How do I use portkey-admin-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@portkey-admin-mcp list all users in my organization" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

de en es ja ko ru zh

portkey-admin-mcp

by CodesWhat

Overview Schema Related Servers Score Discussions

TypeScript

Hybrid

The Portkey Admin MCP Server provides 151 tools for managing Portkey AI infrastructure through the Model Context Protocol (MCP), enabling comprehensive administration across the following areas:

👥 User & Access Management — Invite, list, update, and delete users; manage pending invitations; retrieve user activity statistics; control role-based permissions.

🏢 Workspace Management — Create, configure, and delete workspaces; manage workspace members and their roles (admin, manager, member).

⚙️ Gateway Configuration — Set up and manage configs with load balancing, fallback routing, simple/semantic caching, and retry policies; view version history.

🔑 API & Virtual Key Management — Create and manage Portkey API keys (org-level and workspace-scoped) and virtual keys for securely storing AI provider credentials (OpenAI, Anthropic, Azure, Google, etc.).

📝 Prompt Management — Create, version, publish, render, and execute prompt templates with variable substitution and tool/function definitions; organize into collections; manage reusable partials and labels; migrate and promote prompts across environments (dev → staging → prod).

🛡️ Governance & Safety — Create and manage guardrails for content moderation and security; set usage limits (tokens, requests, cost) on daily/weekly/monthly periods; configure rate limits.

📊 Analytics & Reporting — Query time-series analytics for cost, requests, token usage, latency, errors, cache hit rates, feedback scores, and user activity; group by user, model, or metadata.

📋 Logging & Observability — Insert custom log entries; create and manage log export jobs; retrieve detailed trace information; create and update feedback on AI generations; view audit logs for all administrative actions.

🔌 Integrations & Providers — Manage custom AI providers, third-party integrations, MCP server registrations, and workspace access configurations.

The server supports deployment via npx, Docker, or self-hosting, with HTTP/HTTPS transports, stateful/stateless modes, and bearer/Clerk authentication. It integrates with Claude Code, Cursor, Windsurf, and VS Code. Enterprise features (full analytics, log exports, audit logs) require a Portkey Enterprise plan.

The full Portkey Admin API as an MCP server — 156 tools across prompts, configs, keys, analytics, and more.

IMPORTANT

Maintenance mode. Portkey was acquired by Palo Alto Networks (completed 2026‑05‑29) and is being folded into the Prisma AIRS platform. The Portkey Admin API this server targets is live and unchanged as of June 2026, and this project still works end‑to‑end — but it is now in maintenance mode: security and dependency patches only, no new features, pending Palo Alto's post‑acquisition API roadmap. If the hosted Admin API is ever deprecated, point PORTKEY_BASE_URL at a self‑hosted Portkey gateway. See docs/audit-2026-06.md for the full assessment and security_best_practices_report.md for the 0.6.0 security-hardening review.

You need a Portkey API key with appropriate scopes. Get one from your Portkey dashboard under API Keys.

Claude Code

claude mcp add -e PORTKEY_API_KEY=your_key portkey-admin -- npx -y portkey-admin-mcp

Cursor / Windsurf / VS Code

Add to your MCP config (.cursor/mcp.json, .windsurf/mcp.json, or .vscode/mcp.json):

{
  "mcpServers": {
    "portkey-admin": {
      "command": "npx",
      "args": ["-y", "portkey-admin-mcp"],
      "env": {
        "PORTKEY_API_KEY": "your_api_key"
      }
    }
  }
}

Run directly

PORTKEY_API_KEY=your_key npx -y portkey-admin-mcp

To expose only a focused subset of tools in stdio clients, set PORTKEY_TOOL_DOMAINS:

PORTKEY_API_KEY=your_key \
PORTKEY_TOOL_DOMAINS=prompts,analytics \
npx -y portkey-admin-mcp

git clone https://github.com/CodesWhat/portkey-admin-mcp.git
cd portkey-admin-mcp
npm install && npm run build

Then use this config:

{
  "mcpServers": {
    "portkey-admin": {
      "command": "node",
      "args": ["/path/to/portkey-admin-mcp/build/index.js"],
      "env": {
        "PORTKEY_API_KEY": "your_api_key"
      }
    }
  }
}

Category	Tools	Examples
Prompts	14	Create, version, render, execute, migrate, promote prompts
Prompt Partials	7	Reusable prompt fragments with versioning
Prompt Labels	5	Organize prompt versions (production, staging, dev)
Configs	6	Gateway routing, caching, retry, loadbalancing
API Keys	6	Create, rotate, and manage scoped API keys
Secret References	5	Manage AWS, Azure, and HashiCorp external-secret references
Virtual Keys	5	Manage provider access keys
Collections	5	Group prompts by app or project
Providers	5	Manage AI provider configurations
Integrations	10	Provider integrations, models, workspace access
MCP Integrations	10	External MCP tool integrations
MCP Servers	10	MCP server registry and capabilities
Guardrails	5	Content safety policies
Usage Limits	7	Cost and token consumption limits
Rate Limits	5	Request frequency controls
Analytics	20	Cost, latency, errors, tokens, cache, feedback
Logging	8	Log ingestion and export
Tracing	2	Feedback creation and updates on traces
Users & Workspaces	20	User management, invites, workspace members
Audit	1	Audit log access

156 tools total. See ENDPOINTS.md for the full list with descriptions.

Most tools work with a workspace-scoped service key that has Select All permissions enabled. That covers prompts, configs, virtual/API keys, providers, guardrails, workspace integrations, MCP servers, rate/usage limits, logs, prompt completions, and workspace user management.

Enterprise-gated tools (28)

The following tools require an organisation-level scope that is only available on Portkey Enterprise plans. They return 403 You do not have enough permissions to execute this request on workspace plans. Their descriptions include an Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. suffix so MCP clients know upfront.

Area	Tools	Required scope
Analytics (20)	`get_cost_analytics`, `get_request_analytics`, `get_token_analytics`, `get_latency_analytics`, `get_error_analytics`, `get_error_rate_analytics`, `get_cache_hit_latency`, `get_cache_hit_rate`, `get_users_analytics`, `get_error_stacks_analytics`, `get_error_status_codes_analytics`, `get_user_requests_analytics`, `get_rescued_requests_analytics`, `get_feedback_analytics`, `get_feedback_models_analytics`, `get_feedback_scores_analytics`, `get_feedback_weighted_analytics`, `get_analytics_group_users`, `get_analytics_group_models`, `get_analytics_group_metadata`	org-level `analytics.view`
Audit	`list_audit_logs`	`audit_logs.list`
Org-level integrations	`get_integration`, `list_integration_models`, `list_integration_workspaces`	`organisation_integrations.read`
Org-level users	`list_all_users`, `get_user`, `get_user_stats`, `list_user_invites`	`organisation_users.list` / `organisation_users.read`

Other scope requirements

Feature	Required
Prompt completions (`run_prompt_completion`)	`completions.write` scope + billing metadata (`app`, `env`)
Org-level service API key creation via `create_api_key`	`organisation_service_api_keys.create` (Enterprise)

If a tool returns a 403 with Portkey error AB03, it means missing scopes — not a broken endpoint.

Status: The HTTP transport works locally and is covered by the integration test suite, but it is a proof of concept — there is no hosted version of this server, and hosted deployment is not currently a goal. Use stdio (npx) as the supported transport.

The server supports Streamable HTTP for remote access:

PORTKEY_API_KEY=your_key \
MCP_HOST=127.0.0.1 \
MCP_PORT=3000 \
MCP_PUBLIC_BASE_URL=https://mcp.example.com \
MCP_AUTH_MODE=bearer \
MCP_AUTH_TOKEN=your_secret \
node build/server.js

Or via npx (the portkey-admin-mcp package includes the HTTP binary):

PORTKEY_API_KEY=your_key MCP_AUTH_MODE=bearer MCP_AUTH_TOKEN=your_secret \
  npx -y -p portkey-admin-mcp portkey-admin-mcp-http

For local-only HTTP use, leave MCP_HOST at its default 127.0.0.1. Set MCP_HOST=0.0.0.0 only when you intentionally need to accept connections from outside the local machine, such as Docker or a reverse proxy on another interface.

Configuration

Variable	Default	Description
`PORTKEY_API_KEY`	(required)	Your Portkey API key
`PORTKEY_BASE_URL`	`https://api.portkey.ai/v1`	Portkey Admin API base URL. Credentialed requests never auto-follow redirects
`PORTKEY_ALLOW_PRIVATE_BASE_URL`	—	Set to `true` to allow a literal loopback/private `PORTKEY_BASE_URL`
`PORTKEY_ALLOW_INSECURE_HTTP`	—	Separately set to `true` only when a trusted self-hosted gateway cannot use HTTPS
`PORTKEY_TOOL_DOMAINS`	—	Server-side tool-domain allowlist. HTTP `?tools=` may narrow this set but cannot expand it
`MCP_HOST`	`127.0.0.1`	Bind address
`MCP_PORT`	`3000`	Port
`MCP_PUBLIC_BASE_URL`	—	Public absolute base URL to advertise from `/auth/info` and the status page; recommended for hosted deployments
`MCP_AUTH_MODE`	`none`	`none`, `bearer`, or `clerk` (`none` is blocked for HTTP unless explicitly overridden)
`MCP_AUTH_TOKEN`	—	Secret for bearer auth
`CLERK_ISSUER` / `CLERK_AUDIENCE`	—	Required issuer and audience when `MCP_AUTH_MODE=clerk`
`CLERK_ALLOWED_SUBJECTS`	—	Optional CSV subject allowlist for Clerk; at least one Clerk authorization policy is required
`CLERK_ALLOWED_ORGANIZATION_IDS` / `CLERK_ALLOWED_ROLES`	—	Optional CSV organization and role constraints; every configured constraint must match
`CLERK_REQUIRED_PERMISSIONS`	—	Optional CSV permissions that must all be present in the verified Clerk JWT
`MCP_ALLOW_UNAUTHENTICATED_HTTP`	—	Set to `true` only for intentional local unauthenticated HTTP debugging
`MCP_SESSION_MODE`	`stateful`	`stateful` or `stateless`
`MCP_MAX_SESSIONS`	`100`	Maximum concurrent stateful sessions or active stateless request handlers
`MCP_EVENT_STORE`	`off`	`off`, `memory`, or `redis`; stateless `GET /mcp` replay requires `memory` or `redis`
`MCP_EVENT_TTL_SECONDS`	`300`	Replay retention in seconds
`MCP_REDIS_URL`	—	Redis URL for shared event store; production requires `rediss://` and ACL-scoped credentials
`MCP_EVENT_ENCRYPTION_KEY`	—	Required 32-byte base64 AES key for Redis replay payloads; generate with `openssl rand -base64 32`
`MCP_REDIS_KEY_PREFIX`	`mcp:event-store`	Dedicated Redis namespace for replay data
`MCP_TLS_KEY_PATH`	—	TLS key for native HTTPS
`MCP_TLS_CERT_PATH`	—	TLS cert for native HTTPS
`ALLOWED_ORIGINS`	—	CORS allow-list; also used to validate the `Host` header (DNS-rebinding protection) when `MCP_AUTH_MODE=none`
`MCP_TRUST_PROXY`	`false`	Trust proxy headers (for reverse proxies)
`RATE_LIMIT_STORE`	`memory`	`redis` for multi-instance/serverless deployments; production memory mode requires `RATE_LIMIT_SINGLE_PROCESS=true`
`RATE_LIMIT_REDIS_URL`	—	Shared limiter Redis URL, falling back to `MCP_REDIS_URL`/`REDIS_URL`; production requires `rediss://`
`RATE_LIMIT_REDIS_KEY_PREFIX`	`mcp:rate-limit`	Redis namespace for atomic pre-authentication IP and principal-plus-IP token buckets
`RATE_LIMIT_MAX_BUCKETS`	`10000`	Maximum local buckets in explicit memory mode before new clients share overflow capacity

Production containers must choose their rate-limit topology explicitly: set RATE_LIMIT_STORE=redis for multi-instance deployments, or set RATE_LIMIT_SINGLE_PROCESS=true only for a single long-lived process.

Vercel support is kept as a reference proof of concept — we do not run a hosted deployment. See docs/VERCEL_DEPLOYMENT.md if you want to self-deploy.

Key points:

Uses stateless request handling with encrypted, principal-bound Redis replay and a shared atomic Redis rate limiter
Requires Clerk or bearer auth
Leave MCP_TLS_* unset (Vercel terminates HTTPS)
Set MCP_PUBLIC_BASE_URL to your deployment URL so advertised MCP endpoints never depend on request headers
Vercel does not support WebSockets — Streamable HTTP/SSE only

docker build -t portkey-admin-mcp .
docker run \
  -e PORTKEY_API_KEY=your_key \
  -e MCP_TRANSPORT=http \
  -e MCP_HOST=0.0.0.0 \
  -e MCP_PORT=3000 \
  -e MCP_AUTH_MODE=bearer \
  -e MCP_AUTH_TOKEN=your_secret \
  -p 3000:3000 \
  portkey-admin-mcp

Health Endpoints

Path	Purpose
`GET /health`	Server liveness
`GET /ready`	Readiness (includes optional Portkey connectivity check)
`GET /auth/info`	Auth configuration metadata

npm run dev           # stdio with hot reload
npm run dev:http      # HTTP with hot reload
npm test              # unit + contract tests
npm run test:e2e      # MCP protocol tests
npm run test:http     # HTTP endpoint smoke test
npm run ci            # full pipeline (lint + typecheck + test + build + e2e + verify)

npm run dev:http now requires MCP_AUTH_MODE=bearer or MCP_AUTH_MODE=clerk by default. For deliberate local-only unauthenticated testing, set MCP_ALLOW_UNAUTHENTICATED_HTTP=true.

Built With

TypeScript MCP SDK Zod 4 Biome Node 24 Anthropic

SemVer Conventional Commits Keep a Changelog

MIT License · Inspired by r-huijts/portkey-admin-mcp-server

Sponsor

Install Server

license - permissive license

quality

maintenance

How are these scores calculated?

Maintenance

–Maintainers

7dResponse time

1wRelease cycle

12Releases (12mo)

Commit activity

Issues opened vs closed

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Tools

View all tools

Related MCP Servers

Portkey MCP Server
Cloud Platforms Monitoring Developer Tools
r-huijts
A
license
A
quality
D
maintenance
Connects Claude to Portkey's API for managing AI configurations, workspaces, analytics, and user access, providing comprehensive control over API usage and settings.
Last updated 2025-08-26
9
3
MIT
agentforge
Agent Orchestration AI & Machine Learning
doggychip
F
license
A
quality
F
maintenance
MCP server that exposes 300+ AI agents as tools via a single API key. Supports listing agents, invoking any agent with chat-completion style messages, checking agent health, and retrieving platform statistics.
Last updated 2026-04-21
5
3
litellm-admin-mcp
AI & Machine Learning Security
junwayne66
F
license
-
quality
B
maintenance
Exposes LiteLLM Proxy admin APIs as MCP tools for managing internal users, virtual keys, and spend logs via streamable-http, enabling agents to administer LiteLLM without custom HTTP glue.
Last updated 2026-06-09
1
litellm-mcp
AI & Machine Learning Developer Tools
weeebdev
A
license
-
quality
C
maintenance
MCP server that provides tools to interact with the LiteLLM proxy API, enabling LLM completions, embeddings, image generation, and admin operations.
Last updated 2026-06-09
21
MIT

View all related MCP servers

Related MCP Connectors

mcp-server
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
ToolAPI
Free public MCP for AI agents — 193 tools, 44 workflows. No API key.
royal-mcp
Security-first WordPress MCP server. 129 tools for Claude, ChatGPT, Gemini. Free on wp.org.

View all MCP Connectors

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/CodesWhat/portkey-admin-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server