List an MCP server's capabilities

GET/v1/mcp-servers/{slug}/capabilities

List an MCP server's capabilities.

The connector's capabilities as seen from this server: server_enabled says whether the server has each switched on, and effective_enabled whether a call through this server would be allowed. Not paginated.

Requires an organization admin key, or a key of the server's workspace (any role). Returns 404 when the server does not exist in the organization.

Authorization

AuthorizationBearer va_
A platform API key (va_...), created under Settings > API keys. Scoped to an organization or one workspace, with an admin or member role. Used by the management API.

Path parameters

slugstringrequired
The MCP server's slug (mcps-...).

Query parameters

organizationstringrequired
The organization's identifier (slug).

Responses

200application/json

dataobject[]
The capabilities, all of them (not paginated).
Child attributes
- idstring<uuid>
  The capability's ID (UUID), used to update it.
- typeenum<string>
  TOOL, PROMPT, RESOURCE or RESOURCE_TEMPLATE.
  One of "TOOL", "PROMPT", "RESOURCE", "RESOURCE_TEMPLATE"
- identifierstring
  What identifies it at the upstream: the name of a tool or prompt, the URI of a resource, the URI template of a resource template.
- namestring
  The capability's name, as the upstream gives it.
- titlestring
  Human-readable title, when the upstream gives one.
- descriptionstring
  Description, as the upstream gives it.
- annotationsobject
  Tool annotations (hints such as read-only or destructive), as a JSON object, when the upstream gives them.
- input_schemaobject
  Tools: the JSON Schema of the arguments.
- output_schemaobject
  Tools: the JSON Schema of the structured result, when the upstream gives one.
- argumentsobject
  Prompts: the prompt's arguments, as the upstream lists them.
- uristring
  Resources: the resource URI.
- uri_templatestring
  Resource templates: the URI template.
- mime_typestring
  Resources and resource templates: the MIME type, when given.
- schema_hashstring
  SHA-256 of the current definition (hex).
- pinned_schema_hashstring
  SHA-256 of the approved (pinned) definition.
- driftedboolean
  true when the current definition differs from the pinned one. A drifted capability is refused until it is pinned again.
- scannedboolean
  true when the current definition has been scanned for tool poisoning (hidden instructions in its description or schema). false for a definition synced before scanning was available.
- scan_findingsobject
  What the scan found in the current definition: a list of objects with check_type, description and field. Absent when not scanned.
- quarantinedboolean
  true when the scan found tool poisoning and no admin has released this definition: it is refused on calls and hidden from listings.
- released_bystring
  The user who released the current definition despite its findings. Absent unless released.
- released_atstring<date-time>
  When the current definition was released (ISO 8601). Absent unless released.
- is_privilegedboolean
  Tools: true refuses the tool for a caller that received untrusted content recently (a result from a tool not marked trusted_output), unless a person approves that exact call. Tools of OPENAPI and HTTP connectors other than GET and HEAD start privileged.
- requires_approvalboolean
  Tools: true holds every call until a person approves that exact call; the agent's identical retry then goes ahead once.
- trusted_outputboolean
  true: what it returns does not make the caller untrusted. Default false.
- enabledboolean
  Whether the capability is switched on for the connector. A capability that appears after the first sync starts off, and every tool of an OPENAPI or HTTP connector starts off.
- statusenum<string>
  ACTIVE (listed by the upstream on the last sync) or REMOVED.
  One of "ACTIVE", "REMOVED"
- server_enabledboolean
  In a server's listing: whether that server has it switched on. Absent in a connector's listing.
- effective_enabledboolean
  Whether a call to it would be allowed: enabled, active, on for the server, not drifted and not quarantined.
- first_seen_atstring<date-time>
  When a sync first found it (ISO 8601).
- last_seen_atstring<date-time>
  When a sync last found it (ISO 8601).
totalinteger<int64>
How many there are.

VectorAxis is built by GK Labs, a member of NVIDIA Inception.