--- title: "List Catalog" method: GET path: "/api/v1/mcp_server_catalog" tags: ["MCP Servers"] --- # List Catalog `GET /api/v1/mcp_server_catalog` ListCatalog returns all available MCP server catalog entries. ## Query parameters - `page_size` integer — Page size (max 100). - `page_token` string — Page token for pagination. - `query` string — Optional text query to filter catalog entries by display name. ## Response `200` MCPServerServiceListCatalogResponse returns a paginated list of catalog entries. - C1ApiAiGovernanceV1MCPServerServiceListCatalogResponse — MCPServerServiceListCatalogResponse returns a paginated list of catalog entries. - `list` C1ApiAiGovernanceV1MCPServerCatalogEntry[], nullable — List of catalog entries. - `authModes` C1ApiAiGovernanceV1MCPServerCatalogAuthMode[], nullable — Authentication methods this server supports. The first entry is the catalog-prescribed default. Empty when the impl declares no auth. - `authMethod` 'MCP_SERVER_AUTH_METHOD_UNSPECIFIED' | 'MCP_SERVER_AUTH_METHOD_NONE' | 'MCP_SERVER_AUTH_METHOD_BEARER_TOKEN' | 'MCP_SERVER_AUTH_METHOD_OAUTH2' | 'MCP_SERVER_AUTH_METHOD_CUSTOM_HEADER' | 'MCP_SERVER_AUTH_METHOD_AWS_SIGV4' | 'MCP_SERVER_AUTH_METHOD_BASIC_AUTH' — Authentication method enum. UNSPECIFIED entries are dropped on the way out. - `authStyle` string — Credential placement on the OAuth2 token request. Allowed values: "in_params" (form body), "in_header" (HTTP Basic), or empty (autodetect). Set by the impl bundle and shown read-only on the form. - `authorizeUrl` string — OAuth2 authorization endpoint URL. Empty for non-OAuth2 methods. - `clientIdMode` 'MCP_SERVER_CATALOG_CLIENT_ID_MODE_UNSPECIFIED' | 'MCP_SERVER_CATALOG_CLIENT_ID_MODE_MANUAL' | 'MCP_SERVER_CATALOG_CLIENT_ID_MODE_DCR' | 'MCP_SERVER_CATALOG_CLIENT_ID_MODE_CIMD' — How the OAuth2 client_id is acquired for this mode. Set by the impl bundle and shown read-only on the form. authorization_code grant only. - `credentialUrl` string — Documentation URL where the user can obtain a credential for this method (e.g., a link to the SaaS app's "create API token" page). Empty if not set. - `description` string — Optional admin-facing hint describing the use case this mode targets (e.g. "Per user OAuth option"). - `extraAuthorizeParams` object — Static query params the bundle declares for the authorize URL (e.g. Notion `owner=user`). authorization_code grant only. Surfaced read-only so the form can pre-populate its editable copy. - `extraTokenParams` object — Extra body params the bundle declares for the OAuth2 token request (e.g. Auth0/Wiz `audience`). Surfaced read-only so the registration form can pre-populate its editable copy on MCPServerAuthOAuth2. - `header` string — Header name for api_key / custom-header methods. Prefills the form's header-name field. Empty falls back to the C1 default. - `issuerUrl` string — OAuth2 issuer URL (used for OIDC discovery). Empty when not an OIDC issuer. - `jwtAudience` string — JWT-bearer assertion audience when it differs from token_url. - `oauth2Grant` string — OAuth2 grant for this mode. Prefills the form's OAuth2 mode selection. Raw bundle string: "client_credentials", "authorization_code", "jwt_bearer", "google_service_account", or empty (infer from authorize_url). - `optionalScopes` string[], nullable — Optional (opt-in) OAuth2 scopes from the config's optional_scopes. Disjoint from `scopes` and not pre-selected. Empty for non-OAuth2 methods. - `passthrough` boolean — Per-user OAuth: each user authorizes individually instead of sharing a service-level credential. Only meaningful for OAuth2. - `pkce` string — PKCE behavior for authorization_code: "discover" (or empty), "s256", or "disabled". Set by the impl bundle and shown read-only on the form. - `scopes` string[], nullable — OAuth2 scopes requested by this method. Empty for non-OAuth2 methods. - `tokenUrl` string — OAuth2 token endpoint URL. Empty for non-OAuth2 methods. - `baseUrl` string — Connection base URL declared by the impl. May be a ${VAR} template over config_schema fields (e.g. "https://${workspace}.app.n8n.cloud/mcp-server/http"); the UI substitutes the admin's config-field values to preview the resolved endpoint. Empty when the impl declares no base URL. - `channel` 'MCP_SERVER_CATALOG_CHANNEL_UNSPECIFIED' | 'MCP_SERVER_CATALOG_CHANNEL_STABLE' | 'MCP_SERVER_CATALOG_CHANNEL_BETA' | 'MCP_SERVER_CATALOG_CHANNEL_ALPHA' — Release channel for this catalog entry. - `configSchema` C1ApiAiGovernanceV1MCPServerCatalogConfigSchema — MCPServerCatalogConfigSchema describes extra configuration fields beyond auth. - `fields` C1ApiAiGovernanceV1MCPServerCatalogConfigField[], nullable — The fields field. - `default` string — Default value the registration form prefills. Ignored when secret. - `description` string — Help text describing the field. - `displayName` string — Human-readable label for the field. - `name` string — Machine-readable field name (used as the map key in config_fields). - `placeholder` string — Placeholder text shown in an empty input. - `required` boolean — Whether this field must be provided. - `secret` boolean — Whether the field value should be treated as a secret (e.g. masked in UI). - `defaultAuthMethod` 'MCP_SERVER_AUTH_METHOD_UNSPECIFIED' | 'MCP_SERVER_AUTH_METHOD_NONE' | 'MCP_SERVER_AUTH_METHOD_BEARER_TOKEN' | 'MCP_SERVER_AUTH_METHOD_OAUTH2' | 'MCP_SERVER_AUTH_METHOD_CUSTOM_HEADER' | 'MCP_SERVER_AUTH_METHOD_AWS_SIGV4' | 'MCP_SERVER_AUTH_METHOD_BASIC_AUTH' — Deprecated: read auth_modes instead. - `defaultAuthorizeUrl` string — Deprecated: read the OAUTH2 entry's authorize_url from auth_modes instead. - `defaultScopes` string[], nullable — Deprecated: read the OAUTH2 entry's scopes from auth_modes instead. - `defaultTokenUrl` string — Deprecated: read the OAUTH2 entry's token_url from auth_modes instead. - `defaultToolPrefix` string — Curated default tool-name prefix an admin gets when they register this catalog entry and set no custom prefix: the impl's declared server_prefix, else its service_name. Shown as a placeholder in the create wizard's tool prefix field. Empty when the impl declares no curated default. Mirrors the read-only default_tool_prefix on MCPServerView surfaced in the edit flow. - `description` string — Short description of what the MCP server does. - `displayName` string — Human-readable display name. - `iconUrl` string — Icon URL (e.g. "/static/app-icons/datadog.svg"). - `id` string — Opaque catalog entry identifier (27-character KSUID). - `maturity` 'MCP_SERVER_CATALOG_MATURITY_UNSPECIFIED' | 'MCP_SERVER_CATALOG_MATURITY_STUB' | 'MCP_SERVER_CATALOG_MATURITY_GENERATED' | 'MCP_SERVER_CATALOG_MATURITY_VERIFIED' | 'MCP_SERVER_CATALOG_MATURITY_CURATED' — Implementation maturity level. - `scope` 'MCP_SERVER_CATALOG_SCOPE_UNSPECIFIED' | 'MCP_SERVER_CATALOG_SCOPE_BUSINESS' | 'MCP_SERVER_CATALOG_SCOPE_EXCLUDED' | 'MCP_SERVER_CATALOG_SCOPE_UNDETERMINED' — Implementation scope classification. - `serviceName` string — mcpgw impl service name (e.g., "datadog", "github"). Stable across display-name changes; suitable for grouping entries that share an impl and for matching catalog entries to a host app. For tunneled HOSTED registrations the appliance must announce a HOSTED port whose Name field matches this string — that's how the wormhole DialByName at runtime resolves the right port on the appliance. - `stable` boolean — Whether this catalog entry is stable (true) or early access (false/default). Deprecated: use channel instead. - `supportedOauth2Modes` string[], nullable — OAuth2 modes supported by this server. When non-empty, the frontend shows only these modes in the dropdown. When empty, all modes are shown. - `nextPageToken` string — Token for next page. --- [API](https://skmtc.net/conductorone/apis/c1-api.md) · [All operations](https://skmtc.net/conductorone/apis/c1-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/conductorone/c1-api/revisions/f2cf3228f366/schema)