Discover Mcp Tools
Discover available tools from an MCP server.
Three callable shapes - see DiscoverMcpToolsRequest docs for full details:
- Saved-id:
{savedConnectionId}-> BE reads the stored row and composes headers server-side; the browser never sees the token.savedConnectionNameis accepted as a deprecated alias for one release cycle. - Inline with masked secret:
{serverUrl, headers: {...: "********"}}-> BE matches the serverUrl against saved settings and substitutes the stored secret for every masked header value. - Inline plaintext:
{serverUrl, headers}- used on first-save “Test” click before the row exists.
URL is validated (SSRF guard) on every path. Per-tenant rate limit:
30 req/min -> 429 with Retry-After. A 300s in-process cache (M10)
keyed by (serverUrl, headers-hash) short-circuits repeat calls;
X-MCP-Cache: hit|miss is emitted on every response. Cache hits
still consume rate-limit budget - the cache is not a bypass.
POST
/agents/mcp/toolsAuthorization
AuthorizationBearer token · headerrequiredRequest body
requiredapplication/jsonserverUrlstringmax length 2048 · default: ""
headersobjectsavedConnectionIdstring | nullIf set, BE resolves serverUrl + headers from the tenant's saved connection by id
Show propertiesHide properties
Any of:
string
stringnull
nullsavedConnectionNamestring | nullDeprecated - prefer savedConnectionId. Accepted for backward compatibility for one release cycle.
Show propertiesHide properties
Any of:
string
stringnull
nullResponses
200
Successful Response
object422
Validation Error
detailValidationError[]Show propertiesHide properties
Array of
ValidationErrorlocstring | integer[]requiredShow propertiesHide properties
Array of
string | integerAny of:
string
stringinteger
integermsgstringrequiredtypestringrequiredinputanyctxobject