MCP server registry API reference

The MCP server registry is a read-only API that lists an environment's MCP servers in the format defined by the MCP Registry v0.1 specification. This article covers its endpoints, authentication, responses, and the ways it differs from the specification. To learn what the registry is for and what it lists for each caller, see Discover MCP servers with the MCP server registry.

Base URL

https://<API host>/mcp/<MCP account alias>/registry/v0.1

The API host depends on the region you sign in to:

Each environment has its own MCP account alias and therefore its own registry. Only paths under /registry/v0.1/ are registry resources. A request to /mcp/<MCP account alias>/registry alone isn't a registry request and returns an error.

Endpoints

{serverName} is a server's registry name, such as com.celigo.acme-corp-prod/support-tools. URL-encode it, as the specification recommends, so that / becomes %2F.

The registry has no write endpoints. Create and change MCP servers in AI studio > MCP servers or with /v1/mcpservers.

Authentication

Send a credential in the Authorization header as a bearer token:

Authorization: Bearer <token>

The registry accepts:

• API tokens, with Full access or Custom access.
• Personal access tokens.
• Access tokens from a Celigo Identity sign-in.

A token that your own identity provider issues for an MCP server that uses Token validation isn't accepted.

What each credential lists is described in What the registry lists for each caller in Discover MCP servers with the MCP server registry. A credential from a different account, or from a different environment than the alias in the URL, gets an empty list.

Sign in with OAuth

A request with no credential, or with one that's invalid, expired, or revoked, gets 401 Unauthorized with this header:

WWW-Authenticate: Bearer resource_metadata="https://api.integrator.io/.well-known/oauth-protected-resource/mcp/acme-corp-prod/registry"

The header points to the registry's protected resource metadata (RFC 9728), which names Celigo Identity as the authorization server:

{
  "resource": "https://api.integrator.io/mcp/acme-corp-prod/registry",
  "authorization_servers": ["<Celigo Identity issuer URL for your region>"],
  "scopes_supported": ["mcp:read"],
  "bearer_methods_supported": ["header"],
  "resource_signing_alg_values_supported": ["RS256"]
}

A client that supports MCP authorization reads this document, signs the person in through Celigo Identity, and repeats the request with the access token. A client can also fetch the document directly, without waiting for a challenge. The document doesn't require a credential, and responses can be cached for up to one hour.

List servers

GET /mcp/<MCP account alias>/registry/v0.1/servers

Query parameters

The registry doesn't support updated_since or include_deleted. A request that includes either gets 400 Bad Request.

Response

200 OK with this body:

A credential that can't connect to any servers gets { "servers": [], "metadata": { "count": 0 } }.

Example

curl -H "Authorization: Bearer <your token>" \
  "https://api.integrator.io/mcp/acme-corp-prod/registry/v0.1/servers?limit=2"

{
  "servers": [
    {
      "server": {
        "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
        "name": "com.celigo.acme-corp-prod/billing-tools",
        "title": "Billing tools",
        "description": "Invoice lookup and payment status for the finance team.",
        "version": "1.0.0",
        "remotes": [
          {
            "type": "streamable-http",
            "url": "https://api.integrator.io/mcp/acme-corp-prod/billing-tools",
            "headers": [
              {
                "name": "Authorization",
                "description": "Bearer token for the MCP server.",
                "isRequired": true,
                "isSecret": true
              }
            ]
          }
        ]
      },
      "_meta": {
        "io.modelcontextprotocol.registry/official": {
          "status": "active",
          "publishedAt": "2026-05-11T16:20:00.000Z",
          "updatedAt": "2026-09-30T08:02:41.000Z",
          "statusChangedAt": "2026-05-11T16:20:00.000Z",
          "isLatest": true
        },
        "io.celigo.registry/entry": {
          "visibility": "entitled",
          "access": "entitled"
        }
      }
    }
  ],
  "metadata": {
    "count": 2,
    "nextCursor": "<opaque cursor value>"
  }
}

The example shows only the first of the two entries.

List a server's versions

GET /mcp/<MCP account alias>/registry/v0.1/servers/{serverName}/versions

Returns 200 OK with the same shape as List servers. The list holds exactly one entry, or no entries when the server doesn't exist or the caller can't see it.

Get a server version

GET /mcp/<MCP account alias>/registry/v0.1/servers/{serverName}/versions/{version}

{version} is latest or 1.0.0, and both return the same entry. The response is 200 OK with one server entry, not wrapped in a servers array.

The response is 404 Not Found when the server doesn't exist, when the caller can't see it, or when {version} is any other value. The response is identical in all three cases.

Server entry

Each server entry has two parts, server and _meta.

server

_meta

Treat visibility and access as open sets: accept values that aren't listed here.

Errors

Error responses use application/problem+json (RFC 9457):

{
  "type": "about:blank",
  "title": "Not Found",
  "status": 404,
  "detail": "Server not found.",
  "instance": "/mcp/acme-corp-prod/registry/v0.1/servers/com.celigo.acme-corp-prod%2Fpayroll-tools/versions/latest"
}

Every registry response includes an X-Request-Id header. Include its value when you contact Celigo support about a request.

CORS

Registry responses include CORS headers for browser-based clients, and the exposed headers include WWW-Authenticate. Send the token in the Authorization header. The registry doesn't use cookies.

Differences from the MCP Registry v0.1 specification

• No incremental sync. updated_since and include_deleted return 400 Bad Request, and deleted servers are never returned. Read the full list periodically, and compare each entry's updatedAt.
• One version per server. Every server is version 1.0.0, and latest returns the same entry. The entry always describes the server's current configuration.
• Search includes titles. search matches title as well as name.
• Read-only. The specification's publish, edit, and authentication endpoints aren't available, and neither are its optional /v0.1/health, /v0.1/ping, /v0.1/version, and /v0.1/validate endpoints.
• Problem details for errors. Error bodies use application/problem+json.

Related articles

• Discover MCP servers with the MCP server registry
• Create and manage API and Personal Access tokens
• Set up authentication for an MCP server
• MCP Registry v0.1 API specification