---
title: "[Beta] Create an McpConfig."
method: POST
path: "/v1/mcp-configs"
tags: ["mcp-configs"]
---

# [Beta] Create an McpConfig.

`POST /v1/mcp-configs`

[Beta] Create a new McpConfig to connect to an upstream MCP (Model Context Protocol) server. The config specifies the target endpoint and which tools are allowed.

## Request body

- McpConfigCreateParameters — Parameters required to create a new McpConfig.
  - `name` string, required — The human-readable name for the McpConfig. Must be unique within your account. The first segment before '-' is used as the service name for tool routing (e.g., 'github-readonly' uses 'github' as the service name).
  - `endpoint` string, required — The target MCP server endpoint URL (e.g., 'https://mcp.example.com').
  - `allowed_tools` string[], required — Glob patterns specifying which tools are allowed from this MCP server. Examples: ['*'] for all tools, ['github.search_*', 'github.get_*'] for specific patterns.
  - `description` string, nullable — Optional description for this MCP configuration.
  - `custom_headers` CustomHeaderView[], nullable — Additional headers applied to upstream requests after the credential. At most 8 entries.
    - `name` string, required — The header name (e.g., 'DD-APPLICATION-KEY').
    - `secret` string, nullable — Account secret providing the header value. Accepts a secret name or 'sec_' id on writes; reads always return the 'sec_' id.
    - `value` string, nullable — Literal header value. Stored in plaintext and returned by reads - use 'secret' for credentials or other sensitive values.
  - `auth_mechanism` AuthMechanismView — Defines how the primary credential is applied to requests proxied to the upstream.
    - `type` string, required — The type of authentication mechanism: 'header', 'bearer', or 'basic'. For 'basic', store the secret as plain 'user:pass'; the proxy base64-encodes it.
    - `key` string, nullable — The header name (e.g., 'x-api-key'). Required for 'header' type; invalid for other types.

## Response `200`

McpConfig created successfully.

- McpConfigView — An McpConfig defines a configuration for connecting to an upstream MCP (Model Context Protocol) server. It specifies the target endpoint and which tools are allowed.
  - `id` string, required — The unique identifier of the McpConfig.
  - `name` string, required — The human-readable name of the McpConfig. Unique per account.
  - `endpoint` string, required — The target MCP server endpoint URL (e.g., 'https://mcp.example.com').
  - `allowed_tools` string[], required — Glob patterns specifying which tools are allowed from this MCP server (e.g., ['github.search_*', 'github.get_*'] or ['*'] for all tools).
  - `description` string, nullable — Optional description for this MCP configuration.
  - `custom_headers` CustomHeaderView[], nullable — Additional headers applied to upstream requests after the credential. Secret-backed entries reference the secret by 'sec_' id; values are never returned.
    - `name` string, required — The header name (e.g., 'DD-APPLICATION-KEY').
    - `secret` string, nullable — Account secret providing the header value. Accepts a secret name or 'sec_' id on writes; reads always return the 'sec_' id.
    - `value` string, nullable — Literal header value. Stored in plaintext and returned by reads - use 'secret' for credentials or other sensitive values.
  - `auth_mechanism` AuthMechanismView, required — Defines how the primary credential is applied to requests proxied to the upstream.
    - `type` string, required — The type of authentication mechanism: 'header', 'bearer', or 'basic'. For 'basic', store the secret as plain 'user:pass'; the proxy base64-encodes it.
    - `key` string, nullable — The header name (e.g., 'x-api-key'). Required for 'header' type; invalid for other types.
  - `create_time_ms` integer, required — Creation time of the McpConfig (Unix timestamp in milliseconds).

## Other responses

- `400` — Bad request. Name already exists or is invalid.
- `401` — Unauthorized. Invalid or missing authentication.
- `403` — Forbidden. Account does not have devbox capability.
- `500` — Internal server error.

## Changes

- **2026-08-20** `e9dc776053e4` — 4 info
  - added the new optional request property `auth_mechanism`
  - added the new optional request property `custom_headers`
  - added the optional property `custom_headers` to the response with the `200` status
  - added the required property `auth_mechanism` to the response with the `200` status
- **2026-05-27** `d3ddb452754c` — 1 breaking
  - the request property `description` became not nullable
- **2026-02-05** `15b7fd06098d` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/runloopai/apis/runloop-api/changes/v1/mcp-configs/post.md)

---

[API](https://skmtc.dev/runloopai/apis/runloop-api.md) · [All operations](https://skmtc.dev/runloopai/apis/runloop-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/runloopai/runloop-api/revisions/e9dc776053e4/schema)