal_stepper.js
+++ b/application/single_app/static/js/plugin_modal_stepper.js
@@ -53,6 +53,15 @@ const MCP_RESERVED_CUSTOM_HEADER_NAMES = new Set([
 ]);
 const AZURE_MAPS_PLUGIN_TYPE = 'azure_maps_openlayers';
 const AZURE_MAPS_DEFAULT_ENDPOINT = 'https://atlas.microsoft.com';
+const ROCKSDB_PLUGIN_TYPE = 'rocksdb';
+const ROCKSDB_AUTH_SCHEME_NONE = 'none';
+const ROCKSDB_AUTH_SCHEME_BEARER = 'bearer';
+const ROCKSDB_AUTH_SCHEME_API_KEY = 'api_key';
+const ROCKSDB_DEFAULT_API_KEY_HEADER = 'X-API-Key';
+const ROCKSDB_DEFAULT_COLUMN_FAMILY = 'default';
+const ROCKSDB_DEFAULT_MAX_RESULTS = 100;
+const ROCKSDB_DEFAULT_MAX_VALUE_BYTES = 32768;
+const ROCKSDB_DEFAULT_TIMEOUT = 30;
 const CHART_DEFAULT_ENDPOINT = 'chart://internal';
 const INTERNAL_DOCUMENT_SEARCH_ENDPOINT = 'internal://document-search';
 const MSGRAPH_DEFAULT_ENDPOINT = 'https://graph.microsoft.com';
@@ -726,6 +735,11 @@ export class PluginModalStepper {
     document.getElementById('sql-identity-select').addEventListener('change', () => this.handleActionIdentityChange('sql'));
     document.getElementById('cosmos-auth-type').addEventListener('change', () => this.handleCosmosAuthTypeChange());
 
+    const rocksDbAuthSchemeSelect = document.getElementById('rocksdb-auth-scheme');
+    if (rocksDbAuthSchemeSelect) {
+      rocksDbAuthSchemeSelect.addEventListener('change', () => this.handleRocksDbAuthSchemeChange());
+    }
+
     // Test SQL connection button
     const testConnBtn = document.getElementById('sql-test-connection-btn');
     if (testConnBtn) {
@@ -737,6 +751,11 @@ export class PluginModalStepper {
       testCosmosBtn.addEventListener('click', () => this.testCosmosConnection());
     }
 
+    const testRocksDbBtn = document.getElementById('rocksdb-test-connection-btn');
+    if (testRocksDbBtn) {
+      testRocksDbBtn.addEventListener('click', () => this.testRocksDbConnection());
+    }
+
     const testYamcsBtn = document.getElementById('yamcs-test-connection-btn');
     if (testYamcsBtn) {
       testYamcsBtn.addEventListener('click', () => this.testYamcsConnection());
@@ -1268,6 +1287,10 @@ export class PluginModalStepper {
     return !!(type && type.toLowerCase() === 'cosmos_query');
   }
 
+  isRocksDbType(type = this.selectedType) {
+    return !!(type && type.toLowerCase() === ROCKSDB_PLUGIN_TYPE);
+  }
+
   isDocumentSearchType(type = this.selectedType) {
     return !!(type && ['search', 'document_search'].includes(type.toLowerCase()));
   }
@@ -3414,7 +3437,7 @@ export class PluginModalStepper {
   }
 
   isStructuredConfigType(type = this.selectedType) {
-    return this.isSqlType(type) || this.isCosmosType(type) || this.isDocumentSearchType(type) || this.isBlobStorageType(type) || this.isDatabricksType(type) || this.isSnowflakeType(type) || this.isTableauType(type) || this.isYamcsType(type) || this.isMcpType(type) || this.isSimpleChatType(type) || this.isMsGraphType(type) || this.isAzureMapsType(type) || this.isChartType(type);
+    return this.isSqlType(type) || this.isCosmosType(type) || this.isRocksDbType(type) || this.isDocumentSearchType(type) || this.isBlobStorageType(type) || this.isDatabricksType(type) || this.isSnowflakeType(type) || this.isTableauType(type) || this.isYamcsType(type) || this.isMcpType(type) || this.isSimpleChatType(type) || this.isMsGraphType(type) || this.isAzureMapsType(type) || this.isChartType(type);
   }
 
   showConfigSectionForType() {
@@ -3423,6 +3446,7 @@ export class PluginModalStepper {
       generic: document.getElementById('generic-config-section'),
       sql: document.getElementById('sql-config-section'),
       cosmos: document.getElementById('cosmos-config-section'),
+      rocksdb: document.getElementById('rocksdb-config-section'),
       documentSearch: document.getElementById('document-search-config-section'),
       blobStorage: document.getElementById('blob-storage-config-section'),
       databricks: document.getElementById('databricks-config-section'),
@@ -3453,6 +3477,9 @@ export class PluginModalStepper {
     } else if (this.isCosmosType()) {
       showOnly('cosmos');
       this.initializeCosmosConfiguration();
+    } else if (this.isRocksDbType()) {
+      showOnly('rocksdb');
+      this.initializeRocksDbConfiguration();
     } else if (this.isDocumentSearchType()) {
       showOnly('documentSearch');
       this.initializeDocumentSearchConfiguration();
@@ -3530,6 +3557,8 @@ export class PluginModalStepper {
           titleEl.textContent = 'Database Configuration';
         } else if (isCosmosType) {
           titleEl.textContent = 'Cosmos Configuration';
+        } else if (this.isRocksDbType()) {
+          titleEl.textContent = 'RocksDB Configuration';
         } else if (isDocumentSearchType) {
           titleEl.textContent = 'Document Search Configuration';
         } else if (isBlobStorageType) {
@@ -3727,6 +3756,7 @@ export class PluginModalStepper {
         const openApiSection = document.getElementById('openapi-config-section');
         const sqlSection = document.getElementById('sql-config-section');
         const cosmosSection = document.getElementById('cosmos-config-section');
+        const rocksDbSection = document.getElementById('rocksdb-config-section');
         const documentSearchSection = document.getElementById('document-search-config-section');
         const blobStorageSection = document.getElementById('blob-storage-config-section');
         const databricksSection = document.getElementById('databricks-config-section');
@@ -3741,6 +3771,7 @@ export class PluginModalStepper {
         const isOpenApiVisible = !openApiSection.classList.contains('d-none');
         const isSqlVisible = !sqlSection.classList.contains('d-none');
         const isCosmosVisible = !cosmosSection.classList.contains('d-none');
+        const isRocksDbVisible = !!rocksDbSection && !rocksDbSection.classList.contains('d-none');
         const isDocumentSearchVisible = !documentSearchSection.classList.contains('d-none');
         const isBlobStorageVisible = !blobStorageSection.classList.contains('d-none');
         const isDatabricksVisible = !databricksSection.classList.contains('d-none');
@@ -3901,6 +3932,12 @@ export class PluginModalStepper {
             this.showError('Timeout must be between 1 and 120 seconds.');
             return false;
           }
+        } else if (isRocksDbVisible) {
+          const rocksDbError = this.getRocksDbValidationError();
+          if (rocksDbError) {
+            this.showError(rocksDbError);
+            return false;
+          }
         } else if (isBlobStorageVisible) {
           const connectionString = document.getElementById('blob-storage-connection-string').value.trim();
           const containerName = document.getElementById('blob-storage-container-name').value.trim();
@@ -4686,6 +4723,282 @@ export class PluginModalStepper {
     }
   }
 
+  initializeRocksDbConfiguration() {
+    const defaultValues = [
+      ['rocksdb-auth-scheme', ROCKSDB_AUTH_SCHEME_NONE],
+      ['rocksdb-read-only', 'true'],
+      ['rocksdb-key-encoding', 'utf8'],
+      ['rocksdb-value-encoding', 'utf8'],
+      ['rocksdb-column-family', ROCKSDB_DEFAULT_COLUMN_FAMILY],
+      ['rocksdb-api-key-header', ROCKSDB_DEFAULT_API_KEY_HEADER],
+      ['rocksdb-max-results', String(ROCKSDB_DEFAULT_MAX_RESULTS)],
+      ['rocksdb-max-value-bytes', String(ROCKSDB_DEFAULT_MAX_VALUE_BYTES)],
+      ['rocksdb-timeout', String(ROCKSDB_DEFAULT_TIMEOUT)]
+    ];
+
+    defaultValues.forEach(([fieldId, defaultValue]) => {
+      const field = document.getElementById(fieldId);
+      if (field && !field.value) {
+        field.value = defaultValue;
+      }
+    });
+
+    const resultDiv = document.getElementById('rocksdb-test-connection-result');
+    if (resultDiv) {
+      resultDiv.classList.add('d-none');
+    }
+
+    this.handleRocksDbAuthSchemeChange();
+  }
+
+  setRocksDbFieldValue(fieldId, value) {
+    const field = document.getElementById(fieldId);
+    if (field) {
+      field.value = value === null || value === undefined ? '' : value;
+    }
+  }
+
+  handleRocksDbAuthSchemeChange() {
+    const authScheme = document.getElementById('rocksdb-auth-scheme')?.value || ROCKSDB_AUTH_SCHEME_NONE;
+    const requiresToken = authScheme === ROCKSDB_AUTH_SCHEME_BEARER || authScheme === ROCKSDB_AUTH_SCHEME_API_KEY;
+
+    document.getElementById('rocksdb-auth-key-group')?.classList.toggle('d-none', !requiresToken);
+    document.getElementById('rocksdb-api-key-header-group')?.classList.toggle(
+      'd-none',
+      authScheme !== ROCKSDB_AUTH_SCHEME_API_KEY
+    );
+
+    const keyInput = document.getElementById('rocksdb-auth-key');
+    if (keyInput) {
+      keyInput.required = requiresToken;
+    }
+  }
+
+  getRocksDbKeyPrefixHints() {
+    const rawValue = document.getElementById('rocksdb-key-prefix-hints')?.value || '';
+    return rawValue
+      .split(/[,\n]/)
+      .map(value => value.trim())
+      .filter(Boolean);
+  }
+
+  getRocksDbEndpointValue() {
+    return (document.getElementById('rocksdb-base-url')?.value || '').trim().replace(/\/+$/, '');
+  }
+
+  getRocksDbAuthLabel() {
+    const authScheme = document.getElementById('rocksdb-auth-scheme')?.value || ROCKSDB_AUTH_SCHEME_NONE;
+    if (authScheme === ROCKSDB_AUTH_SCHEME_BEARER) {
+      return 'Bearer Token';
+    }
+    if (authScheme === ROCKSDB_AUTH_SCHEME_API_KEY) {
+      return 'API Key Header';
+    }
+    return 'No Authentication';
+  }
+
+  getRocksDbValidationError() {
+    const baseUrl = (document.getElementById('rocksdb-base-url')?.value || '').trim();
+    if (!baseUrl) {
+      return 'RocksDB service base URL is required.';
+    }
+    if (!/^https?:\/\/.+/i.test(baseUrl)) {
+      return 'RocksDB service base URL must start with http:// or https://.';
+    }
+
+    const authScheme = document.getElementById('rocksdb-auth-scheme')?.value || ROCKSDB_AUTH_SCHEME_NONE;
+    if (authScheme !== ROCKSDB_AUTH_SCHEME_NONE && !(document.getElementById('rocksdb-auth-key')?.value || '').trim()) {
+      return 'A service token is required when the RocksDB authentication scheme is Bearer Token or API Key Header.';
+    }
+
+    const maxResults = parseInt(document.getElementById('rocksdb-max-results')?.value, 10);
+    if (Number.isNaN(maxResults) || maxResults < 1 || maxResults > 1000) {
+      return 'Max results must be between 1 and 1000.';
+    }
+
+    const maxValueBytes = parseInt(document.getElementById('rocksdb-max-value-bytes')?.value, 10);
+    if (Number.isNaN(maxValueBytes) || maxValueBytes < 1 || maxValueBytes > 1048576) {
+      return 'Max value bytes must be between 1 and 1048576.';
+    }
+
+    const timeout = parseInt(document.getElementById('rocksdb-timeout')?.value, 10);
+    if (Number.isNaN(timeout) || timeout < 1 || timeout > 300) {
+      return 'Timeout must be between 1 and 300 seconds.';
+    }
+
+    return null;
+  }
+
+  getRocksDbConfiguration() {
+    const endpoint = this.getRocksDbEndpointValue();
+    const authScheme = document.getElementById('rocksdb-auth-scheme')?.value || ROCKSDB_AUTH_SCHEME_NONE;
+
+    const additionalFields = {
+      base_url: endpoint,
+      auth_scheme: authScheme,
+      column_family: (document.getElementById('rocksdb-column-family')?.value || '').trim() || ROCKSDB_DEFAULT_COLUMN_FAMILY,
+      key_encoding: document.getElementById('rocksdb-key-encoding')?.value || 'utf8',
+      value_encoding: document.getElementById('rocksdb-value-encoding')?.value || 'utf8',
+      key_prefix_hints: this.getRocksDbKeyPrefixHints(),
+      read_only: (document.getElementById('rocksdb-read-only')?.value || 'true') === 'true',
+      max_results: parseInt(document.getElementById('rocksdb-max-results')?.value, 10) || ROCKSDB_DEFAULT_MAX_RESULTS,
+      max_value_bytes: parseInt(document.getElementById('rocksdb-max-value-bytes')?.value, 10) || ROCKSDB_DEFAULT_MAX_VALUE_BYTES,
+      timeout: parseInt(document.getElementById('rocksdb-timeout')?.value, 10) || ROCKSDB_DEFAULT_TIMEOUT
+    };
+
+    if (authScheme === ROCKSDB_AUTH_SCHEME_API_KEY) {
+      additionalFields.api_key_header = (document.getElementById('rocksdb-api-key-header')?.value || '').trim()
+        || ROCKSDB_DEFAULT_API_KEY_HEADER;
+    }
+
+    const auth = {};
+    if (authScheme === ROCKSDB_AUTH_SCHEME_NONE) {
+      auth.type = 'NoAuth';
+    } else {
+      auth.type = 'key';
+      auth.key = (document.getElementById('rocksdb-auth-key')?.value || '').trim();
+    }
+
+    return { endpoint, auth, additionalFields };
+  }
+
+  populateRocksDbForm(plugin) {
+    const additionalFields = plugin.additionalFields || plugin.additional_fields || {};
+    const auth = plugin.auth || {};
+    const prefixHints = Array.isArray(additionalFields.key_prefix_hints)
+      ? additionalFields.key_prefix_hints.join('\n')
+      : (additionalFields.key_prefix_hints || '');
+
+    this.setRocksDbFieldValue('rocksdb-base-url', additionalFields.base_url || plugin.endpoint || '');
+    this.setRocksDbFieldValue('rocksdb-auth-scheme', additionalFields.auth_scheme || ROCKSDB_AUTH_SCHEME_NONE);
+    this.setRocksDbFieldValue('rocksdb-auth-key', auth.key || '');
+    this.setRocksDbFieldValue('rocksdb-api-key-header', additionalFields.api_key_header || ROCKSDB_DEFAULT_API_KEY_HEADER);
+    this.setRocksDbFieldValue('rocksdb-column-family', additionalFields.column_family || ROCKSDB_DEFAULT_COLUMN_FAMILY);
+    this.setRocksDbFieldValue('rocksdb-read-only', additionalFields.read_only === false ? 'false' : 'true');
+    this.setRocksDbFieldValue('rocksdb-key-encoding', additionalFields.key_encoding || 'utf8');
+    this.setRocksDbFieldValue('rocksdb-value-encoding', additionalFields.value_encoding || 'utf8');
+    this.setRocksDbFieldValue('rocksdb-key-prefix-hints', prefixHints);
+    this.setRocksDbFieldValue('rocksdb-max-results', additionalFields.max_results || ROCKSDB_DEFAULT_MAX_RESULTS);
+    this.setRocksDbFieldValue('rocksdb-max-value-bytes', additionalFields.max_value_bytes || ROCKSDB_DEFAULT_MAX_VALUE_BYTES);
+    this.setRocksDbFieldValue('rocksdb-timeout', additionalFields.timeout || ROCKSDB_DEFAULT_TIMEOUT);
+
+    this.handleRocksDbAuthSchemeChange();
+  }
+
+  setRocksDbSummaryText(elementId, value) {
+    const element = document.getElementById(elementId);
+    if (element) {
+      element.textContent = value;
+    }
+  }
+
+  populateRocksDbSummary() {
+    const rocksDbSection = document.getElementById('summary-rocksdb-section');
+    if (!rocksDbSection) {
+      return;
+    }
+
+    if (!this.isRocksDbType()) {
+      rocksDbSection.classList.add('d-none');
+      return;
+    }
+
+    const readOnly = (document.getElementById('rocksdb-read-only')?.value || 'true') === 'true';
+    const prefixHints = this.getRocksDbKeyPrefixHints();
+    const timeoutValue = (document.getElementById('rocksdb-timeout')?.value || '').trim();
+    const keyEncoding = document.getElementById('rocksdb-key-encoding')?.value || 'utf8';
+    const valueEncoding = document.getElementById('rocksdb-value-encoding')?.value || 'utf8';
+
+    this.setRocksDbSummaryText('summary-rocksdb-target', this.getRocksDbEndpointValue() || '-');
+    this.setRocksDbSummaryText('summary-rocksdb-auth-scheme', this.getRocksDbAuthLabel());
+    this.setRocksDbSummaryText('summary-rocksdb-access', readOnly ? 'Read-only' : 'Reads and writes');
+    this.setRocksDbSummaryText(
+      'summary-rocksdb-column-family',
+      (document.getElementById('rocksdb-column-family')?.value || '').trim() || ROCKSDB_DEFAULT_COLUMN_FAMILY
+    );
+    this.setRocksDbSummaryText('summary-rocksdb-encoding', `Keys: ${keyEncoding}, Values: ${valueEncoding}`);
+    this.setRocksDbSummaryText(
+      'summary-rocksdb-max-results',
+      (document.getElementById('rocksdb-max-results')?.value || '').trim() || '-'
+    );
+    this.setRocksDbSummaryText(
+      'summary-rocksdb-max-value-bytes',
+      (document.getElementById('rocksdb-max-value-bytes')?.value || '').trim() || '-'
+    );
+    this.setRocksDbSummaryText('summary-rocksdb-timeout', timeoutValue ? `${timeoutValue} seconds` : '-');
+    this.setRocksDbSummaryText(
+      'summary-rocksdb-key-prefix-hints',
+      prefixHints.length ? prefixHints.join(', ') : 'None configured'
+    );
+
+    rocksDbSection.classList.remove('d-none');
+  }
+
+  async testRocksDbConnection() {
+    const btn = document.getElementById('rocksdb-test-connection-btn');
+    const resultDiv = document.getElementById('rocksdb-test-connection-result');
+    const alertDiv = document.getElementById('rocksdb-test-connection-alert');
+    if (!btn || !resultDiv || !alertDiv) return;
+
+    const validationError = this.getRocksDbValidationError();
+    if (validationError) {
+      resultDiv.classList.remove('d-none');
+      alertDiv.className = 'alert alert-warning mb-0 py-2 px-3 small';
+      alertDiv.textContent = validationError;
+      return;
+    }
+
+    const authScheme = document.getElementById('rocksdb-auth-scheme')?.value || ROCKSDB_AUTH_SCHEME_NONE;
+    const payload = {
+      base_url: this.getRocksDbEndpointValue(),
+      auth_scheme: authScheme,
+      timeout: Math.min(parseInt(document.getElementById('rocksdb-timeout')?.value, 10) || 10, 30)
+    };
+
+    if (authScheme === ROCKSDB_AUTH_SCHEME_API_KEY) {
+      payload.api_key_header = (document.getElementById('rocksdb-api-key-header')?.value || '').trim()
+        || ROCKSDB_DEFAULT_API_KEY_HEADER;
+    }
+    if (authScheme !== ROCKSDB_AUTH_SCHEME_NONE) {
+      payload.auth_key = (document.getElementById('rocksdb-auth-key')?.value || '').trim();
+    }
+
+    const existingPluginContext = this.getTestPluginContext();
+    if (existingPluginContext) {
+      payload.existing_plugin = existingPluginContext;
+    }
+
+    const originalText = btn.innerHTML;
+    btn.innerHTML = '<span class="spinner-border spinner-border-sm me-2" role="status" aria-hidden="true"></span>Testing...';
+    btn.disabled = true;
+    resultDiv.classList.add('d-none');
+
+    try {
+      const response = await fetch('/api/plugins/test-rocksdb-connection', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(payload)
+      });
+      const data = await response.json();
+
+      resultDiv.classList.remove('d-none');
+      if (data.success) {
+        alertDiv.className = 'alert alert-success mb-0 py-2 px-3 small';
+        alertDiv.innerHTML = '<i class="bi bi-check-circle me-2"></i>' + this.escapeHtml(data.message || 'Connection successful!');
+      } else {
+        alertDiv.className = 'alert alert-danger mb-0 py-2 px-3 small';
+        alertDiv.innerHTML = '<i class="bi bi-x-circle me-2"></i>' + this.escapeHtml(data.error || 'Connection failed.');
+      }
+    } catch (error) {
+      resultDiv.classList.remove('d-none');
+      alertDiv.className = 'alert alert-danger mb-0 py-2 px-3 small';
+      alertDiv.innerHTML = '<i class="bi bi-x-circle me-2"></i>Test failed: ' + this.escapeHtml(error.message || 'Network error');
+    } finally {
+      btn.innerHTML = originalText;
+      btn.disabled = false;
+    }
+  }
+
   async testYamcsConnection() {
     const btn = document.getElementById('yamcs-test-connection-btn');
     const resultDiv = document.getElementById('yamcs-test-connection-result');
@@ -5341,6 +5654,8 @@ export class PluginModalStepper {
       document.getElementById('cosmos-auth-type').value = auth.type || 'identity';
       document.getElementById('cosmos-auth-key').value = auth.key || '';
       this.initializeCosmosConfiguration();
+    } else if (this.isRocksDbType(plugin.type)) {
+      this.populateRocksDbForm(plugin);
     } else if (this.isDocumentSearchType(plugin.type)) {
       this.populateDocumentSearchForm(plugin.additionalFields || {});
       this.initializeDocumentSearchConfiguration();
@@ -5416,6 +5731,7 @@ export class PluginModalStepper {
     const openApiSection = document.getElementById('openapi-config-section');
     const sqlSection = document.getElementById('sql-config-section');
     const cosmosSection = document.getElementById('cosmos-config-section');
+    const rocksDbSection = document.getElementById('rocksdb-config-section');
     const documentSearchSection = document.getElementById('document-search-config-section');
     const blobStorageSection = document.getElementById('blob-storage-config-section');
     const databricksSection = document.getElementById('databricks-config-section');
@@ -5427,6 +5743,7 @@ export class PluginModalStepper {
     const isOpenApiVisible = !openApiSection.classList.contains('d-none');
     const isSqlVisible = !sqlSection.classList.contains('d-none');
     const isCosmosVisible = !cosmosSection.classList.contains('d-none');
+    const isRocksDbVisible = !!rocksDbSection && !rocksDbSection.classList.contains('d-none');
     const isDocumentSearchVisible = !documentSearchSection.classList.contains('d-none');
     const isBlobStorageVisible = !blobStorageSection.classList.contains('d-none');
     const isDatabricksVisible = !databricksSection.classList.contains('d-none');
@@ -5658,6 +5975,16 @@ export class PluginModalStepper {
       additionalFields.field_hints = this.getCosmosFieldHints();
       additionalFields.max_items = parseInt(document.getElementById('cosmos-max-items').value, 10) || 100;
       additionalFields.timeout = parseInt(document.getElementById('cosmos-timeout').value, 10) || 30;
+    } else if (isRocksDbVisible) {
+      const rocksDbError = this.getRocksDbValidationError();
+      if (rocksDbError) {
+        throw new Error(rocksDbError);
+      }
+
+      const rocksDbConfig = this.getRocksDbConfiguration();
+      endpoint = rocksDbConfig.endpoint;
+      auth = rocksDbConfig.auth;
+      additionalFields = rocksDbConfig.additionalFields;
     } else if (isDocumentSearchVisible) {
       endpoint = INTERNAL_DOCUMENT_SEARCH_ENDPOINT;
       auth.type = 'NoAuth';
@@ -5833,6 +6160,7 @@ export class PluginModalStepper {
 
     const endpointRow = document.getElementById('summary-plugin-endpoint-row');
     const databaseTypeRow = document.getElementById('summary-plugin-database-type-row');
+    const isRocksDbType = this.isRocksDbType();
 
     if (isSqlType) {
       // Hide endpoint for SQL plugins since they don't use endpoints
@@ -5845,6 +6173,12 @@ export class PluginModalStepper {
       endpointRow.style.display = '';
       document.getElementById('summary-plugin-database-type').textContent = 'Cosmos DB for NoSQL';
       databaseTypeRow.style.display = '';
+    } else if (isRocksDbType) {
+      const endpoint = this.getEndpointValue();
+      document.getElementById('summary-plugin-endpoint').textContent = endpoint || '-';
+      endpointRow.style.display = '';
+      document.getElementById('summary-plugin-database-type').textContent = 'RocksDB HTTP service';
+      databaseTypeRow.style.display = '';
     } else if (isDocumentSearchType) {
       endpointRow.style.display = 'none';
       document.getElementById('summary-plugin-database-type').textContent = 'Internal document search';
@@ -5915,10 +6249,10 @@ export class PluginModalStepper {
     }
 
     const databaseType = this.getSqlDatabaseType();
-    if (!isSqlType && !isCosmosType && !isDocumentSearchType && !isBlobStorageType && !isDatabricksType && !isSnowflakeType && !isTableauType && !isYamcsType && !isMcpType && !isSimpleChatType && !isMsGraphType && !isAzureMapsType && !isChartType && databaseType) {
+    if (!isSqlType && !isCosmosType && !isRocksDbType && !isDocumentSearchType && !isBlobStorageType && !isDatabricksType && !isSnowflakeType && !isTableauType && !isYamcsType && !isMcpType && !isSimpleChatType && !isMsGraphType && !isAzureMapsType && !isChartType && databaseType) {
       document.getElementById('summary-plugin-database-type').textContent = databaseType;
       databaseTypeRow.style.display = '';
-    } else if (!isSqlType && !isCosmosType && !isDocumentSearchType && !isBlobStorageType && !isDatabricksType && !isSnowflakeType && !isTableauType && !isYamcsType && !isMcpType && !isSimpleChatType && !isMsGraphType && !isAzureMapsType && !isChartType) {
+    } else if (!isSqlType && !isCosmosType && !isRocksDbType && !isDocumentSearchType && !isBlobStorageType && !isDatabricksType && !isSnowflakeType && !isTableauType && !isYamcsType && !isMcpType && !isSimpleChatType && !isMsGraphType && !isAzureMapsType && !isChartType) {
       databaseTypeRow.style.display = 'none';
     }
 
@@ -5926,6 +6260,7 @@ export class PluginModalStepper {
     this.populateOpenApiSummary();
     this.populateSqlSummary();
     this.populateCosmosSummary();
+    this.populateRocksDbSummary();
     this.populateDocumentSearchSummary();
     this.populateBlobStorageSummary();
     this.populateDatabricksSummary();
@@ -5962,6 +6297,8 @@ export class PluginModalStepper {
       return document.getElementById('sql-connection-string').value.trim();
     } else if (isCosmosType) {
       return document.getElementById('cosmos-endpoint').value.trim();
+    } else if (this.isRocksDbType()) {
+      return this.getRocksDbEndpointValue();
     } else if (isDocumentSearchType) {
       return INTERNAL_DOCUMENT_SEARCH_ENDPOINT;
     } else if (isBlobStorageType) {
@@ -6014,6 +6351,8 @@ export class PluginModalStepper {
     } else if (isCosmosType) {
       const authType = document.getElementById('cosmos-auth-type')?.value || 'identity';
       return authType === 'key' ? 'Account Key' : 'Managed Identity';
+    } else if (this.isRocksDbType()) {
+      return this.getRocksDbAuthLabel();
     } else if (isDocumentSearchType) {
       return 'Internal user context';
     } else if (isBlobStorageType) {
@@ -6615,6 +6954,8 @@ export class PluginModalStepper {
         currentEndpoint = document.getElementById('sql-connection-string')?.value || '';
       } else if (isCosmosType) {
         currentEndpoint = document.getElementById('cosmos-endpoint')?.value || '';
+      } else if (this.isRocksDbType()) {
+        currentEndpoint = this.getRocksDbEndpointValue();
       } else if (isDocumentSearchType) {
         currentEndpoint = INTERNAL_DOCUMENT_SEARCH_ENDPOINT;
       } else if (isDatabricksType) {
@@ -6659,6 +7000,12 @@ export class PluginModalStepper {
         if (currentAuthType === 'key') {
           currentAuthKey = document.getElementById('cosmos-auth-key')?.value || '';
         }
+      } else if (this.isRocksDbType()) {
+        const rocksDbAuthScheme = document.getElementById('rocksdb-auth-scheme')?.value || ROCKSDB_AUTH_SCHEME_NONE;
+        currentAuthType = rocksDbAuthScheme !== ROCKSDB_AUTH_SCHEME_NONE ? 'key' : 'NoAuth';
+        if (currentAuthType === 'key') {
+          currentAuthKey = document.getElementById('rocksdb-auth-key')?.value || '';
+        }
       } else if (isDocumentSearchType) {
         currentAuthType = 'NoAuth';
       } else if (isTableauType) {
@@ -6717,6 +7064,8 @@ export class PluginModalStepper {
           max_items: parseInt(document.getElementById('cosmos-max-items')?.value, 10) || 100,
           timeout: parseInt(document.getElementById('cosmos-timeout')?.value, 10) || 30
         }, null, 2);
+      } else if (this.isRocksDbType()) {
+        currentAdditionalFields = JSON.stringify(this.getRocksDbConfiguration().additionalFields, null, 2);
       } else if (isDocumentSearchType) {
         currentAdditionalFields = JSON.stringify(this.getDocumentSearchAdditionalFields(), null, 2);
       } else if (isTableauType) {
diff --git a/application/single_app/static/js/workspace/view-utils.js b/application/single_app/static/js/workspace/view-utils.js
index 2dee40f19..aa62d9224 100644
--- a/application/single_app/static/js/workspace/view-utils.js
+++ b/application/single_app/static/js/workspace/view-utils.js
@@ -53,6 +53,7 @@ export function getTypeIcon(type) {
     const t = type.toLowerCase();
     if (t.includes("sql")) return "bi-database";
     if (t.includes("cosmos")) return "bi-database-fill-gear";
+    if (t.includes("rocksdb")) return "bi-hdd-stack";
     if (t.includes("chart")) return "bi-bar-chart-line";
     if (t.includes("simplechat")) return "bi-chat-square-dots";
     if (t === "mcp" || t.includes("model_context_protocol")) return "bi-diagram-3";
diff --git a/application/single_app/static/json/schemas/rocksdb.definition.json b/application/single_app/static/json/schemas/rocksdb.definition.json
new file mode 100644
index 000000000..83dfd04da
--- /dev/null
+++ b/application/single_app/static/json/schemas/rocksdb.definition.json
@@ -0,0 +1,7 @@
+{
+  "$schema": "./plugin.definition.schema.json",
+  "allowedAuthTypes": [
+    "NoAuth",
+    "key"
+  ]
+}
diff --git a/application/single_app/templates/_plugin_modal.html b/application/single_app/templates/_plugin_modal.html
index bf57cee0f..74988d498 100644
--- a/application/single_app/templates/_plugin_modal.html
+++ b/application/single_app/templates/_plugin_modal.html
@@ -1352,6 +1352,121 @@ <h6><i class="bi bi-info-circle me-2"></i>API Information</h6>
               </div>
             </div>
           </div>
+
+          <!-- RocksDB Configuration -->
+          <div id="rocksdb-config-section" class="d-none">
+            <div class="config-section-label">
+              <i class="bi bi-hdd-stack me-2"></i>RocksDB Configuration
+            </div>
+
+            <div class="rocksdb-config-card">
+              <div class="config-section-label">
+                <i class="bi bi-cloud me-2"></i>RocksDB Service
+              </div>
+
+              <div class="mb-3">
+                <label for="rocksdb-base-url" class="form-label">Service Base URL <span class="text-danger">*</span></label>
+                <input type="text" class="form-control" id="rocksdb-base-url" placeholder="https://rocksdb.example.com/api" />
+                <div class="form-text">API root of a service that implements the SimpleChat RocksDB HTTP contract. Only http and https URLs are accepted.</div>
+              </div>
+
+              <div class="mb-3">
+                <label for="rocksdb-auth-scheme" class="form-label">Authentication Scheme <span class="text-danger">*</span></label>
+                <select class="form-select" id="rocksdb-auth-scheme">
+                  <option value="none">No Authentication</option>
+                  <option value="bearer">Bearer Token</option>
+                  <option value="api_key">API Key Header</option>
+                </select>
+              </div>
+
+              <div class="mb-3 d-none" id="rocksdb-auth-key-group">
+                <label for="rocksdb-auth-key" class="form-label">Service Token <span class="text-danger">*</span></label>
+                <input type="password" class="form-control" id="rocksdb-auth-key" placeholder="Service token or API key" autocomplete="new-password" />
+                <div class="form-text">If this action already uses a Key Vault-backed token, leave the stored value unchanged to preserve the existing secret.</div>
+              </div>
+
+                <div class="mb-0 d-none" id="rocksdb-api-key-header-group">
+                  <label for="rocksdb-api-key-header" class="form-label">API Key Header Name</label>
+                  <input type="text" class="form-control" id="rocksdb-api-key-header" placeholder="X-API-Key" />
+                  <div class="form-text">Header used to send the API key. Defaults to <code>X-API-Key</code>.</div>
+                </div>
+              </div>
+
+            <div class="rocksdb-config-card">
+              <div class="config-section-label">
+                <i class="bi bi-gear me-2"></i>Data Handling
+              </div>
+
+              <div class="row g-3">
+                <div class="col-md-6">
+                  <label for="rocksdb-column-family" class="form-label">Column Family</label>
+                  <input type="text" class="form-control" id="rocksdb-column-family" placeholder="default" />
+                  <div class="form-text">Column family used when a call does not specify one.</div>
+                </div>
+                <div class="col-md-6">
+                  <label for="rocksdb-read-only" class="form-label">Read-Only <span class="text-danger">*</span></label>
+                  <select class="form-select" id="rocksdb-read-only">
+                    <option value="true">Yes (Recommended)</option>
+                    <option value="false">No (Allow writes)</option>
+                  </select>
+                  <div class="form-text">Allowing writes lets the model put, delete, and batch-write records.</div>
+                </div>
+              </div>
+
+              <div class="row g-3 mt-0">
+                <div class="col-md-6">
+                  <label for="rocksdb-key-encoding" class="form-label">Key Encoding</label>
+                  <select class="form-select" id="rocksdb-key-encoding">
+                    <option value="utf8">UTF-8 text</option>
+                    <option value="base64">Base64 (binary keys)</option>
+                  </select>
+                </div>
+                <div class="col-md-6">
+                  <label for="rocksdb-value-encoding" class="form-label">Value Encoding</label>
+                  <select class="form-select" id="rocksdb-value-encoding">
+                    <option value="utf8">UTF-8 text</option>
+                    <option value="json">JSON</option>
+                    <option value="base64">Base64 (binary values)</option>
+                  </select>
+                </div>
+              </div>
+
+              <div class="mt-3">
+                <label for="rocksdb-key-prefix-hints" class="form-label">Key Prefix Hints</label>
+                <textarea class="form-control" id="rocksdb-key-prefix-hints" rows="3" placeholder="user:&#10;event:&#10;session:"></textarea>
+                <div class="form-text">Optional. Add one key prefix per line so the model knows how the keyspace is organized.</div>
+              </div>
+
+              <div class="row g-3 mt-0">
+                <div class="col-md-4">
+                  <label for="rocksdb-max-results" class="form-label">Max Results</label>
+                  <input type="number" class="form-control" id="rocksdb-max-results" value="100" min="1" max="1000" />
+                  <div class="form-text">Hard cap for records returned per call.</div>
+                </div>
+                <div class="col-md-4">
+                  <label for="rocksdb-max-value-bytes" class="form-label">Max Value Bytes</label>
+                  <input type="number" class="form-control" id="rocksdb-max-value-bytes" value="32768" min="1" max="1048576" />
+                  <div class="form-text">Larger values are truncated and flagged.</div>
+                </div>
+                <div class="col-md-4">
+                  <label for="rocksdb-timeout" class="form-label">Timeout (seconds)</label>
+                  <input type="number" class="form-control" id="rocksdb-timeout" value="30" min="1" max="300" />
+                  <div class="form-text">Absolute timeout for RocksDB service requests.</div>
+                </div>
+              </div>
+            </div>
+
+            <div class="mt-4 pt-3 border-top" id="rocksdb-test-connection-section">
+              <div class="d-flex align-items-center gap-3">
+                <button type="button" class="btn btn-outline-primary" id="rocksdb-test-connection-btn">
+                  <i class="bi bi-plug me-2"></i>Test RocksDB Connection
+                </button>
+              </div>
+              <div id="rocksdb-test-connection-result" class="mt-2 d-none">
+                <div class="alert mb-0 py-2 px-3 small" id="rocksdb-test-connection-alert" role="alert"></div>
+              </div>
+            </div>
+          </div>
         </div>
 
         <!-- Step 4: Advanced -->
@@ -1701,6 +1816,72 @@ <h6 class="mb-0 fw-bold">
             </div>
           </div>
 
+          <div class="card mb-3 border-0 shadow-sm d-none" id="summary-rocksdb-section">
+            <div class="card-header text-white p-3" style="background: linear-gradient(135deg, #6f42c1 0%, #43277a 100%);">
+              <h6 class="mb-0 fw-bold">
+                <i class="bi bi-hdd-stack me-2"></i>RocksDB Configuration
+              </h6>
+            </div>
+            <div class="card-body p-3">
+              <div class="row g-3">
+                <div class="col-md-6">
+                  <div class="d-flex flex-column">
+                    <label class="text-muted small mb-1">Service Base URL</label>
+                    <span class="fw-medium font-monospace" id="summary-rocksdb-target">-</span>
+                  </div>
+                </div>
+                <div class="col-md-6">
+                  <div class="d-flex flex-column">
+                    <label class="text-muted small mb-1">Authentication</label>
+                    <span class="fw-medium" id="summary-rocksdb-auth-scheme">-</span>
+                  </div>
+                </div>
+                <div class="col-md-6">
+                  <div class="d-flex flex-column">
+                    <label class="text-muted small mb-1">Access</label>
+                    <span class="fw-medium" id="summary-rocksdb-access">-</span>
+                  </div>
+                </div>
+                <div class="col-md-6">
+                  <div class="d-flex flex-column">
+                    <label class="text-muted small mb-1">Column Family</label>
+                    <span class="fw-medium" id="summary-rocksdb-column-family">-</span>
+                  </div>
+                </div>
+                <div class="col-md-6">
+                  <div class="d-flex flex-column">
+                    <label class="text-muted small mb-1">Encoding</label>
+                    <span class="fw-medium" id="summary-rocksdb-encoding">-</span>
+                  </div>
+                </div>
+                <div class="col-md-6">
+                  <div class="d-flex flex-column">
+                    <label class="text-muted small mb-1">Max Results</label>
+                    <span class="fw-medium" id="summary-rocksdb-max-results">-</span>
+                  </div>
+                </div>
+                <div class="col-md-6">
+                  <div class="d-flex flex-column">
+                    <label class="text-muted small mb-1">Max Value Bytes</label>
+                    <span class="fw-medium" id="summary-rocksdb-max-value-bytes">-</span>
+                  </div>
+                </div>
+                <div class="col-md-6">
+                  <div class="d-flex flex-column">
+                    <label class="text-muted small mb-1">Timeout</label>
+                    <span class="fw-medium" id="summary-rocksdb-timeout">-</span>
+                  </div>
+                </div>
+                <div class="col-12">
+                  <div class="d-flex flex-column">
+                    <label class="text-muted small mb-1">Key Prefix Hints</label>
+                    <span class="fw-medium" id="summary-rocksdb-key-prefix-hints">-</span>
+                  </div>
+                </div>
+              </div>
+            </div>
+          </div>
+
           <div class="card mb-3 border-0 shadow-sm" id="summary-blob-storage-section" style="display: none;">
             <div class="card-header text-white p-3" style="background: linear-gradient(135deg, #0dcaf0 0%, #087990 100%);">
               <h6 class="mb-0 fw-bold">
@@ -2311,6 +2492,13 @@ <h6 class="mb-0 fw-bold">
   background-color: #f8f9fa;
 }
 
+#rocksdb-config-section {
+  border: 1px solid #ded4f2;
+  border-radius: 8px;
+  padding: 1rem;
+  background-color: #f8f9fa;
+}
+
 /* Advanced toggle chevron animation */
 #plugin-advanced-toggle-icon {
   transition: transform 0.3s ease;
@@ -2337,6 +2525,14 @@ <h6 class="mb-0 fw-bold">
   border: 1px solid #e9ecef;
 }
 
+.rocksdb-config-card {
+  background-color: white;
+  border-radius: 6px;
+  padding: 1rem;
+  margin-top: 1rem;
+  border: 1px solid #e9ecef;
+}
+
 .simplechat-config-card {
   background-color: white;
   border-radius: 6px;
@@ -2471,10 +2667,16 @@ <h6 class="mb-0 fw-bold">
   background-color: #343a40;
 }
 
+[data-bs-theme="dark"] #rocksdb-config-section {
+  border-color: #495057;
+  background-color: #343a40;
+}
+
 [data-bs-theme="dark"] .sql-connection-config,
 [data-bs-theme="dark"] .sql-auth-config,
 [data-bs-theme="dark"] .simplechat-config-card,
 [data-bs-theme="dark"] .cosmos-config-card,
+[data-bs-theme="dark"] .rocksdb-config-card,
 [data-bs-theme="dark"] .auth-section {
   background-color: #2d3237;
   border-color: #495057;
diff --git a/docs/explanation/features/index.md b/docs/explanation/features/index.md
index 19c772223..d3b6d903f 100644
--- a/docs/explanation/features/index.md
+++ b/docs/explanation/features/index.md
@@ -24,6 +24,7 @@ category: Version History
 - [Action Type Governance](v0.242.064/ACTION_TYPE_GOVERNANCE.md)
 - [Agents Page Customization](v0.241.229/AGENTS_PAGE_CUSTOMIZATION.md)
 - [Microsoft Graph Send Mail Action](MSGRAPH_SEND_MAIL_ACTION.md)
+- [RocksDB Action](v0.250.216/ROCKSDB_ACTION.md)
 - [Snowflake Action](v0.250.006/SNOWFLAKE_ACTION.md)
 - [Tableau Action](TABLEAU_ACTION.md)
 - [Yamcs Action](YAMCS_ACTION.md)
diff --git a/docs/explanation/features/v0.250.216/ROCKSDB_ACTION.md b/docs/explanation/features/v0.250.216/ROCKSDB_ACTION.md
new file mode 100644
index 000000000..748ca7e5a
--- /dev/null
+++ b/docs/explanation/features/v0.250.216/ROCKSDB_ACTION.md
@@ -0,0 +1,216 @@
+# RocksDB Action
+
+Implemented in version: **0.250.216**
+
+Version reference: `application/single_app/config.py` was updated to `VERSION = "0.250.216"` for this feature.
+
+Dependencies: `requests`, Semantic Kernel action loading, workspace actions, and Key Vault action secret handling. No RocksDB library is installed in the application.
+
+## Overview
+
+The RocksDB action lets an agent read (and optionally write) an ordered
+[RocksDB](https://github.com/facebook/rocksdb) key-value store from a SimpleChat conversation.
+
+RocksDB is an **embedded** C++ library with no native network protocol. SimpleChat does **not**
+run RocksDB locally and never opens a database directory on the application host. Instead, the
+action calls a RocksDB-backed **HTTP/JSON service** that you operate alongside your data, using
+the contract documented below.
+
+```
+Agent
+  └── RocksDbPlugin (semantic_kernel_plugins/rocksdb_plugin.py)
+        └── requests ──► RocksDB HTTP/JSON service ──► RocksDB database
+```
+
+Reads are always available. Writes are refused unless the action is explicitly configured to
+allow them, matching the read-only default of the SQL action.
+
+- **Action type**: `rocksdb`
+- **Plugin module**: `application/single_app/semantic_kernel_plugins/rocksdb_plugin.py`
+
+## Configuration
+
+### Configuration fields
+
+| Field | `additionalFields` key | Notes |
+|---|---|---|
+| Service Base URL | `base_url` | Required. `http` or `https` only. |
+| Authentication Scheme | `auth_scheme` | `none`, `bearer`, or `api_key` |
+| API Key Header Name | `api_key_header` | Only for `api_key`. Defaults to `X-API-Key`. |
+| Column Family | `column_family` | Defaults to `default` |
+| Read-Only | `read_only` | Defaults to `true` |
+| Key Encoding | `key_encoding` | `utf8` or `base64` |
+| Value Encoding | `value_encoding` | `utf8`, `json`, or `base64` |
+| Key Prefix Hints | `key_prefix_hints` | One prefix per line, surfaced to the model |
+| Max Results | `max_results` | 1–1000, defaults to 100 |
+| Max Value Bytes | `max_value_bytes` | 1–1048576, defaults to 32768 |
+| Timeout (seconds) | `timeout` | 1–300, defaults to 30 |
+
+The service token is stored in `auth.key` with `auth.type` set to `key`, so it participates in the
+existing Key Vault secret storage and masked-edit flows. Actions without authentication use
+`auth.type` of `NoAuth`.
+
+### Encodings
+
+Keys and values in RocksDB are byte strings. The configured `key_encoding` and `value_encoding`
+are sent with every request so the service knows how to interpret the strings on the wire:
+
+- `utf8` — keys and values are UTF-8 text.
+- `base64` — keys and values are base64-encoded bytes, for binary data that cannot travel as text.
+- `json` (values only) — the service returns values already parsed as JSON.
+
+Values larger than **Max Value Bytes** are truncated by the plugin so a single record cannot
+flood the model context. The result reports the original `value_bytes` alongside a
+`value_truncated` flag, so the model can tell a truncated value from a short one.
+
+### Example manifest
+
+```json
+{
+  "name": "rocksdb_events",
+  "displayName": "RocksDB Events",
+  "type": "rocksdb",
+  "description": "Read-only access to the event key-value store",
+  "endpoint": "https://rocksdb.example.com/api",
+  "auth": { "type": "key", "key": "service-token" },
+  "metadata": { "description": "Event store lookups" },
+  "additionalFields": {
+    "base_url": "https://rocksdb.example.com/api",
+    "auth_scheme": "bearer",
+    "column_family": "events",
+    "key_encoding": "utf8",
+    "value_encoding": "json",
+    "key_prefix_hints": ["user:", "event:"],
+    "read_only": true,
+    "max_results": 100,
+    "max_value_bytes": 32768,
+    "timeout": 30
+  }
+}
+```
+
+## Agent functions
+
+Keys are sorted lexicographically, so prefix and range scans are the efficient access pattern.
+
+### Read functions (always available)
+
+| Function | Purpose |
+|---|---|
+| `get_value(key, column_family=None)` | Read one value by exact key |
+| `get_values(keys, column_family=None)` | Read several values; accepts a list or JSON array string |
+| `key_exists(key, column_family=None)` | Cheap existence check that skips the value |
+| `scan_prefix(prefix, limit=None, column_family=None)` | List pairs whose keys start with a prefix |
+| `scan_range(start_key=None, end_key=None, limit=None, reverse=False, column_family=None)` | Walk an inclusive-start, exclusive-end key range, optionally descending |
+| `list_column_families()` | List available column families |
+| `get_database_stats()` | Report key-count and size estimates |
+
+### Write functions (require writes to be enabled)
+
+| Function | Purpose |
+|---|---|
+| `put_value(key, value, column_family=None)` | Write one key-value pair |
+| `delete_value(key, column_family=None)` | Delete one key |
+| `write_batch(operations, column_family=None)` | Apply put and delete operations atomically |
+
+While the action is read-only, these three functions return an explicit refusal that names the
+operation and never issue a request to the service.
+
+`write_batch` accepts a list or a JSON array string:
+
+```json
+[
+  { "op": "put", "key": "user:005", "value": "erin" },
+  { "op": "delete", "key": "user:004" }
+]
+```
+
+## RocksDB HTTP service contract
+
+Implement these endpoints under the configured base URL. Requests are JSON, responses are JSON
+objects. Every request body also carries `key_encoding` and `value_encoding`.
+
+| Function | Method | Path | Request body | Response |
+|---|---|---|---|---|
+| Health probe | `GET` | `/health` | – | any JSON object |
+| `get_value` | `POST` | `/get` | `{key, column_family}` | `{found, value}` |
+| `get_values` | `POST` | `/multi_get` | `{keys, column_family}` | `{results: [{key, found, value}]}` |
+| `key_exists` | `POST` | `/exists` | `{key, column_family}` | `{exists}` |
+| `scan_prefix` / `scan_range` | `POST` | `/scan` | `{prefix?, start_key?, end_key?, limit, reverse, column_family}` | `{items: [{key, value}], truncated?}` |
+| `list_column_families` | `GET` | `/column_families` | – | `{column_families: [...]}` |
+| `get_database_stats` | `GET` | `/stats` | – | `{stats: {...}}` or a flat object |
+| `put_value` | `POST` | `/put` | `{key, value, column_family}` | `{success}` |
+| `delete_value` | `POST` | `/delete` | `{key, column_family}` | `{success}` |
+| `write_batch` | `POST` | `/batch` | `{operations, column_family}` | `{success}` |
+
+Authentication headers:
+
+- `bearer` sends `Authorization: Bearer <token>`
+- `api_key` sends `<api_key_header>: <token>`
+- `none` sends no credential header
+
+The **Test RocksDB Connection** button probes `GET /health` and falls back to `POST /scan` with
+`{"limit": 1}` when `/health` returns 404, so minimal services still validate.
+
+Range semantics the service should honor:
+
+- `start_key` is **inclusive**, `end_key` is **exclusive**.
+- `prefix` and the range bounds are mutually exclusive in practice; the plugin sends only what
+  the caller supplied.
+- `reverse` walks the range from the highest matching key downwards.
+- `limit` is already clamped to the action's **Max Results** before it reaches the service.
+
+## Using the action
+
+1. Open **Workspace → Actions → Create Action** (or the group / admin equivalent).
+2. Choose the **RocksDB** action type and continue to the configuration step.
+3. Enter the **Service Base URL** for your RocksDB HTTP service.
+4. Pick an **Authentication Scheme** and supply the token when using bearer or API key auth.
+   TLS certificate validation is always enforced.
+5. Set the data-handling options: column family, read-only toggle, encodings, key prefix hints,
+   and the result, value-size, and timeout caps.
+6. Click **Test RocksDB Connection** to verify the configuration before saving.
+7. Review the **RocksDB Configuration** summary card and save.
+
+Key prefix hints are surfaced to the model through the action instructions, so listing the
+prefixes that organize the keyspace measurably improves how well the agent targets its scans.
+
+## Security considerations
+
+- SimpleChat never opens a RocksDB database directory, so there is no local filesystem exposure
+  and no path-traversal surface.
+- Service base URLs are restricted to `http` and `https`.
+- The connection-test endpoint requires an authenticated user (`@login_required`,
+  `@user_required`).
+- Service errors report the HTTP status code only; response bodies are never echoed back to the
+  browser or the model.
+- Writes are off by default and are refused both client-side and server-side while `read_only`
+  is true.
+- TLS certificate validation is always enforced and cannot be turned off. For a service using
+  a private certificate authority, install that CA in the application trust store or point
+  `REQUESTS_CA_BUNDLE` at it.
+
+## Testing and validation
+
+| Test | Location |
+|---|---|
+| Manifest validation, write guard, request shaping, auth headers, caps, error handling | `functional_tests/test_rocksdb_plugin.py` |
+| Action modal flow, connection test, validation messages, summary card | `ui_tests/test_workspace_rocksdb_action_modal.py` |
+| Route registration and auth policy | `functional_tests/route_tests/` |
+
+## Known limitations
+
+- The action depends on a RocksDB HTTP service that you operate; SimpleChat does not ship one.
+- The service contract is SimpleChat-defined, so an existing RocksDB proxy will usually need a
+  thin adapter.
+- Results are capped per call, so very large scans must be paged by the agent using narrower
+  prefixes or range bounds.
+
+## Related
+
+- Action type registry: `application/single_app/route_backend_plugins.py`
+- Action type definition: `application/single_app/static/json/schemas/rocksdb.definition.json`
+- Manifest validation: `application/single_app/semantic_kernel_plugins/plugin_health_checker.py`
+- Action modal: `application/single_app/templates/_plugin_modal.html`,
+  `application/single_app/static/js/plugin_modal_stepper.js`
+- Logging tag: `[ROCKSDB_PLUGIN]` (see `docs/reference/logging-tags.md`)
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 4ba293ab5..0f27d5040 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,19 @@
 
 For feature-focused and fix-focused drill-downs by version, see [Features by Version](/explanation/features/) and [Fixes by Version](/explanation/fixes/).
 
+### **(v0.250.216)**
+
+#### New Features
+
+*   **RocksDB Action**
+    *   Added a new `rocksdb` action type so agents can read an ordered [RocksDB](https://github.com/facebook/rocksdb) key-value store, with a dedicated configuration card and Test Connection button in the action modal.
+    *   RocksDB is an embedded library with no network protocol, so the action calls a RocksDB-backed HTTP/JSON service that you operate alongside your data. SimpleChat never runs RocksDB locally or opens a database directory on the application host.
+    *   Supports no-auth, bearer token, and API key header authentication with a configurable header name. TLS certificate validation is always enforced.
+    *   Exposes `get_value`, `get_values`, `key_exists`, `scan_prefix`, `scan_range`, `list_column_families`, and `get_database_stats` for reads, plus `put_value`, `delete_value`, and `write_batch` that stay blocked until an action explicitly allows writes.
+    *   Handles binary data through configurable UTF-8, base64, and JSON key and value encodings that are sent to the service on every request, caps returned records, and flags values truncated by the size limit.
+    *   The RocksDB HTTP service contract is fully documented so operators can implement a conforming service.
+    *   (Ref: `rocksdb_plugin.py`, `route_backend_plugins.py`, `plugin_health_checker.py`, `_plugin_modal.html`, `plugin_modal_stepper.js`, `rocksdb.definition.json`, `test_rocksdb_plugin.py`, `test_workspace_rocksdb_action_modal.py`, `docs/explanation/features/v0.250.216/ROCKSDB_ACTION.md`)
+
 ### **(v0.250.215)**
 
 #### Bug Fixes
diff --git a/docs/reference/logging-tags.md b/docs/reference/logging-tags.md
index e4811f592..e04b495a0 100644
--- a/docs/reference/logging-tags.md
+++ b/docs/reference/logging-tags.md
@@ -178,6 +178,7 @@ Last inventoried: 2026-08-10
 - `[REDIS_TEST]`
 - `[RESULT_REQUIRES_MESSAGE_RELOAD]`
 - `[RETENTION_POLICY]`
+- `[ROCKSDB_PLUGIN]`
 - `[SAFETY_LIFECYCLE]`
 - `[SAFETY_REMEDIATION]`
 - `[SAFETY_VIOLATIONS]`
diff --git a/functional_tests/test_rocksdb_plugin.py b/functional_tests/test_rocksdb_plugin.py
new file mode 100644
index 000000000..c8d554bb3
--- /dev/null
+++ b/functional_tests/test_rocksdb_plugin.py
@@ -0,0 +1,682 @@
+#!/usr/bin/env python3
+# test_rocksdb_plugin.py
+"""
+Functional test for the RocksDB action (plugin).
+Version: 0.250.216
+Implemented in: 0.250.216
+
+This test ensures that the RocksDB plugin validates its manifest, blocks writes while the
+action is read-only, shapes RocksDB HTTP service calls and auth headers correctly, caps
+result counts and oversized values, and is discoverable by the shared plugin loader.
+
+The plugin only talks to a remote RocksDB HTTP service; SimpleChat never opens a RocksDB
+database directory locally.
+"""
+
+import importlib
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'application', 'single_app'))
+
+from test_support.versioning import assert_app_version_at_least
+
+
+class FakeConfigCosmosContainer:
+    """Minimal Cosmos container stand-in for importing config.py without live I/O."""
+
+    def read_item(self, item, partition_key=None):
+        if item == "app_settings":
+            return {"id": "app_settings", "settings": {}}
+        raise KeyError(item)
+
+    def upsert_item(self, item):
+        return item
+
+    def query_items(self, *args, **kwargs):
+        return []
+
+
+class FakeConfigCosmosDatabase:
+    """Minimal Cosmos database stand-in for config.py import-time container setup."""
+
+    def __init__(self):
+        self.containers = {}
+
+    def create_container_if_not_exists(self, id, **kwargs):
+        self.containers.setdefault(id, FakeConfigCosmosContainer())
+        return self.containers[id]
+
+
+class FakeConfigCosmosClient:
+    """Minimal Cosmos client stand-in for config.py import-time client setup."""
+
+    def __init__(self, *args, **kwargs):
+        self.database = FakeConfigCosmosDatabase()
+
+    def create_database_if_not_exists(self, *args, **kwargs):
+        return self.database
+
+
+def import_app_module_without_live_cosmos(module_name):
+    """Import app modules without letting config.py connect to live Cosmos."""
+    if module_name in sys.modules:
+        return sys.modules[module_name]
+
+    import azure.cosmos as azure_cosmos
+
+    original_cosmos_client = azure_cosmos.CosmosClient
+    azure_cosmos.CosmosClient = FakeConfigCosmosClient
+    try:
+        return importlib.import_module(module_name)
+    finally:
+        azure_cosmos.CosmosClient = original_cosmos_client
+
+
+def get_rocksdb_module():
+    return import_app_module_without_live_cosmos("semantic_kernel_plugins.rocksdb_plugin")
+
+
+def get_rocksdb_plugin_class():
+    return get_rocksdb_module().RocksDbPlugin
+
+
+def build_manifest(auth_key="", **additional_overrides):
+    additional_fields = {
+        "base_url": "https://rocksdb.example.com/api",
+        "auth_scheme": "none",
+        "api_key_header": "X-API-Key",
+        "column_family": "default",
+        "key_encoding": "utf8",
+        "value_encoding": "utf8",
+        "key_prefix_hints": ["user:", "event:"],
+        "read_only": True,
+        "max_results": 10,
+        "max_value_bytes": 1024,
+        "timeout": 10,
+    }
+    additional_fields.update(additional_overrides)
+    auth = {"type": "key", "key": auth_key} if auth_key else {"type": "NoAuth"}
+    return {
+        "name": "test_rocksdb",
+        "displayName": "Test RocksDB",
+        "type": "rocksdb",
+        "description": "RocksDB test action",
+        "endpoint": additional_fields["base_url"],
+        "auth": auth,
+        "metadata": {"description": "RocksDB plugin for tests"},
+        "additionalFields": additional_fields,
+    }
+
+
+class FakeResponse:
+    """Minimal requests.Response stand-in for RocksDB service calls."""
+
+    def __init__(self, status_code=200, payload=None, invalid_json=False):
+        self.status_code = status_code
+        self._payload = {} if payload is None else payload
+        self._invalid_json = invalid_json
+
+    def json(self):
+        if self._invalid_json:
+            raise ValueError("Response body is not JSON")
+        return self._payload
+
+
+class FakeSession:
+    """Records outbound RocksDB service calls and returns scripted responses."""
+
+    def __init__(self, response=None):
+        self.calls = []
+        self.response = response or FakeResponse()
+
+    def request(self, method, url, json=None, headers=None, timeout=None, verify=None):
+        self.calls.append({
+            "method": method,
+            "url": url,
+            "payload": json,
+            "headers": headers or {},
+            "timeout": timeout,
+            "verify": verify,
+        })
+        return self.response
+
+
+def make_plugin(response=None, **manifest_overrides):
+    """Build a plugin wired to a fake HTTP session."""
+    RocksDbPlugin = get_rocksdb_plugin_class()
+    auth_key = manifest_overrides.pop("auth_key", "")
+    plugin = RocksDbPlugin(build_manifest(auth_key=auth_key, **manifest_overrides))
+    session = FakeSession(response)
+    plugin.set_http_session(session)
+    return plugin, session
+
+
+def test_manifest_validation_rules():
+    """Test that invalid RocksDB manifests are rejected with actionable errors."""
+    print("🔍 Testing RocksDB manifest validation...")
+
+    try:
+        RocksDbPlugin = get_rocksdb_plugin_class()
+
+        invalid_cases = [
+            (build_manifest(base_url=""), "base_url"),
+            (build_manifest(base_url="ftp://rocks.example.com"), "http"),
+            (build_manifest(base_url="https://"), "host name"),
+            (build_manifest(key_encoding="hex"), "key_encoding"),
+            (build_manifest(value_encoding="yaml"), "value_encoding"),
+            (build_manifest(max_results=0), "max_results"),
+            (build_manifest(max_results=99999), "max_results"),
+            (build_manifest(max_value_bytes=0), "max_value_bytes"),
+            (build_manifest(timeout=0), "timeout"),
+            (build_manifest(timeout=9999), "timeout"),
+            (build_manifest(auth_scheme="mtls"), "auth_scheme"),
+            (build_manifest(auth_scheme="bearer"), "auth.key"),
+            (build_manifest(auth_scheme="api_key"), "auth.key"),
+        ]
+
+        for manifest, expected_fragment in invalid_cases:
+            try:
+                RocksDbPlugin(manifest)
+                raise AssertionError(
+                    f"Manifest should have been rejected for '{expected_fragment}': {manifest['additionalFields']}"
+                )
+            except ValueError as validation_error:
+                assert expected_fragment in str(validation_error), (
+                    f"Expected '{expected_fragment}' in error, got: {validation_error}"
+                )
+
+        # A valid manifest constructs cleanly and normalizes the base URL.
+        plugin = RocksDbPlugin(
+            build_manifest(auth_key="token", auth_scheme="bearer", base_url="https://rocksdb.example.com/api/")
+        )
+        assert plugin.base_url == "https://rocksdb.example.com/api", "Trailing slashes must be stripped"
+        assert plugin.read_only is True
+        assert plugin.key_prefix_hints == ["user:", "event:"]
+
+        # The plugin must not expose any embedded/local database configuration.
+        for removed_attribute in ("db_path", "access_mode", "secondary_path", "connection_mode"):
+            assert not hasattr(plugin, removed_attribute), (
+                f"Embedded attribute '{removed_attribute}' must not exist on the remote-only plugin"
+            )
+
+        print("✅ RocksDB manifest validation rejects invalid configurations.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_module_has_no_local_database_support():
+    """Test that the plugin module carries no embedded RocksDB code paths."""
+    print("🔍 Testing that the RocksDB plugin has no local database support...")
+
+    try:
+        rocksdb_module = get_rocksdb_module()
+
+        for removed_symbol in (
+            "import_rocksdict",
+            "resolve_allowed_rocksdb_path",
+            "get_allowed_rocksdb_roots",
+            "CONNECTION_MODE_EMBEDDED",
+            "CONNECTION_MODE_REMOTE",
+            "SUPPORTED_ACCESS_MODES",
+            "ACCESS_MODE_SECONDARY",
+        ):
+            assert not hasattr(rocksdb_module, removed_symbol), (
+                f"Embedded symbol '{removed_symbol}' must not exist in the remote-only module"
+            )
+
+        with open(rocksdb_module.__file__, encoding="utf-8") as module_file:
+            module_source = module_file.read()
+        assert "rocksdict" not in module_source, "The module must not reference the rocksdict binding"
+        assert "ROCKSDB_ALLOWED_ROOTS" not in module_source, (
+            "The module must not reference the removed path allowlist"
+        )
+
+        # The dependency must be gone from the application requirements too.
+        requirements_path = os.path.join(
+            os.path.dirname(os.path.abspath(__file__)), "..", "application", "single_app", "requirements.txt"
+        )
+        with open(requirements_path, encoding="utf-8") as requirements_file:
+            requirements = requirements_file.read()
+        assert "rocksdict" not in requirements, "rocksdict must not be pinned in requirements.txt"
+
+        print("✅ RocksDB plugin contains no embedded database code or dependency.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_read_only_blocks_writes():
+    """Test that write operations are refused while the action is read-only."""
+    print("🔍 Testing RocksDB read-only write guard...")
+
+    try:
+        plugin, session = make_plugin(read_only=True)
+
+        blocked_results = [
+            plugin.put_value("user:001", "alice"),
+            plugin.delete_value("user:001"),
+            plugin.write_batch([{"op": "put", "key": "user:001", "value": "alice"}]),
+        ]
+
+        for blocked_result in blocked_results:
+            assert blocked_result.data.get("read_only") is True, "Write guard must report read_only"
+            assert "read-only" in blocked_result.data.get("error", ""), "Write guard must explain the refusal"
+
+        assert session.calls == [], "Read-only writes must never reach the RocksDB service"
+
+        print("✅ RocksDB read-only actions refuse put, delete, and batch operations.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_read_request_shaping():
+    """Test RocksDB service request paths and payloads for read operations."""
+    print("🔍 Testing RocksDB read request shaping...")
+
+    try:
+        plugin, session = make_plugin(FakeResponse(payload={"found": True, "value": "alice"}))
+
+        result = plugin.get_value("user:001")
+        assert result.data["found"] is True
+        assert result.data["value"] == "alice"
+
+        call = session.calls[-1]
+        assert call["method"] == "POST"
+        assert call["url"] == "https://rocksdb.example.com/api/get"
+        assert call["payload"]["key"] == "user:001"
+        assert call["payload"]["column_family"] == "default"
+        assert call["payload"]["key_encoding"] == "utf8", "The service needs the key wire encoding"
+        assert call["payload"]["value_encoding"] == "utf8", "The service needs the value wire encoding"
+        assert call["timeout"] == 10
+        assert call["verify"] is None, (
+            "The plugin must not pass a verify override that could disable TLS validation"
+        )
+
+        # A column family override is forwarded per call.
+        plugin.get_value("user:001", column_family="events")
+        assert session.calls[-1]["payload"]["column_family"] == "events"
+
+        # Multi-get posts the key list.
+        multi_plugin, multi_session = make_plugin(
+            FakeResponse(payload={"results": [
+                {"key": "user:001", "found": True, "value": "alice"},
+                {"key": "user:404", "found": False, "value": None},
+            ]})
+        )
+        multi_result = multi_plugin.get_values(["user:001", "user:404"])
+        assert multi_result.data["requested_key_count"] == 2
+        assert multi_result.data["found_count"] == 1
+        assert multi_session.calls[-1]["url"] == "https://rocksdb.example.com/api/multi_get"
+        assert multi_session.calls[-1]["payload"]["keys"] == ["user:001", "user:404"]
+
+        # Keys may arrive as a JSON array string from the model.
+        multi_plugin.get_values('["user:001", "user:002"]')
+        assert multi_session.calls[-1]["payload"]["keys"] == ["user:001", "user:002"]
+
+        # Existence checks use the dedicated endpoint.
+        exists_plugin, exists_session = make_plugin(FakeResponse(payload={"exists": True}))
+        assert exists_plugin.key_exists("user:001").data["exists"] is True
+        assert exists_session.calls[-1]["url"] == "https://rocksdb.example.com/api/exists"
+
+        # Range scans forward the range arguments.
+        scan_plugin, scan_session = make_plugin(
+            FakeResponse(payload={"items": [{"key": "user:001", "value": "alice"}]})
+        )
+        range_result = scan_plugin.scan_range(start_key="user:001", end_key="user:009", reverse=True)
+        assert range_result.data["reverse"] is True
+        scan_payload = scan_session.calls[-1]["payload"]
+        assert scan_payload["start_key"] == "user:001"
+        assert scan_payload["end_key"] == "user:009"
+        assert scan_payload["reverse"] is True
+        assert "prefix" not in scan_payload, "Range scans must not send an empty prefix"
+
+        # Prefix scans send the prefix and omit range bounds.
+        scan_plugin.scan_prefix("user:")
+        prefix_payload = scan_session.calls[-1]["payload"]
+        assert prefix_payload["prefix"] == "user:"
+        assert "start_key" not in prefix_payload and "end_key" not in prefix_payload
+
+        # Column families and stats use GET endpoints.
+        cf_plugin, cf_session = make_plugin(FakeResponse(payload={"column_families": ["default", "events"]}))
+        assert cf_plugin.list_column_families().data["column_families"] == ["default", "events"]
+        assert cf_session.calls[-1]["method"] == "GET"
+        assert cf_session.calls[-1]["url"] == "https://rocksdb.example.com/api/column_families"
+
+        stats_plugin, stats_session = make_plugin(FakeResponse(payload={"stats": {"keys": 42}}))
+        assert stats_plugin.get_database_stats().data["stats"] == {"keys": 42}
+        assert stats_session.calls[-1]["url"] == "https://rocksdb.example.com/api/stats"
+
+        print("✅ RocksDB read calls use the expected paths and payloads.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_auth_header_shaping():
+    """Test that each auth scheme sends the correct credential header."""
+    print("🔍 Testing RocksDB auth header shaping...")
+
+    try:
+        # No authentication sends no credential header.
+        anon_plugin, anon_session = make_plugin(FakeResponse(payload={"found": False}))
+        anon_plugin.get_value("user:001")
+        anon_headers = anon_session.calls[-1]["headers"]
+        assert "Authorization" not in anon_headers
+        assert "X-API-Key" not in anon_headers
+
+        # Bearer authentication.
+        bearer_plugin, bearer_session = make_plugin(
+            FakeResponse(payload={"found": False}), auth_key="secret-token", auth_scheme="bearer"
+        )
+        bearer_plugin.get_value("user:001")
+        assert bearer_session.calls[-1]["headers"]["Authorization"] == "Bearer secret-token"
+
+        # API key header authentication honours a custom header name.
+        api_key_plugin, api_key_session = make_plugin(
+            FakeResponse(payload={"found": False}),
+            auth_key="header-token",
+            auth_scheme="api_key",
+            api_key_header="X-Rocks-Key",
+        )
+        api_key_plugin.get_value("user:001")
+        api_key_headers = api_key_session.calls[-1]["headers"]
+        assert api_key_headers["X-Rocks-Key"] == "header-token"
+        assert "Authorization" not in api_key_headers
+
+        # Certificate validation is always on; the plugin never disables it.
+        strict_plugin, strict_session = make_plugin(FakeResponse(payload={"found": False}))
+        strict_plugin.get_value("user:001")
+        assert strict_session.calls[-1]["verify"] is None, (
+            "The plugin must not pass a verify override that could disable TLS validation"
+        )
+
+        print("✅ RocksDB auth schemes send the expected headers.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_result_caps_and_truncation():
+    """Test that result counts and oversized values are capped."""
+    print("🔍 Testing RocksDB result caps and value truncation...")
+
+    try:
+        # max_results caps scan output even when the service returns more.
+        scan_plugin, scan_session = make_plugin(
+            FakeResponse(payload={"items": [{"key": f"user:{i:03d}", "value": "v"} for i in range(25)]})
+        )
+        scan_result = scan_plugin.scan_prefix("user:")
+        assert scan_result.data["item_count"] == 10, "max_results must cap scan output"
+        assert scan_result.data["is_truncated"] is True
+        assert scan_session.calls[-1]["payload"]["limit"] == 10
+
+        # A per-call limit cannot exceed the configured cap.
+        scan_plugin.scan_prefix("user:", limit=500)
+        assert scan_session.calls[-1]["payload"]["limit"] == 10
+        scan_plugin.scan_prefix("user:", limit=3)
+        assert scan_session.calls[-1]["payload"]["limit"] == 3
+
+        # max_results also caps the requested key list.
+        multi_plugin, multi_session = make_plugin(FakeResponse(payload={"results": []}))
+        multi_plugin.get_values([f"user:{i:03d}" for i in range(50)])
+        assert len(multi_session.calls[-1]["payload"]["keys"]) == 10
+
+        # Oversized values are truncated and flagged with the original byte length.
+        oversized_value = "x" * 100
+        truncating_plugin, _ = make_plugin(
+            FakeResponse(payload={"found": True, "value": oversized_value}), max_value_bytes=10
+        )
+        truncated = truncating_plugin.get_value("user:001")
+        assert truncated.data["value"] == "x" * 10
+        assert truncated.data["value_truncated"] is True
+        assert truncated.data["value_bytes"] == 100
+
+        # Values within the cap pass through untouched, including structured JSON.
+        json_plugin, _ = make_plugin(FakeResponse(payload={"found": True, "value": {"kind": "login"}}))
+        json_result = json_plugin.get_value("event:001")
+        assert json_result.data["value"] == {"kind": "login"}
+        assert json_result.data["value_truncated"] is False
+
+        # Batch size is bounded by max_results.
+        batch_plugin, _ = make_plugin(FakeResponse(payload={"success": True}), read_only=False)
+        oversized_batch = [{"op": "put", "key": f"k{i}", "value": "v"} for i in range(50)]
+        batch_result = batch_plugin.write_batch(oversized_batch)
+        assert "limited to 10" in batch_result.data["error"]
+
+        print("✅ RocksDB caps result counts, key lists, batches, and oversized values.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_write_operations_when_enabled():
+    """Test that writes reach the service once the action allows them."""
+    print("🔍 Testing RocksDB write operations...")
+
+    try:
+        plugin, session = make_plugin(FakeResponse(payload={"success": True}), read_only=False)
+
+        put_result = plugin.put_value("user:009", "ivan")
+        assert put_result.data["written"] is True
+        assert session.calls[-1]["url"] == "https://rocksdb.example.com/api/put"
+        assert session.calls[-1]["payload"]["value"] == "ivan"
+
+        delete_result = plugin.delete_value("user:009")
+        assert delete_result.data["deleted"] is True
+        assert session.calls[-1]["url"] == "https://rocksdb.example.com/api/delete"
+
+        batch_result = plugin.write_batch(
+            '[{"op": "put", "key": "user:005", "value": "erin"}, {"op": "delete", "key": "user:004"}]'
+        )
+        assert batch_result.data["applied"] is True
+        assert batch_result.data["operation_count"] == 2
+        assert session.calls[-1]["url"] == "https://rocksdb.example.com/api/batch"
+        assert session.calls[-1]["payload"]["operations"][0]["op"] == "put"
+        assert session.calls[-1]["payload"]["operations"][1]["op"] == "delete"
+
+        # Malformed batch operations are rejected before any request is sent.
+        call_count = len(session.calls)
+        bad_batch = plugin.write_batch('[{"op": "drop", "key": "user:001"}]')
+        assert "put" in bad_batch.data["error"] and "delete" in bad_batch.data["error"]
+        assert len(session.calls) == call_count, "Invalid batches must not reach the service"
+
+        missing_key_batch = plugin.write_batch([{"op": "put", "value": "v"}])
+        assert "key" in missing_key_batch.data["error"]
+
+        print("✅ RocksDB write operations reach the service when writes are enabled.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_service_error_handling():
+    """Test that service failures surface as structured errors without leaking bodies."""
+    print("🔍 Testing RocksDB service error handling...")
+
+    try:
+        # HTTP failures report the status code only.
+        error_plugin, _ = make_plugin(FakeResponse(status_code=503, payload={"secret": "leak"}))
+        error_result = error_plugin.get_value("user:001")
+        assert "503" in error_result.data["error"]
+        assert "leak" not in error_result.data["error"], "Response bodies must never be echoed"
+
+        # Non-JSON responses are reported clearly.
+        invalid_plugin, _ = make_plugin(FakeResponse(invalid_json=True))
+        assert "non-JSON" in invalid_plugin.get_value("user:001").data["error"]
+
+        # Unexpected payload shapes are rejected rather than silently mishandled.
+        shape_plugin, _ = make_plugin(FakeResponse(payload={"items": "not-a-list"}))
+        assert "unexpected scan payload" in shape_plugin.scan_prefix("user:").data["error"]
+
+        multi_shape_plugin, _ = make_plugin(FakeResponse(payload={"results": "nope"}))
+        assert "unexpected multi_get payload" in multi_shape_plugin.get_values(["a"]).data["error"]
+
+        cf_shape_plugin, _ = make_plugin(FakeResponse(payload={"column_families": "nope"}))
+        assert "unexpected column_families payload" in cf_shape_plugin.list_column_families().data["error"]
+
+        # Transport exceptions are captured instead of propagating to the kernel.
+        class ExplodingSession:
+            def request(self, *args, **kwargs):
+                raise ConnectionError("connection refused")
+
+        RocksDbPlugin = get_rocksdb_plugin_class()
+        exploding_plugin = RocksDbPlugin(build_manifest())
+        exploding_plugin.set_http_session(ExplodingSession())
+        assert "connection refused" in exploding_plugin.get_value("user:001").data["error"]
+
+        print("✅ RocksDB service failures produce structured, non-leaking errors.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_health_checker_validation():
+    """Test that the shared plugin health checker validates RocksDB manifests."""
+    print("🔍 Testing RocksDB manifest validation in the plugin health checker...")
+
+    try:
+        health_module = import_app_module_without_live_cosmos(
+            "semantic_kernel_plugins.plugin_health_checker"
+        )
+        PluginHealthChecker = health_module.PluginHealthChecker
+
+        valid_manifest = build_manifest(auth_key="token", auth_scheme="bearer")
+        is_valid, errors = PluginHealthChecker.validate_plugin_manifest(valid_manifest, "rocksdb")
+        assert is_valid, f"Valid RocksDB manifest was rejected: {errors}"
+
+        invalid_cases = [
+            (build_manifest(base_url=""), "base_url"),
+            (build_manifest(base_url="ftp://rocks.example.com"), "base_url"),
+            (build_manifest(auth_scheme="bearer"), "auth.key"),
+            (build_manifest(auth_scheme="mtls"), "auth_scheme"),
+            (build_manifest(max_results=99999), "max_results"),
+            (build_manifest(timeout="soon"), "timeout"),
+            (build_manifest(value_encoding="yaml"), "value_encoding"),
+            (build_manifest(key_encoding="hex"), "key_encoding"),
+        ]
+
+        for manifest, expected_fragment in invalid_cases:
+            is_valid, errors = PluginHealthChecker.validate_plugin_manifest(manifest, "rocksdb")
+            assert not is_valid, f"Manifest should be invalid for '{expected_fragment}'"
+            assert any(expected_fragment in error for error in errors), (
+                f"Expected '{expected_fragment}' in {errors}"
+            )
+
+        print("✅ Plugin health checker validates RocksDB manifests.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_plugin_discovery_and_metadata():
+    """Test that the RocksDB plugin is discoverable and exposes its expected surface."""
+    print("🔍 Testing RocksDB plugin discovery and metadata...")
+
+    try:
+        assert_app_version_at_least("0.250.216")
+
+        loader_module = import_app_module_without_live_cosmos(
+            "semantic_kernel_plugins.plugin_loader"
+        )
+        discovered_plugins = loader_module.discover_plugins()
+        assert "RocksDbPlugin" in discovered_plugins, (
+            f"RocksDbPlugin must be discoverable, found: {sorted(discovered_plugins)}"
+        )
+
+        RocksDbPlugin = get_rocksdb_plugin_class()
+        plugin = RocksDbPlugin(build_manifest())
+
+        assert plugin.display_name == "RocksDB"
+        assert plugin.metadata["type"] == "rocksdb"
+        assert "read-only" in plugin.metadata["description"]
+        assert "HTTP service" in plugin.metadata["description"]
+
+        expected_functions = {
+            "get_value",
+            "get_values",
+            "key_exists",
+            "scan_prefix",
+            "scan_range",
+            "list_column_families",
+            "get_database_stats",
+            "put_value",
+            "delete_value",
+            "write_batch",
+        }
+        assert set(plugin.get_functions()) == expected_functions
+        documented_methods = {method["name"] for method in plugin.metadata["methods"]}
+        assert documented_methods == expected_functions, (
+            "Every exposed function must be documented in plugin metadata"
+        )
+
+        writable_plugin = RocksDbPlugin(build_manifest(read_only=False))
+        assert "Write operations are enabled" in writable_plugin.metadata["description"]
+
+        # Instruction context surfaces the service target and prefix hints.
+        instruction_context = plugin.build_instruction_context()
+        assert "https://rocksdb.example.com/api" in instruction_context
+        assert "user:" in instruction_context
+        assert "read-only" in instruction_context
+
+        print("✅ RocksDB plugin is discoverable and exposes complete metadata.")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+if __name__ == "__main__":
+    tests = [
+        test_manifest_validation_rules,
+        test_module_has_no_local_database_support,
+        test_read_only_blocks_writes,
+        test_read_request_shaping,
+        test_auth_header_shaping,
+        test_result_caps_and_truncation,
+        test_write_operations_when_enabled,
+        test_service_error_handling,
+        test_health_checker_validation,
+        test_plugin_discovery_and_metadata,
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        results.append(test())
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if success else 1)
diff --git a/ui_tests/test_workspace_rocksdb_action_modal.py b/ui_tests/test_workspace_rocksdb_action_modal.py
new file mode 100644
index 000000000..ae141dfa1
--- /dev/null
+++ b/ui_tests/test_workspace_rocksdb_action_modal.py
@@ -0,0 +1,237 @@
+# test_workspace_rocksdb_action_modal.py
+"""
+UI test for the workspace RocksDB action modal.
+Version: 0.250.216
+Implemented in: 0.250.216
+
+This test ensures users can select the RocksDB action type, complete the RocksDB HTTP
+service configuration, switch authentication schemes, run the browser-side connection
+test, see inline validation errors, and review the RocksDB summary card before saving.
+"""
+
+import json
+import os
+from pathlib import Path
+
+import pytest
+from playwright.sync_api import expect
+
+
+BASE_URL = os.getenv("SIMPLECHAT_UI_BASE_URL", "").rstrip("/")
+STORAGE_STATE = os.getenv("SIMPLECHAT_UI_STORAGE_STATE", "")
+SKIP_RESPONSE_CODES = {401, 403, 404}
+
+
+def _require_ui_env():
+    if not BASE_URL:
+        pytest.skip("Set SIMPLECHAT_UI_BASE_URL to run this UI test.")
+    if not STORAGE_STATE or not Path(STORAGE_STATE).exists():
+        pytest.skip("Set SIMPLECHAT_UI_STORAGE_STATE to a valid authenticated Playwright storage state file.")
+
+
+def _open_rocksdb_config_step(page):
+    """Navigate the action modal to the RocksDB configuration step."""
+    response = page.goto(f"{BASE_URL}/workspace", wait_until="networkidle")
+    assert response is not None, "Expected a navigation response when loading /workspace."
+
+    if response.status in SKIP_RESPONSE_CODES:
+        pytest.skip(f"Workspace page unavailable in this environment (HTTP {response.status}).")
+
+    assert response.ok, f"Expected /workspace to load successfully, got HTTP {response.status}."
+    expect(page.locator("#documents-tab")).to_be_visible()
+
+    plugins_tab_button = page.locator("#plugins-tab-btn")
+    if plugins_tab_button.count() == 0:
+        pytest.skip("Workspace actions are not enabled in this environment.")
+
+    plugins_tab_button.click()
+
+    create_button = page.locator("#create-plugin-btn")
+    if create_button.count() == 0:
+        pytest.skip("Workspace action creation is not available in this environment.")
+
+    expect(create_button).to_be_visible()
+    create_button.click()
+
+    modal = page.locator("#plugin-modal")
+    expect(modal).to_be_visible()
+
+    rocksdb_card = page.locator('.action-type-card[data-type="rocksdb"]')
+    if rocksdb_card.count() == 0:
+        pytest.skip("The RocksDB action type is not available in this environment.")
+
+    rocksdb_card.click()
+    modal.get_by_role("button", name="Next").click()
+
+    page.locator("#plugin-display-name").fill("RocksDB Reader")
+    modal.get_by_role("button", name="Next").click()
+
+    expect(page.locator("#rocksdb-config-section")).to_be_visible()
+    expect(page.locator("#cosmos-config-section")).to_be_hidden()
+    expect(page.locator("#generic-config-section")).to_be_hidden()
+
+    return modal
+
+
+@pytest.mark.ui
+def test_workspace_rocksdb_action_modal_configuration(playwright):
+    """Validate the RocksDB service flow, connection test, and summary card."""
+    _require_ui_env()
+
+    browser = playwright.chromium.launch()
+    context = browser.new_context(
+        storage_state=STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    page = context.new_page()
+
+    try:
+        captured_payload = {}
+
+        def handle_rocksdb_test(route):
+            request_body = route.request.post_data or "{}"
+            captured_payload.clear()
+            captured_payload.update(json.loads(request_body))
+            route.fulfill(
+                status=200,
+                content_type="application/json",
+                body='{"success": true, "message": "Successfully reached the RocksDB service at https://rocksdb.example.com/api."}'
+            )
+
+        page.route("**/api/plugins/test-rocksdb-connection", handle_rocksdb_test)
+
+        _open_rocksdb_config_step(page)
+
+        page.locator("#rocksdb-base-url").fill("https://rocksdb.example.com/api")
+
+        # Selecting a token-based scheme reveals the token and header fields.
+        expect(page.locator("#rocksdb-auth-key-group")).to_be_hidden()
+        expect(page.locator("#rocksdb-api-key-header-group")).to_be_hidden()
+        page.locator("#rocksdb-auth-scheme").select_option("api_key")
+        expect(page.locator("#rocksdb-auth-key-group")).to_be_visible()
+        expect(page.locator("#rocksdb-api-key-header-group")).to_be_visible()
+
+        page.locator("#rocksdb-auth-key").fill("service-token-value")
+        page.locator("#rocksdb-api-key-header").fill("X-Rocks-Key")
+        page.locator("#rocksdb-column-family").fill("events")
+        page.locator("#rocksdb-key-prefix-hints").fill("user:\nevent:")
+        page.locator("#rocksdb-max-results").fill("50")
+        page.locator("#rocksdb-max-value-bytes").fill("8192")
+        page.locator("#rocksdb-timeout").fill("20")
+
+        page.locator("#rocksdb-test-connection-btn").click()
+        expect(page.locator("#rocksdb-test-connection-result")).to_be_visible()
+        expect(page.locator("#rocksdb-test-connection-alert")).to_contain_text("Successfully reached the RocksDB service")
+
+        assert captured_payload.get("base_url") == "https://rocksdb.example.com/api"
+        assert captured_payload.get("auth_scheme") == "api_key"
+        assert captured_payload.get("api_key_header") == "X-Rocks-Key"
+        assert captured_payload.get("auth_key") == "service-token-value"
+
+        page.locator("#plugin-modal-skip").click()
+
+        expect(page.locator("#summary-rocksdb-section")).to_be_visible()
+        expect(page.locator("#summary-plugin-database-type")).to_have_text("RocksDB HTTP service")
+        expect(page.locator("#summary-plugin-auth")).to_have_text("API Key Header")
+        expect(page.locator("#summary-rocksdb-target")).to_have_text("https://rocksdb.example.com/api")
+        expect(page.locator("#summary-rocksdb-auth-scheme")).to_have_text("API Key Header")
+        expect(page.locator("#summary-rocksdb-access")).to_have_text("Read-only")
+        expect(page.locator("#summary-rocksdb-column-family")).to_have_text("events")
+        expect(page.locator("#summary-rocksdb-max-results")).to_have_text("50")
+        expect(page.locator("#summary-rocksdb-key-prefix-hints")).to_contain_text("event:")
+    finally:
+        context.close()
+        browser.close()
+
+
+@pytest.mark.ui
+def test_workspace_rocksdb_action_modal_write_mode_and_errors(playwright):
+    """Validate write-mode summary text and a failing connection test."""
+    _require_ui_env()
+
+    browser = playwright.chromium.launch()
+    context = browser.new_context(
+        storage_state=STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    page = context.new_page()
+
+    try:
+        def handle_rocksdb_test(route):
+            route.fulfill(
+                status=400,
+                content_type="application/json",
+                body='{"success": false, "error": "The RocksDB service returned HTTP 502."}'
+            )
+
+        page.route("**/api/plugins/test-rocksdb-connection", handle_rocksdb_test)
+
+        _open_rocksdb_config_step(page)
+
+        page.locator("#rocksdb-base-url").fill("https://rocksdb.internal/api")
+        page.locator("#rocksdb-auth-scheme").select_option("bearer")
+        page.locator("#rocksdb-auth-key").fill("bearer-token")
+        page.locator("#rocksdb-read-only").select_option("false")
+
+        page.locator("#rocksdb-test-connection-btn").click()
+        expect(page.locator("#rocksdb-test-connection-result")).to_be_visible()
+        expect(page.locator("#rocksdb-test-connection-alert")).to_contain_text("returned HTTP 502")
+
+        page.locator("#plugin-modal-skip").click()
+
+        expect(page.locator("#summary-rocksdb-section")).to_be_visible()
+        expect(page.locator("#summary-rocksdb-access")).to_have_text("Reads and writes")
+        expect(page.locator("#summary-rocksdb-auth-scheme")).to_have_text("Bearer Token")
+        expect(page.locator("#summary-rocksdb-target")).to_have_text("https://rocksdb.internal/api")
+    finally:
+        context.close()
+        browser.close()
+
+
+@pytest.mark.ui
+def test_workspace_rocksdb_action_modal_validation_messages(playwright):
+    """Validate that incomplete RocksDB configurations surface inline errors."""
+    _require_ui_env()
+
+    browser = playwright.chromium.launch()
+    context = browser.new_context(
+        storage_state=STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    page = context.new_page()
+
+    try:
+        _open_rocksdb_config_step(page)
+
+        # A missing base URL is rejected before any request is sent.
+        page.locator("#rocksdb-test-connection-btn").click()
+        expect(page.locator("#rocksdb-test-connection-result")).to_be_visible()
+        expect(page.locator("#rocksdb-test-connection-alert")).to_contain_text(
+            "RocksDB service base URL is required"
+        )
+
+        # A non-HTTP base URL is rejected.
+        page.locator("#rocksdb-base-url").fill("ftp://rocks.example.com")
+        page.locator("#rocksdb-test-connection-btn").click()
+        expect(page.locator("#rocksdb-test-connection-alert")).to_contain_text(
+            "must start with http:// or https://"
+        )
+
+        # A token-based scheme without a token is rejected.
+        page.locator("#rocksdb-base-url").fill("https://rocksdb.example.com/api")
+        page.locator("#rocksdb-auth-scheme").select_option("bearer")
+        page.locator("#rocksdb-test-connection-btn").click()
+        expect(page.locator("#rocksdb-test-connection-alert")).to_contain_text(
+            "service token is required"
+        )
+
+        # Out-of-range numeric caps are rejected.
+        page.locator("#rocksdb-auth-key").fill("token")
+        page.locator("#rocksdb-max-results").fill("0")
+        page.locator("#rocksdb-test-connection-btn").click()
+        expect(page.locator("#rocksdb-test-connection-alert")).to_contain_text(
+            "Max results must be between 1 and 1000"
+        )
+    finally:
+        context.close()
+        browser.close()