mcp-servers
Customer-built MCP (Model Context Protocol) server resources that expose a chosen slice of Celigo Tools and builder-mode APIs as an MCP endpoint for external AI clients (Cursor, Claude, ChatGPT, Windsurf, and anything else that speaks MCP).
What the UI calls Capability Sets is stored as permissionSets[] — an embedded array on the MCP server document, not a top-level resource. Each entry is {_id, name, description?, accessLevel: read|write, _toolIds[], _apiIds[]}; the server generates _id, which is the stable handle end-user grants reference as pset:<_id> (alongside tool:<id|all>, which also covers prompts via prompts[]._id, and api:<id|all>).
⚠️ PUT erases capability sets. The server resets
permissionSetsto[]on any full PUT that omits it — anupdatewhose body lacks the field silently deletes every capability set and orphans everypset:grant that pointed at one (older documents omit the key on GET entirely, so the omission is easy to miss). Preferset:name/disabledapply as an atomic PATCH, and every other field goes GET + modify + PUT with the complete document, which preserves them.
REST API: MCP Servers
celigo mcp-servers <subcommand> [args] [flags]Supports all global flags.
Subcommands
list
List every MCP server on the account.
get <id>
Fetch one MCP server by ID.
create
Create from a JSON body (--file <path> or stdin).
update <id>
Full PUT replace from a JSON body (--file <path> or stdin).
set <id> <key=value>...
Safe field edit: name/disabled via atomic PATCH, everything else GET + modify + PUT. Supports key=file://<path>.
delete <id>
Delete an MCP server.
dependencies <id> (alias used-by)
List resources that depend on this MCP server.
audit <id>
Show the MCP server's audit log (change history).
effective-access <id>
Compile every end user who can reach this server, with each grant's source.
assign-end-users <id> <ashareIds...>
Bulk-assign the server's capabilities to end users (replaces each listed user's grant).
assign-groups <id> <groupIds...>
Bulk-assign the server's capabilities to end-user groups (replaces each listed group's grant).
celigo mcp-servers list
List every MCP server configured on the account.
Signature
Arguments
None.
Flags
None beyond global flags.
Example
Corresponds to: GET /v1/mcpservers (operationId: listMcpServers).
celigo mcp-servers get
Fetch a single MCP server by ID, including its tools, APIs, and override settings.
Signature
Arguments
<id>
string
Yes
MCP server ID.
Flags
None beyond global flags.
Example
Corresponds to: GET /v1/mcpservers/{_id} (operationId: getMcpServerById).
celigo mcp-servers create
Create an MCP server from a JSON body. Read the body from a file with -f, --file (recommended), or pipe it on stdin. Servers are created disabled by default; at least one tool or API must be enabled before the server itself can be enabled.
Signature
Arguments
None.
Flags
-f, --file <path>
string
—
Read the JSON body from a file instead of stdin (--file - also means stdin). Added in celigo-cli 2026.6.1.
Request body
A JSON object matching the POST /v1/mcpservers request schema, including the tools[], apis[], annotations, and override fields.
Example
Corresponds to: POST /v1/mcpservers (operationId: createMcpServer).
celigo mcp-servers update
Full PUT replace of an MCP server from a JSON body (--file <path> or stdin). Omitted fields are erased — round-trip via get first, or prefer set for targeted edits.
⚠️
updatereplaces the entire MCP server. Any field you omit from the body is erased, includingtools[]andapis[]— and a body that omitspermissionSetserases every capability set (the API resets the field to[]), orphaning everypset:grant that points at one. Include the completepermissionSetsarray in the body, or preferset, which round-trips the full document and preserves them.
Signature
Arguments
<id>
string
Yes
MCP server ID.
Flags
-f, --file <path>
string
—
Read the JSON body from a file instead of stdin (--file - also means stdin). Added in celigo-cli 2026.6.1.
--force
boolean
false
Submit even if the body contains masked credential values (***) copied from a GET.
Request body
A JSON object matching the PUT /v1/mcpservers/{_id} request schema.
Example
Corresponds to: PUT /v1/mcpservers/{_id} (operationId: updateMcpServer).
celigo mcp-servers set
Safe field edit. Whitelisted fields (name, disabled) are applied via an atomic PATCH; every other field goes GET + in-memory mutation + PUT with the complete document — which preserves permissionSets, unlike a hand-written update body. Dot notation and array indexing are supported. A null RHS removes the field (or splices an array element). A key=file://<path> value loads that field's value from a file instead of the command line (a leading ~ and relative paths are supported).
Signature
Arguments
<id>
string
Yes
MCP server ID.
<key=value>...
string (variadic)
Yes
One or more assignments, e.g. disabled=false or tools[0].disabled=true.
Flags
None beyond global flags.
Example
Corresponds to: GET /v1/mcpservers/{_id} + PUT /v1/mcpservers/{_id} (operationIds: getMcpServerById, updateMcpServer).
celigo mcp-servers delete
Delete an MCP server by ID.
⚠️ Deleting an MCP server cannot be undone. External AI clients that connect through this server's endpoint immediately lose access.
Signature
Arguments
<id>
string
Yes
MCP server ID.
Flags
-y, --yes
bool
false
Skip the interactive confirmation prompt.
Example
Corresponds to: DELETE /v1/mcpservers/{_id} (operationId: deleteMcpServer).
celigo mcp-servers dependencies
List resources that depend on this MCP server (alias: used-by). Use it to check whether a server is safe to delete — an empty result means nothing references it.
Signature
Arguments
<id>
string
Yes
MCP server ID.
Flags
None beyond global flags.
Example
Corresponds to: GET /v1/mcpservers/{_id}/dependencies.
celigo mcp-servers audit
Show the audit log (change history) for one MCP server.
Signature
Arguments
<id>
string
Yes
MCP server ID.
Flags
None beyond global flags.
Example
Corresponds to: GET /v1/mcpservers/{_id}/audit.
celigo mcp-servers effective-access <id>
Compile who can reach this MCP server: every end user with access, their effective tools, and the source of each grant (direct, group:<name>, pset:<name>, role:<name>). The per-user mirror is end-users effective-access, which compiles the same picture for one person across every server.
Signature
Arguments
<id>
string
Yes
MCP server ID.
Example
Corresponds to: GET /v1/mcpservers/{_id}/effective-access
celigo mcp-servers assign-end-users <id> <ashareIds...>
Bulk-assign this server's capabilities to end users — up to 100 per call. Requires full mode.
The assignment replaces, not appends: each listed end user's grant for this server becomes exactly the given --capabilities — whatever they previously had on this server is dropped. Grants for other servers, wildcard all-server grants, and end users not listed are untouched. A mid-batch failure stops the batch: the response lists the end users already updated plus the error.
Signature
Arguments
<id>
string
Yes
MCP server ID.
Flags
--capabilities <caps>
string
—
Required. Capabilities to grant on this server, comma-separated: tool:all, tool:<id>, api:all, api:<id>, or pset:<permissionSetId> (a capability set's _id from mcp-servers get).
Example
Corresponds to: PUT /v1/mcpservers/{_id}/endusers
celigo mcp-servers assign-groups <id> <groupIds...>
Bulk-assign this server's capabilities to end-user groups — up to 100 per call. Requires full mode.
Same replace semantics as assign-end-users: each listed group's grant for this server becomes exactly the given --capabilities; grants for other servers, wildcard grants, and groups not listed are untouched. Member end users receive the change through membership. A mid-batch failure stops the batch and reports the groups already updated.
Signature
Arguments
<id>
string
Yes
MCP server ID.
Flags
--capabilities <caps>
string
—
Required. Capabilities to grant on this server, comma-separated: tool:all, tool:<id>, api:all, api:<id>, or pset:<permissionSetId>.
Example
Corresponds to: PUT /v1/mcpservers/{_id}/groups
Gotchas
This resource is not the Celigo Platform MCP. The
mcp-serverscommand manages builder-side MCP endpoints you create to expose a chosen slice of your Tools and builder-mode APIs. For the first-party hosted MCP server that AI agents use to manage your whole account, see the MCP docs.Editing tools, APIs, or credentials is a body edit, not a dedicated subcommand. There is no
tools add,tools remove,apis add, ortokens rotate— mutatetools[]/apis[]viaset(for append/patch) orupdate(for full replace).updateis a full PUT replace. Omitted fields are erased. Always round-trip viaget+jqfirst, or reach forset.A PUT that omits
permissionSetserases every capability set. The API resets the field to[]rather than preserving it, and older documents omit the key on GET entirely, so the omission is easy to miss. Everypset:grant pointing at an erased set is orphaned.setis the safe editor.The
assign-*commands replace, not append. Each listed end user's or group's grant for the server becomes exactly the given--capabilities. To add a capability, read the current grant fromeffective-accessfirst and pass the complete list.Servers start disabled, and need at least one enabled child. A freshly created server's
disabledcannot be flipped tofalseuntil one of itstools[]orapis[]entries is enabled.relativeURIis unique per account and must match/<segment>(alphanumerics, underscores, hyphens). A collision is rejected with422 Unprocessable Entity.No CLI surface for
/previewor/logs. Those endpoints exist at/api/mcpservers/{id}/previewand/api/mcpservers/{id}/logsbut are session-auth only and not reachable via bearer token — use the UI for preview and log inspection.
Related
Last updated
Was this helpful?