Skip to content
MCP Gateway

Validate MCP server or API source manifests without publishing them.

POST
/v1/registry/validate-manifest

Authorizations

Section titled “Authorizations ”

Request Body required

Section titled “Request Body required ”
object
manifest
required
object
schema_version
required
server_id
required
string
>= 1 characters
name
required
string
>= 1 characters
tenant_id
required
string
>= 1 characters
owner
required
object
team
required
string
>= 1 characters
user_id
required
string
>= 1 characters
escalation_contact
required
string
>= 1 characters
oncall_rotation
required
string
>= 1 characters
environment_id
required
string
>= 1 characters
endpoint
string format: uri
/^https:///
transport
required
One of:
version
required
string
>= 1 characters
registration_status
required
Allowed values: registered disabled deprecated
credential_mode
required
Allowed values: service_account user_delegated agent_scoped workload_mapped
requested_approval_status
required
Allowed values: submitted under_review
docs_url
required
string format: uri
tools
required
Array<object>
>= 1 items
object
tool_id
required
string
>= 1 characters
name
required
string
>= 1 characters
description
required
string
>= 1 characters
risk_tier
required
Allowed values: low medium high critical
gateway_status
required
Allowed values: allowed denied_candidate
denied_reason
string
/^[a-z0-9_]+$/
input_schema_ref
required
string
>= 1 characters
input_schema

Sanitized MCP tool input schema preserved in the approved snapshot and runtime projection.

object
policy_refs
required
Array<string>
>= 1 items
schemaRef
string

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Manifest validation result. Semantic validation failures, including policy ref failures, return 200 with valid=false and errors[].

object
valid
required
boolean
schema_ref
required
string
>= 1 characters
rejects_arbitrary_api_exposure
required
boolean
secrets_redacted
required
boolean
errors
required
Array<object>
object
reason_code
required
string
/^[a-z0-9_]+$/
field
required
string
>= 1 characters
message
required
string
>= 1 characters

Type set in Geist, Source Serif 4, and Departure Mono.