Make a remote MCP server with a bearer typed in
The operator (installation.settings.manage, the workspace owner), signed in; an API key is 403 whatever its scopes. The credential is the value in the request, sealed under this row alone in the same transaction as the row; a reference to the deployment's env or Secrets Manager is the operator's settings CLI's. The destination never changes after: another one is a new id. An id ever used (disabled rows count) is 409 already_exists; an entry the catalog's rules refuse is 400 invalid_entry. With the secret store off (no PLATFORM_SECRET_KEY) a credential is 503. github is the built-in server's name. Writes a create_mcp_server receipt.
Auth: cookie session only; no scope. Idempotency-Key: ignored.
cookieSession__Host-werft_session<token>For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.
X-Requested-With?"werft-web"Required with a cookie session: the literal werft-web.
"werft-web"application/json- body
id*string^[a-z0-9][a-z0-9._-]{0,63}$url*string1 <= lengthcredential_ref*string1 <= lengthworkspaces*array<>1 <= itemsvalue*string1 <= length <= 8192The entry's id and the change's receipt.
application/json- response
id*string1 <= lengthreceipt_id*string^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidcurl -X POST 'https://example.com/v1/installation/settings/mcp-servers' \ -H 'Content-Type: application/json' \ -d '{ "id": "docs", "url": "https://mcp.example.com/mcp", "credential_ref": "docs_mcp", "workspaces": [ "acme" ], "value": "example-bearer"}'{ "id": "docs", "receipt_id": "019a0000-0000-7000-8000-0000000000f3"}