---
title: "List tool servers"
method: GET
path: "/client/mcp/upstreams"
tags: ["Tool gateway"]
---

# List tool servers

`GET /client/mcp/upstreams`

## Request

- Base URL: `https://api.roar-ai.com`
- URL: `https://api.roar-ai.com/client/mcp/upstreams`
- Auth: HTTP bearer

Your MCP servers. Addresses go to an owner or admin only; a credential is reported as set or not, never returned. Requires `mcp:read`.

## Response `200`

Tool servers

- McpUpstreamList
  - `data` McpUpstream[], required
    - `id` string, uuid, required
    - `clientId` string, uuid, required
    - `name` string, required: The prefix agents see on its tools: `<name>__<tool>`
    - `url` string, uri, nullable, required: Null unless the caller may change tool servers: an owner or admin session, or an org-level key with mcp:write. An address can carry a token in its path.
    - `authType` 'none' | 'bearer' | 'header' | 'oauth', required: `oauth`: an owner or admin SIGNS IN to it; its state is `GET /client/mcp/upstreams/{id}/oauth`
    - `authHeader` string, nullable, required: The header NAME for `header` auth — never its value. Null on the same terms as `url`
    - `status` 'active' | 'disabled', required
    - `argsPolicy` 'pass' | 'redact' | 'block', required: What happens to personal data in a call’s ARGUMENTS. Results are always masked
    - `toolsFetchedAt` string, date-time, nullable, required: Null until the first successful refresh
    - `lastError` string, nullable, required: Why the last refresh failed, in words safe to show. Null after a success
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `hasCredential` boolean, required: Whether a credential is stored. The credential itself is never returned

## Other responses

- `403`: Key lacks mcp:read

---

[API](https://skmtc.dev/roar-ai/apis/roar-ai-api.md) · [All operations](https://skmtc.dev/roar-ai/apis/roar-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/roar-ai/apis/roar-ai-api/revisions/37e4d0d5a7fe?raw)