---
title: "Get Project Key Mcp Config"
method: GET
path: "/project-keys/{project_key_id}/mcp-config"
tags: ["Project Keys"]
---

# Get Project Key Mcp Config

`GET /project-keys/{project_key_id}/mcp-config`

Returns authoritative MCP tool scoping config for server-side enforcement.

Called by the MCP server on session start to verify tool_profile, allowed_tools,
and blocked_tools - preventing credential file tampering.

## Path parameters

- `project_key_id` string, required

## Response `200`

Successful Response

- ProjectKeyMcpConfig — Authoritative MCP tool scoping config for server-side enforcement. Includes identity fields (tenant_id, service_id, kafka_username) so the MCP server can enrich audit logs with verified context without trusting the credential file.
  - `project_key_id` string, required
  - `tenant_id` string, required
  - `service_id` string, required
  - `kafka_username` string, nullable
  - `tool_profile` 'full' | 'read-only' | 'agent-operator' | 'infra-admin'
  - `allowed_tools` string[], nullable
  - `blocked_tools` string[], nullable

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/streamkap/apis/streamkap-rest-api.md) · [All operations](https://skmtc.net/streamkap/apis/streamkap-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/streamkap/streamkap-rest-api/versions/8aea6143d003/schema)