Update an MCP-client server registration

PATCH

/admin/ai/mcp-clients/{id}

• Local development behind nginx (port 8088 by default)

Partial update — only the supplied fields mutate. Use this to flip enabled, change the URL after the server moves, rotate auth secrets, etc.

auth_secret_ref is write-only: supply it to rotate the stored secret, omit it (or send an empty string) to keep the current one. Saving an unrelated field cannot wipe it, and the response never echoes it back.

Requires mcp.client.admin.

Authorizations

• cookieAuth
• bearerAuth

Parameters

Path Parameters

id

required

string format: uuid

Request Body ^required

Partial-update payload for PATCH /admin/ai/mcp-clients/{id}. Omitted fields keep their existing value. Health-check fields are owned by the per-server poller and not editable here.

object

url

string

>= 1 characters

transport

string

Allowed values: http stdio

auth_kind

string

Allowed values: none bearer header mtls

auth_secret_ref

Write-only. Provide to set or rotate the stored auth secret; omit (or send an empty string) to keep the current value. Never returned on any read — responses carry auth_secret_set instead (#711).

string format: password

auth_header_name

string

privacy_class

string

Allowed values: local cloud

enabled

boolean

rate_limit_per_second

integer

>= 1

rate_limit_per_minute

integer

>= 1

health_check_interval_s

integer

>= 1

Responses

200

Updated

One registered MCP server. Each registration becomes one ai.Provider in the router; the operator-chosen name is the audit-dashboard identifier and the dispatcher slot key.

object

id

required

string format: uuid

name

required

string

>= 1 characters <= 128 characters

url

required

string

>= 1 characters

transport

required

string

Allowed values: http stdio

auth_kind

required

string

Allowed values: none bearer header mtls

auth_secret_set

required

True when an auth secret is currently stored for this server. The secret itself is NEVER returned — despite the _ref name on the write side it holds the live bearer token / header value, and a stored credential has no read-back workflow, so no capability reads it back (#711). Set it via POST / PATCH auth_secret_ref.

boolean

auth_header_name

string

nullable

privacy_class

required

string

Allowed values: local cloud

enabled

required

boolean

rate_limit_per_second

required

integer

>= 1

rate_limit_per_minute

required

integer

>= 1

health_check_interval_s

required

integer

>= 1

last_health_check_at

string format: date-time

nullable

last_health_status

string

nullable

Allowed values: healthy degraded unreachable

last_health_error

string

nullable

created_at

required

string format: date-time

updated_at

required

string format: date-time

401

Authentication required, missing, or invalid

object

error

required

Human-readable error summary

string

Example

the request could not be completed

Example

{
  "error": "authentication required: sign in and retry with a valid session or API token"
}

403

Authenticated but missing required capabilities

object

error

required

Human-readable error summary

string

Example

the request could not be completed

404

Resource not found

object

error

required

Human-readable error summary

string

Example

the request could not be completed