STstacklok
workloads

Export workload configuration

Changed on

Export a workload's run configuration as JSON

get/api/v1beta/workloads/{name}/export

Request

Path parameters

namestring required

Workload name

Response

OK

allow_docker_gatewayboolean

AllowDockerGateway permits outbound connections to Docker gateway addresses (all daemon bridge gateways, host.docker.internal, and gateway.docker.internal). These are blocked by default in the egress proxy even when InsecureAllowAll is set. Only applicable to Docker deployments with network isolation enabled. Gateways are snapshotted at deployment; redeploy to include bridges created later. Gateway access is port-independent: it ignores the permission profile's allowed ports, so once enabled the gateway is reachable on any port.

allowed_originsstring[]

AllowedOrigins is the allowlist of values accepted on the HTTP Origin header, used for DNS-rebinding protection per MCP 2025-11-25 §"Security Warning". When empty and Host is loopback (127.0.0.1 / localhost / [::1]), a default loopback-only allowlist is derived at middleware-wiring time. When empty and Host is non-loopback, the middleware is disabled — operators exposing the proxy publicly must configure an explicit allowlist.

audit_config_pathstring

DEPRECATED: Middleware configuration. AuditConfigPath is the path to the audit configuration file

authz_config_pathstring

DEPRECATED: Middleware configuration. AuthzConfigPath is the path to the authorization configuration file

base_namestring

BaseName is the base name used for the container (without prefixes)

cmd_argsstring[]

CmdArgs are the arguments to pass to the container

container_labelsobject

ContainerLabels are the labels to apply to the container

container_namestring

ContainerName is the name of the container

debugboolean

Debug indicates whether debug mode is enabled

endpoint_prefixstring

EndpointPrefix is an explicit prefix to prepend to SSE endpoint URLs. This is used to handle path-based ingress routing scenarios.

env_file_dirstring

DEPRECATED: No longer appears to be used. EnvFileDir is the directory path to load environment files from

env_varsobject

EnvVars are the parsed environment variables as key-value pairs

groupstring

Group is the name of the group this workload belongs to, if any

hoststring

Host is the host for the HTTP proxy

imagestring

Image is the Docker image to run

isolate_networkboolean

IsolateNetwork indicates whether to isolate the network for the container

jwks_auth_token_filestring

DEPRECATED: No longer appears to be used. JWKSAuthTokenFile is the path to file containing auth token for JWKS/OIDC requests

k8s_pod_template_patchstring

K8sPodTemplatePatch is a JSON string to patch the Kubernetes pod template Only applicable when using Kubernetes runtime

max_request_body_sizeinteger

MaxRequestBodySize is the maximum inbound MCP proxy request body size in bytes. Zero uses the default limit of 8 MiB. Negative values are rejected when the RunConfig is built or used at runtime.

mcpserver_generationinteger

MCPServerGeneration is the K8s .metadata.generation of the MCPServer CR that rendered this RunConfig. The Kubernetes runtime uses it as a monotonic version to prevent stale rolling-update pods from overwriting a newer RunConfig's StatefulSet apply. Zero value means unversioned (backward-compat with older operators, or non-operator callers).

namestring

Name is the name of the MCP server

permission_profile_name_or_pathstring

PermissionProfileNameOrPath is the name or path of the permission profile

portinteger

Port is the port for the HTTP proxy to listen on (host port)

proxy_mode'sse' | 'streamable-http'

ProxyMode is the effective HTTP protocol the proxy uses. For stdio transports, this is the configured mode (sse or streamable-http). For direct transports (sse/streamable-http), this matches the transport type. Note: "sse" is deprecated; use "streamable-http" instead.

proxy_read_timeoutstring

ProxyReadTimeout bounds reading the entire request (headers + body) on the proxy HTTP server, expressed as a Go duration string (e.g. "30s", "1m"). Empty uses the proxy default (30s). Negative durations and values that fail time.ParseDuration are rejected at runtime. Applies to all HTTP transports. String (not time.Duration) keeps the wire format unit-explicit.

publishstring[]

Publish lists ports to publish to the host in format "hostPort:containerPort"

rate_limit_namespacestring

RateLimitNamespace is the Kubernetes namespace for Redis key derivation.

registry_api_urlstring

RegistryAPIURL is the registry API URL that served this server's metadata. Empty when the server was not discovered via registry lookup.

registry_server_namestring

RegistryServerName is the registry entry name used to look up this server's metadata. Empty when the server was not discovered via registry lookup.

registry_urlstring

RegistryURL is the registry URL that served this server's metadata. Empty when the server was not discovered via registry lookup.

remote_urlstring

RemoteURL is the URL of the remote MCP server (if running remotely)

schema_versionstring

SchemaVersion is the version of the RunConfig schema

secretsstring[]

Secrets are the secret parameters to pass to the container Format: "<secret name>,target=<target environment variable>"

session_ttlstring

SessionTTL is the inactivity timeout for proxy sessions, expressed as a Go duration string (e.g. "30m", "2h", "168h"). Empty uses the transport default (2h). Negative durations and values that fail time.ParseDuration are rejected at runtime. String (not time.Duration) keeps the wire format unit-explicit: a time.Duration field serializes as nanoseconds in JSON.

statelessboolean

Stateless indicates the server only supports POST (no SSE/GET). When true, the proxy returns 405 for incoming GET requests and uses a POST-based health check instead of the default GET probe. Applies to both remote URLs and local container workloads.

strict_protocol_validationboolean

StrictProtocolValidation enables strict MCP-Protocol-Version validation on the streamable HTTP proxy: a request whose header names an unknown MCP revision is rejected with HTTP 400. Default false accepts any version string (an absent header is always accepted in either mode).

target_hoststring

TargetHost is the host to forward traffic to (only applicable to SSE transport)

target_portinteger

TargetPort is the port for the container to expose (only applicable to SSE transport)

thv_ca_bundlestring

DEPRECATED: No longer appears to be used. ThvCABundle is the path to the CA certificate bundle for ToolHive HTTP operations

tools_filterstring[]

DEPRECATED: Middleware configuration. ToolsFilter is the list of tools to filter

tools_overrideobject

DEPRECATED: Middleware configuration. ToolsOverride is a map from an actual tool to its overridden name and/or description

transport'stdio' | 'sse' | 'streamable-http' | 'inspector'

Transport is the transport mode (stdio, sse, or streamable-http)

trust_proxy_headersboolean

TrustProxyHeaders indicates whether to trust X-Forwarded-* headers from reverse proxies

volumesstring[]

Volumes are the directory mounts to pass to the container Format: "host-path:container-path[:ro]"

Example response

{
  "embedded_auth_server_config": {
    "cimd": {
      "cache_fallback_ttl": "5m"
    }
  },
  "proxy_read_timeout": "30s",
  "remote_auth_config": {
    "timeout": "5m"
  },
  "session_ttl": "2h"
}

Changes

  • f24699eeb705Revision changes
    • info

      added the optional property /// to the response with the status

    • info

      added the optional property /// to the response with the status

    • info

      added the optional property /// to the response with the status

    • info

      added the optional property /// to the response with the status

    • info

      added the optional property /// to the response with the status

    • info

      added the optional property /// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property //// to the response with the status

    • info

      added the optional property // to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property /// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property //// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property ///// to the response with the status

    • info

      added the optional property //// to the response with the status

  • 686129546a6aRevision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property // to the response with the status