HTTP API
McpServerDefinition
A registered remote MCP server. Its tools are discovered at connection time and listed alongside the tools registered in code.
Shape: object
| Property | Required | Type | Description | Rules |
|---|---|---|---|---|
id |
yes | string (uuid) |
The server identifier. A time-ordered UUID (v7). | — |
tenantId |
yes | string |
The tenant the server belongs to. | — |
name |
yes | string |
The server name. Discovered tools are named as {name}.{tool}, so tools with the same name on two servers never collide. |
— |
description |
no | string |
The description. | — |
endpoint |
yes | string (uri) |
The server address. Only http and https are accepted. |
— |
transport |
no | McpTransportMode |
The transport format. | — |
headers |
no | object |
Extra request headers, sent as given with every request to the server. An HTTP response never returns a stored value: it carries every header name with the value ***. |
— |
headerConfigurationKeys |
no | object |
Credential request headers, as a map from the header name to the NAME of the configuration key its value is read from. The value is resolved through IConfiguration on every connection and is never stored. |
— |
enabled |
no | boolean |
Whether the server is enabled. Its tools are not discovered while disabled. | — |
oauthEnabled |
no | boolean |
Whether OAuth authentication is on. When on, HeaderConfigurationKeys may not name Authorization — both would try to manage that header. |
— |
oauthClientId |
no | string |
The OAuth client identifier. Not a secret, stored as-is. | — |
oauthClientSecretConfigurationKey |
no | string |
The configuration key the OAuth client secret’s value is read from. The value is never written to the database, under the same rule as HeaderConfigurationKeys. |
— |
oauthScopes |
no | string |
The space-separated OAuth scope list. Example: "repo read:user". |
— |
oauthAuthorizationMode |
no | McpOAuthAuthorizationMode |
The OAuth authorization flow. | — |
requiresApproval |
no | boolean |
Whether this server’s tools require explicit approval before each call. Defaults to true: the tool definition comes from outside and is treated as untrusted. |
— |
createdAt |
no | string (date-time) |
The creation time (UTC). | — |
updatedAt |
no | string (date-time) |
The last-updated time (UTC). | — |