Inspect an MCP server before registering it

Answers 404 where the mcp-upstreams feature is off. A read: it stores nothing, adopts nothing and sends no credential. Says what the server is, through the transport and discovery registration uses: open (lists its tools without a sign-in), oauth (signs people in with OAuth), credential (asks for a sign-in and names no OAuth metadata), refused (the reason Anlyon will not sign in to it) or unreachable. What the server answers is a 200 with one of those; an endpoint registration would refuse is a 400. Its text is the server’s, untrusted.

POST/api/v2/mcp-upstreams/inspect

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Request body

requiredapplication/json

urlstring<uri>required

max length 2048

Responses

200

What the server is.

successbooleanrequired

dataMcpUpstreamInspectionrequired

What the server is. kind says which of the other fields are present.

Show properties

kindstringrequired

Allowed:openoauthcredentialrefusedunreachable

hoststringrequired

toolCountinteger

For open: the tools it lists without a sign-in.

transportstring

For open: the transport that answered. sse is the older HTTP+SSE transport.

Allowed:streamable-httpsse

serverInfoobject | null

For open: what the server calls itself. Untrusted.

Show properties

namestring

titlestring

versionstring

signInMcpUpstreamSignIn | null

For oauth, and for open when it also publishes OAuth metadata for calls (otherwise null).

Show properties

Any of:

McpUpstreamSignIn

issuerstring<uri>required

authorizationHoststringrequired

tokenHoststringrequired

The one host a client secret may be sent to.

scopesSupportedstring[]required

advertisedobjectrequired

Show properties

dynamicRegistrationbooleanrequired

clientIdMetadataDocumentsbooleanrequired

pkceS256booleanrequired

redirectUristring<uri> | nullrequired

The callback a client must list at the vendor. Null where this deployment has no connections configured.

null

null

statusinteger

For credential: the status the server answered, 401 or 403.

reasonstring

For refused: why, as a stable code.

messagestring

For refused and unreachable: why, in words.

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

How to get past this error, for a person or an agent. Present on refusals with a known next step, such as a missing scope or role, a plan or billing limit, a halted environment, or a missing secret, connected account, OAuth app or end-user header. Absent when there is no fix to give. Kept in production responses, unlike details.

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

429

Too Many Requests - Rate limit exceeded. A workspace's API requests are limited per minute and per UTC clock hour by plan; Retry-After says when to try again, and an hourly refusal names the limit and when the count resets. Successful responses carry the same limits in X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (the minute) and X-RateLimit-Limit-Hour, X-RateLimit-Remaining-Hour, X-RateLimit-Reset-Hour (the hour).

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.

Bodyapplication/json

urlstring*

Request

curl -X POST 'https://api.anlyon.com/api/v2/mcp-upstreams/inspect' \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "url": "https://mcp.example.com/mcp"
}'

const response = await fetch("https://api.anlyon.com/api/v2/mcp-upstreams/inspect", {
  method: "POST",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN",
    "Accept": "application/json",
    "Content-Type": "application/json"
  },
  body: "{\n  \"url\": \"https://mcp.example.com/mcp\"\n}"
});

import requests

response = requests.post(
    "https://api.anlyon.com/api/v2/mcp-upstreams/inspect",
    headers={
        "Authorization": "Bearer YOUR_TOKEN",
        "Accept": "application/json",
        "Content-Type": "application/json"
    },
    data="{\n  \"url\": \"https://mcp.example.com/mcp\"\n}",
)

Response

{
  "success": true,
  "data": {
    "kind": "open",
    "host": "mcp.example.com",
    "toolCount": 0,
    "transport": "streamable-http",
    "serverInfo": {
      "name": "string",
      "title": "string",
      "version": "string"
    },
    "signIn": {
      "issuer": "http://example.com",
      "authorizationHost": "string",
      "tokenHost": "string",
      "scopesSupported": [
        "string"
      ],
      "advertised": {
        "dynamicRegistration": true,
        "clientIdMetadataDocuments": true,
        "pkceS256": true
      },
      "redirectUri": "http://example.com"
    },
    "status": 0,
    "reason": "string",
    "message": "string"
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}