COcoder
MCP

Create MCP server config

Changed on
post/api/v2/organizations/{organization}/mcp-servers

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /api/v2/organizations/{organization}/mcp-servers
  • Auth
    API key in header Coder-Session-Token

Path parameters

organizationstring required

Organization name or ID

Request body

allow_in_plan_modeboolean
api_key_headerstring
api_key_valuestring
auth_type'none' | 'oauth2' | 'api_key' | 'custom_headers' | 'user_oidc' required
availability'force_on' | 'default_on' | 'default_off' required
custom_headersobject
descriptionstring
display_namestring required
enabledboolean
forward_coder_headersboolean

ForwardCoderHeaders, when true, forwards Coder identity headers on every outgoing MCP request. See MCPServerConfig.

icon_urlstring
model_intentboolean
oauth2_auth_urlstring
oauth2_client_idstring
oauth2_client_secretstring
oauth2_resourcestring

OAuth2Resource is the RFC 8707 resource indicator sent on OAuth2 requests when set. Auto-discovery fills it if empty.

oauth2_revocation_urlstring

OAuth2RevocationURL is the provider's RFC 7009 revocation endpoint; auto-populated by OAuth2 discovery when omitted.

oauth2_scopesstring
oauth2_token_urlstring
signing_secretstring

SigningSecret signs forwarded identity headers and request bodies. Configure the same secret on the MCP server. It is never returned.

slugstring required
tool_allow_liststring[]
tool_deny_liststring[]
transport'streamable_http' | 'sse' required
urlstring required

Response

Created

allow_in_plan_modeboolean
api_key_headerstring

API key fields (only populated for admins).

auth_connectedboolean

Per-user state (populated for non-admin requests).

auth_typestring

"none", "oauth2", "api_key", "custom_headers", "user_oidc"

availabilitystring

Availability policy set by admin.

created_atstring date-time
descriptionstring
display_namestring
enabledboolean
forward_coder_headersboolean

ForwardCoderHeaders forwards the same Coder identity headers we send to LLM providers (X-Coder-Owner-Id, X-Coder-Chat-Id, and the optional X-Coder-Subchat-Id and X-Coder-Workspace-Id) to this MCP server on every request. Off by default to avoid leaking chat identity to third-party servers.

has_api_keyboolean
has_custom_headersboolean
has_oauth2_secretboolean
has_signing_secretboolean
icon_urlstring
idstring uuid
model_intentboolean
oauth2_auth_urlstring
oauth2_client_idstring

OAuth2 fields (only populated for admins).

oauth2_resourcestring
oauth2_revocation_urlstring
oauth2_scopesstring
oauth2_token_urlstring
organization_idstring uuid
slugstring
tool_allow_liststring[]

Tool governance.

tool_deny_liststring[]
transportstring

"streamable_http" or "sse"

updated_atstring date-time
urlstring

Changes