These management endpoints use a signed-in [User] session, not an API key. Write operations require an administrative role; organization members with read access can list servers and inspect tools.
Endpoints
Register a server
POST /mcp/servers?org_id=ORG_ID
string
required
Organization that will own the registration.
string
required
Display name, up to 255 characters.
string
required
HTTP or HTTPS server URL. Production registrations must use HTTPS and cannot target private, loopback, or link-local addresses.
string
Optional credential value. AutoSage stores it encrypted and does not return it.
List servers
GET /mcp/servers?org_id=ORG_ID
Returns the organization’s registrations without stored credentials.
Inspect discovered tools
GET /mcp/servers/:id/tools?org_id=ORG_ID
Returns server_id, server_name, the cached tools manifest, and manifest_refreshed_at.
Configure OAuth
POST /mcp/servers/:id/oauth/start?org_id=ORG_ID
Accepts an optional scope string and returns an authorization_url. Redirect the signed-in user to that URL. The provider returns through GET /mcp/servers/oauth/callback, where AutoSage exchanges the authorization code and refreshes tool discovery.
The callback is part of the browser authorization flow. Applications should start OAuth through the authenticated endpoint and follow the returned URL rather than constructing callback parameters themselves.
Delete a server
DELETE /mcp/servers/:id?org_id=ORG_ID
Deletes the organization registration. Agents and chats can only enable server IDs that remain registered in the same organization.
Next steps
Configure agents
Select registered MCP servers for an agent.
Chats API
Enable organization MCP servers on a chat.