---
title: "Create Workspace Mcp Server"
method: POST
path: "/v1/workspaces/{workspace_id}/mcp-servers"
tags: ["mcp-servers"]
---

# Create Workspace Mcp Server

`POST /v1/workspaces/{workspace_id}/mcp-servers`

Register an MCP server for a workspace. Organization owners/admins or this workspace's owners/admins.

The authorization token is encrypted at rest and never returned. The URL
is checked for SSRF safety here as well as on the request path, and must
use https when a token is set. A name already used in this workspace is
refused with a 409.

## Path parameters

- `workspace_id` string, uuid, required

## Request body

- WorkspaceMcpServerCreate — Request body for registering a server. ``authorization_token`` is never stored as sent: it is encrypted with ``OTARI_SECRET_KEY`` and only the ciphertext is kept, the same convention `entities.ProviderCredential` and `OrgProviderKey` already use.
  - `allowed_tools` string[], nullable — Allow-list of tool names; null exposes every tool the server offers
  - `authorization_token` string, nullable — Bearer token for the server; requires an https URL. Encrypted at rest, never returned
  - `enabled` boolean — Whether a request naming this server actually reaches it
  - `name` string, required — Label for the server, unique within the workspace
  - `purpose_hint` string, nullable — Hint prepended to the system message to help the model choose
  - `url` string, required — Streamable HTTP MCP endpoint

## Response `201`

Successful Response

- WorkspaceMcpServerPublic — The API-facing shape. Never carries the token, only whether one is set. No ``last4``-style prefix either, unlike `OrgProviderKeyPublic`: a provider key's last four digits let an operator match a stored key against the one in their provider's console, and there is no equivalent workflow for an MCP bearer token.
  - `allowed_tools` string[], nullable, required
  - `created_at` string, required
  - `enabled` boolean, required
  - `has_token` boolean, required
  - `id` string, uuid, required
  - `name` string, required
  - `purpose_hint` string, nullable, required
  - `updated_at` string, required
  - `url` string, required
  - `workspace_id` string, uuid, required

## Other responses

- `422` — Validation Error

## Changes

- **2026-08-24** `961e73dbaf8b` — 1 info
  - endpoint added
- **2026-08-21** `2f89238cc674` — 1 breaking
  - api path removed without deprecation
- **2026-08-21** `875cef5dd6a8` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/mozilla-ai/apis/otari/changes/v1/workspaces/:workspace_id/mcp-servers/post.md)

---

[API](https://skmtc.dev/mozilla-ai/apis/otari.md) · [All operations](https://skmtc.dev/mozilla-ai/apis/otari/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mozilla-ai/otari/revisions/1be78e895028/schema)