---
title: "Create MCP server config"
method: POST
path: "/api/v2/organizations/{organization}/mcp-servers"
tags: ["MCP"]
---

# Create MCP server config

`POST /api/v2/organizations/{organization}/mcp-servers`

## Path parameters

- `organization` string, required

## Request body

- CodersdkCreateMCPServerConfigRequest
  - `allow_in_plan_mode` boolean
  - `api_key_header` string
  - `api_key_value` string
  - `auth_type` 'none' | 'oauth2' | 'api_key' | 'custom_headers' | 'user_oidc', required
  - `availability` 'force_on' | 'default_on' | 'default_off', required
  - `custom_headers` object
  - `description` string
  - `display_name` string, required
  - `enabled` boolean
  - `forward_coder_headers` boolean — ForwardCoderHeaders, when true, forwards Coder identity headers on every outgoing MCP request. See MCPServerConfig.
  - `icon_url` string
  - `model_intent` boolean
  - `oauth2_auth_url` string
  - `oauth2_client_id` string
  - `oauth2_client_secret` string
  - `oauth2_revocation_url` string — OAuth2RevocationURL is the provider's RFC 7009 revocation endpoint; auto-populated by OAuth2 discovery when omitted.
  - `oauth2_scopes` string
  - `oauth2_token_url` string
  - `slug` string, required
  - `tool_allow_list` string[]
  - `tool_deny_list` string[]
  - `transport` 'streamable_http' | 'sse', required
  - `url` string, required

## Response `201`

Created

- CodersdkMCPServerConfig
  - `allow_in_plan_mode` boolean
  - `api_key_header` string — API key fields (only populated for admins).
  - `auth_connected` boolean — Per-user state (populated for non-admin requests).
  - `auth_type` string — "none", "oauth2", "api_key", "custom_headers", "user_oidc"
  - `availability` string — Availability policy set by admin.
  - `created_at` string, date-time
  - `description` string
  - `display_name` string
  - `enabled` boolean
  - `forward_coder_headers` boolean — ForwardCoderHeaders forwards the same Coder identity headers we send to LLM providers (X-Coder-Owner-Id, X-Coder-Chat-Id, and the optional X-Coder-Subchat-Id and X-Coder-Workspace-Id) to this MCP server on every request. Off by default to avoid leaking chat identity to third-party servers.
  - `has_api_key` boolean
  - `has_custom_headers` boolean
  - `has_oauth2_secret` boolean
  - `icon_url` string
  - `id` string, uuid
  - `model_intent` boolean
  - `oauth2_auth_url` string
  - `oauth2_client_id` string — OAuth2 fields (only populated for admins).
  - `oauth2_revocation_url` string
  - `oauth2_scopes` string
  - `oauth2_token_url` string
  - `organization_id` string, uuid
  - `slug` string
  - `tool_allow_list` string[] — Tool governance.
  - `tool_deny_list` string[]
  - `transport` string — "streamable_http" or "sse"
  - `updated_at` string, date-time
  - `url` string

## Changes

- **2026-08-26** `4e2ba40f72eb` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/coder/apis/coder-api/changes/api/v2/organizations/:organization/mcp-servers/post.md)

---

[API](https://skmtc.dev/coder/apis/coder-api.md) · [All operations](https://skmtc.dev/coder/apis/coder-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/coder/coder-api/revisions/bbfaa0a105e8/schema)