Connecting MCP Servers

Register your upstream MCP servers so agents can discover and use their tools.

Registration

curl -X POST https://api.wardenauthz.com/v1/scope/{orgId}/mcp-server \
  -H "x-api-key: ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "serverKey": "github",
    "name": "GitHub MCP",
    "url": "https://api.githubcopilot.com/mcp/",
    "tier": "low",
    "authType": "oauth",
    "allowedTools": [
      { "name": "list_issues", "tier": "low" },
      { "name": "read_repo", "tier": "low" },
      { "name": "create_issue", "tier": "medium", "hitl": "self" },
      { "name": "merge_pr", "tier": "high", "hitl": "admin" }
    ]
  }'

Server Configuration

Field	Description
serverKey	Short unique key — used in tool namespacing (github__list_issues)
url	MCP server endpoint URL
tier	Default tier for all tools (low, medium, high)
authType	oauth, apikey, or none
allowedTools	Explicit list of tools and their individual tiers

OAuth Setup

For OAuth servers (GitHub, Asana, Linear, etc.), configure the OAuth client:

curl -X POST https://api.wardenauthz.com/v1/mcp/oauth/register \
  -H "x-api-key: ak_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "serverKey": "github",
    "clientId": "your-github-oauth-app-id",
    "clientSecret": "your-github-oauth-app-secret"
  }'

Resource Constraints

Constrain which resources an agent can access within a server. This is an ABAC fallback for shared-credential servers.

# Only allow access to specific GitHub repos
-d '{
    ...,
    "resourceConstraints": {
      "repo": ["my-org/public-repo", "my-org/docs"]
    }
  }'

Now if the agent tries to access my-org/private-repo, the call is blocked — even if the tool is in the consent grant.

Catalog

WardenAuth includes a catalog of pre-configured MCP servers:

Server	Auth	Verified
GitHub	OAuth	✓
Atlassian (Jira & Confluence)	OAuth	✓
Asana	OAuth	✓
Linear	OAuth	✓
Notion	OAuth	✓
Sentry	OAuth	✓
Stripe	API Key	✓
Cloudflare	API Key	✓
Custom	Any	—

Pre-configured servers have verified endpoints and default tool lists. Custom servers can be registered with any MCP endpoint.

Full API Reference

Complete request/response schemas, examples, and try-it-out are available in the API Reference.