Get the MCP policy

⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/organizations/mcp_policy

Return which MCP servers requests and agents in the organization may connect to.

For how this fits into a full workflow, see MCP connector.

Headers

HeaderRequiredValue
AuthorizationYesBearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys.
syntic-betaYes, while in previewadmin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning.

Response

200 OK, Content-Type: application/json

{
  "type": "mcp_policy",
  "mode": "allowlist",
  "allowed_servers": [
    {
      "url_prefix": "https://mcp.example.com/",
      "note": "Internal CRM"
    },
    {
      "tunnel_id": "tnl_01JCE4G6J8L0N2Q4S6U8",
      "note": "On-prem ERP"
    }
  ],
  "require_tunnel_for_private": true,
  "updated_at": "2026-11-05T10:00:00Z"
}
FieldTypeDescription
modestringopen (any public HTTPS server), allowlist (only listed servers and tunnels) or disabled (the mcp_servers field is refused).
allowed_serversarrayEntries with either url_prefix or tunnel_id.
require_tunnel_for_privatebooleanRefuse servers on private addresses unless reached through an MCP tunnel.

Examples

curl -sS "https://app.syntic.ai/v1/organizations/mcp_policy" \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01"

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
401authentication_errorinvalid_api_keyThe admin key is missing, unknown, revoked or expired.
403permission_erroradmin_key_requiredAn inference key was used.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?