MCPBundler Docs
MCPBundler Docs
Back to marketplaceGetting StartedAuthenticationTutorial - Bundle to Connected Agent
API Reference
Agent A2A Tools
Agent Channels
Agent Configuration (Staging)
Agent Configuration (Versions)
Agent Tools
Agents
Auth
Billing
Bundler
Bundler Tool
Bundles
Call Campaigns
Catalog
Conversations
Credentials
Deployments
Discover
Embedding
Fleet
Knowledge Bases
LLM
MCP Listings
Approve Schema RevisionCreate Draft ListingSubmit New VersionDelete Draft ListingDiscard Tool OverrideGet MCP ListingMy ListingsGet Schema Revision DetailList Tool OverridesList Schema RevisionsPreview MCP CapabilitiesUpsert Auth SchemesRefresh MCP CapabilitiesReject Schema RevisionSearch MCP ListingsSet Tool OverrideSubmit for ReviewUpdate Listing
Media
OAuth Clients
OAuth2
Observability
Organisations
Realtime
Reviews
Roadmap
SCIM
STT
Suppression
Triggers
TTS
Users
Utils
Voices
Webhooks
Workflows
API ReferenceMCP Listings

Create Draft Listing

POST
/v1/mcp

Create a new MCP listing.

Authorization and lifecycle rules differ by body.visibility:

  • private: owned by the caller; namespace must be unique among the caller's own private listings. Skips the review queue and is published immediately.
  • org: requires body.org_id and caller membership in that organisation; namespace must be unique within the organisation. Skips the review queue and is published immediately.
  • public (default): namespace must be globally unique; created in DRAFT status and must go through submit_for_review before it becomes visible in the marketplace.

If body.initial_version is supplied, a matching McpVersion row is created and marked as the latest version.

An OAuth-client caller (context.mode == "client") may only use the org branch: the other two would place the listing outside the credential's ORGANISATION scope floor (org_id NULL), and the private branch's namespace-uniqueness check keys on context.user_id, which for a credential is the Keycloak service-account's synthetic sub rather than the owner_id the row is actually inserted with.

Returns: The newly created listing in draft/summary form.

Authorization

OAuth2AuthorizationCodeBearer
AuthorizationBearer <token>

In: header

Query Parameters

verify_locally?Verify Locally
Defaulttrue

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://example.com/v1/mcp" \  -H "Content-Type: application/json" \  -d '{    "title": "string",    "namespace": "string",    "short_description": "string",    "transport": "string"  }'
{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "namespace": "string",  "visibility": "public",  "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b",  "block_private_bundle_mixing": false,  "title": "string",  "short_description": "string",  "status": "string",  "transport": "string",  "pricing": "string",  "icon_bg_color": "string",  "icon_text_color": "string",  "created_at": "2019-08-24T14:15:22Z",  "updated_at": "2019-08-24T14:15:22Z",  "category": {    "id": 0,    "name": "string",    "slug": "string",    "description": "string",    "icon": "string",    "mcp_count": 0  }}
{  "detail": [    {      "loc": [        "string"      ],      "msg": "string",      "type": "string"    }  ]}

Approve Schema Revision

Previous Page

Submit New Version

Next Page

title*Title
Length1 <= length <= 200
namespace*Namespace
Match^[@a-z0-9_-]+/[a-z0-9_-]+$
Length3 <= length <= 128
visibility?Visibility
Match^(public|private|org)$
Default"public"
org_id?|null
short_description*Short Description
Length1 <= length <= 500
category_id?integer|null
transport*Transport
Match^(sse|http|webhook|openapi)$
pricing?Pricing
Match^(free|freemium|paid)$
Default"free"
provider_name?|null
maturity_level?|null
source_url?|null
homepage_url?|null
documentation_url?|null
support_url?|null
license?|null
readme_content?string|null
dpa_available?Dpa Available
Defaultfalse
dpa_url?|null
tags?array<string>
icon_bg_color?|null
icon_text_color?|null
auth_mode?|null
preferred_auth_type?|null
mcp_endpoint_url?|null
mcp_schema_endpoint_url?|null
mcp_webhook_url?|null
mcp_webhook_secret?|

Shared secret used to HMAC-sign requests to mcp_webhook_url.

pooled?Pooled
Defaultfalse
oauth_client_id?|null
oauth_auth_url?|null
oauth_token_url?|null
oauth_default_scope?|null
oauth_client_secret?|

OAuth2 confidential-client secret, required by providers whose client type is not a public/PKCE-only client.

supported_auth_modes?array<>|null
auth_schemes?array<>|null
master_credential?||

Publisher's RUNTIME credential; the str form is a deprecated bearer token.

system_credential?|

Publisher's SYSTEM credential for schema refresh and pinging.

catalog_credential?|

Serialized credential JSON for MCPbundler system ops.

initial_version?|null
initial_version_changelog?string|null
install_command?|null
config_json?|null
openapi_spec_url?|null