Nginx Proxy Manager MCP

Overview Schema Source Related Servers Discussions Admin

Update Access List

update_access_list

Modify an existing access list by ID to change client allow/deny rules, basic-auth users, name, and auth settings. Preview changes with dry_run before applying them in Nginx Proxy Manager.

Instructions

Update writable fields on an existing access list by ID, including client rules and basic-auth users. Use this to edit access controls; use delete_access_list to remove a list. NPM receives the merged writable fields; item passwords are write-only and cannot be read back. Returns the updated list object with its name and rules. Set dry_run=True to preview the exact request without changing NPM.

Input Schema

TableJSON Schema

Name	Required	Description
`id`	Yes	ID of the access list, from the matching list tool.
`name`	No	Human-readable name for this access list. For updates, omit to keep the current value.
`items`	No	Basic-auth users as username/password pairs; passwords are write-only in NPM. For updates, omit to keep the current value.
`clients`	No	IP or network rules; each directive must be allow or deny. For updates, omit to keep the current value.
`dry_run`	No	When True, return the exact request preview without changing NPM.
`pass_auth`	No	Whether NPM passes basic-auth credentials upstream. For updates, omit to keep the current value.
`satisfy_any`	No	Whether satisfying any configured access rule is sufficient. For updates, omit to keep the current value.

Output Schema

TableJSON Schema

Name	Required	Description	Default
No arguments

Schema Changelog

Changes observed during successful MCP inspections.

Changed7 schema fields changedv0.5.2Oct 16, 2026

addedInput schema / properties / clients / description

Added value: +"IP or network rules; each directive must be allow or deny. For updates, omit to keep the current value."

addedInput schema / properties / dry_run / description

Added value: +"When True, return the exact request preview without changing NPM."

addedInput schema / properties / id / description

Added value: +"ID of the access list, from the matching list tool."

addedInput schema / properties / items / description

Added value: +"Basic-auth users as username/password pairs; passwords are write-only in NPM. For updates, omit to keep the current value."

addedInput schema / properties / name / description

Added value: +"Human-readable name for this access list. For updates, omit to keep the current value."

addedInput schema / properties / pass_auth / description

Added value: +"Whether NPM passes basic-auth credentials upstream. For updates, omit to keep the current value."

addedInput schema / properties / satisfy_any / description

Added value: +"Whether satisfying any configured access rule is sufficient. For updates, omit to keep the current value."

First observedv0.5.1Oct 16, 2026

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that NPM receives merged writable fields, that item passwords are write-only and unreadable, that dry_run previews the request, and that the updated object is returned. It omits auth/permission requirements needed to perform the update.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tightly scoped sentences, front-loaded with purpose then alternative then behavior. Minor redundancy between the items/clients mention in sentence one and the schema-level detail, but no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-param mutation tool with an output schema, the description covers the operation, merge semantics, write-only constraint, and dry_run. The only real gap is permission/auth prerequisites, which annotations would normally supply but here are absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all seven parameters are already documented — including write-only passwords, dry_run, and the 'omit to keep current value' semantics. The description largely restates items/clients and the dry_run behavior, adding little beyond the schema baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Update'), resource ('an existing access list by ID'), and the writable surface ('client rules and basic-auth users'), so an agent can immediately distinguish it from list/get/create siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: 'Use this to edit access controls; use delete_access_list to remove a list,' and adds a dry_run preview path. It stops short of contrasting with create_access_list, but 'existing access list by ID' implies the boundary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.