portkey-admin-mcp

update_deployment

Modify a registered Gateway deployment's settings, workspace or JWT-sub access, or rotate its authentication secret. Inspect current configuration first; Enterprise plans only.

Instructions

Enterprise-gated. Update a registered Gateway deployment, its workspace or JWT-sub access, or rotate its authentication secret. Use get_deployment first to inspect current settings. Rotation returns the new secret once in this MCP transcript, so store it securely immediately. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans.

Input Schema

TableJSON Schema

Name	Required	Description
`id`	Yes	Deployment UUID
`name`	No	Replacement display name
`tags`	No	Replacement deployment tags, or null to clear all tags
`type`	No	Replacement deployment type
`status`	No	Replacement deployment status
`is_default`	No	Whether this is the default deployment
`rotate_auth`	No	Rotate the one-time deployment authentication secret
`gateway_base_url`	No	Self-hosted Gateway base URL
`jwt_subs_allowed`	No	JWT subject values allowed to use the deployment
`deployment_config`	No	Replacement Gateway configuration, or null to clear it
`override_existing`	No	Allow replacement of existing deployment settings
`workspaces_allowed`	No	Workspace slugs this deployment may serve; empty allows all
`remove_subs_allowed`	No	JWT subject values to remove from the allowlist
`allow_all_workspaces`	No	Clear workspace restrictions and allow every workspace
`mcp_gateway_base_url`	No	MCP Gateway base URL
`is_dataservice_hosted`	No	Whether the deployment hosts its own data service
`jwt_sub_workspace_mapping`	No	JWT subject to workspace-slug mapping
`remove_workspaces_allowed`	No	Workspace slugs to remove from the allowlist
`is_playground_proxy_allowed`	No	Whether Playground proxy traffic is allowed

Output Schema

TableJSON Schema

Name	Required	Description
`ok`	Yes	Whether the tool call succeeded and returned structured data
`data`	No	Structured success payload when ok is true
`error`	No	Structured error payload when ok is false

Schema Changelog

Changes observed during successful MCP inspections.

Changed1 schema field changedv0.12.2Oct 2, 2026

addedInput schema / properties / tags

Added value: +{
+  "anyOf": [
+    {
+      "additionalProperties": {
+        "type": "string"
+      },
+      "propertyNames": {
+        "pattern": "^[a-zA-Z0-9_-]+$",
+        "type": "string"
+      },
+      "type": "object"
+    },
+    {
+      "type": "null"
+    }
+  ],
+  "description": "Replacement deployment tags, or null to clear all tags"
+}

Addedv0.11.5Sep 8, 2026

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the annotations: Enterprise-plan gating with a 403 failure mode, the one-time-only nature of the rotated secret (returned once in this transcript, must be stored immediately), and the recommended inspection step. The single-use secret disclosure is exactly the kind of behavioral trait an agent cannot infer from readOnlyHint/destructiveHint/idempotentHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the gate and the core purpose, then adds the prerequisite and the critical rotation warning. Marks are lost only for the verbatim repetition of "Enterprise-gated" as the first and second-to-last sentence, which wastes space in an otherwise tight description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the description covers gating, prerequisite, and the highest-risk side effect (secret rotation). For a 19-parameter mutation tool it is nearly complete, though it does not flag that allowlist changes affect which workspaces/subjects can currently reach the deployment.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description goes modestly beyond by calling out rotation behavior (the rotate_auth consequence) and the workspace/JWT-sub allowlist edits, but it does not explain the clear/remove semantics of parameters like override_existing, allow_all_workspaces, or the remove_* arrays.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (update) plus resource (registered Gateway deployment) and enumerates the distinct facets it mutates: workspace/JWT-sub access and authentication-secret rotation. This clearly separates it from register_deployment, list_deployments, get_deployment, and archive_deployment without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Use get_deployment first to inspect current settings" gives an explicit prerequisite and workflow context. It does not state when NOT to use this tool or name a sibling alternative (e.g. archive_deployment for status changes), so it falls short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server