---
title: "[Beta] List McpConfigs."
method: GET
path: "/v1/mcp-configs"
tags: ["mcp-configs"]
---

# [Beta] List McpConfigs.

`GET /v1/mcp-configs`

[Beta] List all McpConfigs for the authenticated account.

## Query parameters

- `name` string
- `id` string
- `search` string
- `limit` integer
- `starting_after` string
- `include_total_count` boolean

## Response `200`

Successfully retrieved list of McpConfigs.

- McpConfigListView — A paginated list of McpConfigs.
  - `mcp_configs` McpConfigView[], required — The list of McpConfigs.
    - `id` string, required — The unique identifier of the McpConfig.
    - `name` string, required — The human-readable name of the McpConfig. Unique per account.
    - `endpoint` string, required — The target MCP server endpoint URL (e.g., 'https://mcp.example.com').
    - `allowed_tools` string[], required — Glob patterns specifying which tools are allowed from this MCP server (e.g., ['github.search_*', 'github.get_*'] or ['*'] for all tools).
    - `description` string, nullable — Optional description for this MCP configuration.
    - `custom_headers` CustomHeaderView[], nullable — Additional headers applied to upstream requests after the credential. Secret-backed entries reference the secret by 'sec_' id; values are never returned.
      - `name` string, required — The header name (e.g., 'DD-APPLICATION-KEY').
      - `secret` string, nullable — Account secret providing the header value. Accepts a secret name or 'sec_' id on writes; reads always return the 'sec_' id.
      - `value` string, nullable — Literal header value. Stored in plaintext and returned by reads - use 'secret' for credentials or other sensitive values.
    - `auth_mechanism` AuthMechanismView, required — Defines how the primary credential is applied to requests proxied to the upstream.
      - `type` string, required — The type of authentication mechanism: 'header', 'bearer', or 'basic'. For 'basic', store the secret as plain 'user:pass'; the proxy base64-encodes it.
      - `key` string, nullable — The header name (e.g., 'x-api-key'). Required for 'header' type; invalid for other types.
    - `create_time_ms` integer, required — Creation time of the McpConfig (Unix timestamp in milliseconds).
  - `has_more` boolean, required — Whether there are more results available beyond this page.
  - `total_count` integer, nullable — Total count of McpConfigs that match the query.

## Other responses

- `401` — Unauthorized. Invalid or missing authentication.
- `403` — Forbidden. Account does not have devbox capability.
- `500` — Internal server error.

---

[API](https://skmtc.dev/runloopai/apis/runloop-api.md) · [All operations](https://skmtc.dev/runloopai/apis/runloop-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/runloopai/runloop-api/revisions/e9dc776053e4/schema)