MCP Platform
Register upstream MCP servers, manage discovered tools, control per-agency access, and provision gateway API keys for the Mythic Analytics Model Context Protocol platform.
Overview
The MCP Platform has three surfaces:
- A management API under
/admin/mcpfor registering upstream MCP servers, probing them for tools, controlling which agencies may use each server and tool, and provisioning gateway API keys. It is authenticated with a Supabase session JWT for an allowlisted admin account. - A gateway at
/mcpthat speaks JSON-RPC 2.0. External MCP clients call it with anmcp_API key to list and execute tools. See MCP Gateway. - A hosted Settings Server for agencies to manage a client's analytics settings (insights, dashboards, canvases, destinations, tenant config) with a select-a-client session flow. It uses the same
mcp_keys and scopes. See Settings Server.
Base URL
The management API and gateway share the same worker host.
https://mythic-analytics.gulp.workers.dev
Management endpoints are mounted under /admin/mcp (for example /admin/mcp/servers). The gateway is a single endpoint at POST /mcp.
Response envelope
Management endpoints return a small JSON envelope — there is no success or count wrapper on reads.
Resource payload. An array for list endpoints, an object for single-resource endpoints. Present on successful reads, creates, and updates.
Returned as true by delete endpoints and by the server probe endpoint.
Returned alongside data when creating an API key, reminding you the raw key is shown only once.
Returned by bulk agency-access updates when some entries were rejected. Each item is { agency_id, error }.
Error message. This is the only field on a failed request.
Key concepts
| Concept | Description |
|---|---|
| MCP Server | A registered upstream server that exposes tools over MCP. A server is either platform-wide (agency_id is null) or owned by one agency. |
| Tool | A capability discovered on a server by probing. Tools are never created directly — they come from initialize + tools/list. |
| Agency access | Per-agency enable/disable rules on a server or tool. When no record exists, access defaults to enabled. |
| API key | An mcp_ credential scoped to one agency and one location, used to authenticate against the gateway. |
| Scope prefix | Optional namespace on a server, mapping its tools to a <prefix>:call scope for gateway keys. |
Access model
Management endpoints control access at the agency level (mcp_server_agency_access, mcp_tool_agency_access). Per-location (client) tool access is a separate concern configured through the agency Builder API, not through /admin/mcp.
Error handling
| Status | Meaning |
|---|---|
400 | Missing required field, invalid URL, blocked header, invalid scope_prefix, or nothing to update |
401 | Session token missing, invalid, or not on the admin allowlist |
404 | Server or tool not found |
502 | Upstream MCP server unreachable or probe failed |
500 | Internal error |
On failure, read the error string in the response body together with the HTTP status. There is no success: false envelope on errors.