Programmatic Access

Whether you can create and manage MCP Manager gateways, connections, and identities programmatically: a control-plane API, CLI, and MCP-based provisioning are in active development with design partners, and how that differs from the token-based agent connection and per-user identity passing that ship today.

Many teams want to manage their MCP Manager setup programmatically — provisioning gateways, connections, and identities from code or a pipeline instead of clicking through the app, and managing it the way they manage infrastructure with Terraform. This page explains where that stands and what you can automate today.

Programmatic provisioning of MCP Manager resources — a control-plane API, CLI, and MCP-based access — is in active development and not generally available yet. The token-based connection and per-user identity flows described under What you can automate today do ship now.

A recognized need, in active development

Provisioning MCP Manager resources from code — gateways, connections, identities, and roles — is a recognized priority and is in active development. We are building it together with design partners to get the surfaces right. The surfaces we intend to offer:

• A control-plane API — create and manage gateways, connections, and identities over HTTP.
• A CLI — script the same operations and wire them into pipelines and infrastructure-as-code workflows.
• MCP-based access — manage MCP Manager itself through MCP, so an agent can provision and operate your setup with the same protocol everything else uses.

This is not generally available yet, and we are not committing to specific surfaces or a date here. If it matters to you, contact your MCP Manager contact to learn more or to join as a design partner — design-partner input directly shapes what ships.

What you can automate today

Two related capabilities ship today. Both are about connecting agents to gateways, not about provisioning the gateways themselves — gateways, connections, and identities are still created in the MCP Manager app.

• Token-based agent connection. A headless agent connects to a gateway with an API access token rather than an interactive sign-in. You create a token-based host and issue it a token scoped to a single gateway connection. See API Tokens & Headless Agents.
• Per-user identity passing. A single agent can carry each end user’s own identity through to downstream servers, so actions run as the real person and stay fully logged. See Agents that Pass Identities to MCP Manager.

These let an agent use MCP Manager programmatically. They do not yet let you build your gateways and connections programmatically — that is the control-plane work described above.

Logs are not available through a pull API. Log data leaves MCP Manager in two ways only: as a file you export (CSV or ND-JSON), or pushed to your own collector over OpenTelemetry. There is no endpoint to query or pull logs programmatically — for example, by session ID. To work with logs from code, forward them over OpenTelemetry and query them in your own tool. See Accessing log data programmatically and Export to SIEM.

Further reading

API Tokens & Headless Agents

How a headless agent connects to a gateway with a scoped API access token.

Agents passing identities

One agent, many users, each acting as themselves through per-user tokens.

Gateway Deployment Strategies

How gateways package servers, and the topologies you can build in the app today.

Connection Experience

The authorization flow every host uses to connect to a gateway.