# McpServerRequest

> Tracon documentation. Tracon is a .NET package family that adds a control
> plane on Microsoft Agent Framework, published as NuGet packages that run
> inside your own ASP.NET Core application.
>
> Page: https://tracon.dev/http-api/schemas/mcpserverrequest/
> Summary: OpenAPI request or response schema for McpServerRequest, including required fields, defaults, constraints, and linked nested types.

[← All HTTP schemas](/http-api/schemas/)

Request to create/update an MCP server.

**Shape:** `object`

| Property | Required | Type | Description | Rules |
|---|---|---|---|---|
| `description` | no | `string` | Description. | — |
| `endpoint` | yes | `string` | Server address. Only `http` and `https` are accepted. | — |
| `transport` | no | [`McpTransportMode`](/http-api/schemas/mcptransportmode/) | Transport mode. | — |
| `headers` | no | `object` | Extra request headers, sent as given with every request to the server. The values are stored as plain text, so a header whose name looks like a credential (`Authorization`, `X-Api-Key`, `Cookie`, any name ending in `-key`) is rejected with `400`: declare it in `HeaderConfigurationKeys`. Send every header with its real value on each save: a response masks the values as `***`, and a value of `***` is rejected with `400`. Absent or `null` keeps the stored headers; `{}` removes them. | — |
| `headerConfigurationKeys` | no | `object` | Credential request headers, as a map from the header name to the NAME of the configuration key its value is read from, for example `{"X-Api-Key": "Tracon:McpSecrets:acme:SearchKey"}`. Every name must sit inside the caller's tenant key space. A response returns the map unmasked: it carries no value. Absent or `null` keeps the stored map; `{}` removes it. | — |
| `enabled` | no | `boolean` | Whether the server is enabled. | — |
| `requiresApproval` | no | `boolean` | Whether this server's tools require approval. Default `true`. | — |
| `oauthEnabled` | no | `boolean` | Whether OAuth authentication is enabled. While on, `HeaderConfigurationKeys` may not name `Authorization`. | — |
| `oauthClientId` | no | `string` | OAuth client identifier. | — |
| `oauthClientSecretConfigurationKey` | no | `string` | Configuration key the OAuth client secret's value is read from. The value itself is not sent; only the key's name is. | — |
| `oauthScopes` | no | `string` | Space-separated list of OAuth scopes. | — |
| `oauthAuthorizationMode` | no | [`McpOAuthAuthorizationMode`](/http-api/schemas/mcpoauthauthorizationmode/) | OAuth authorization flow. | — |