Portkey Admin MCP

Portkey Admin MCP Server

The [Portkey](https://portkey.ai/) Admin API as an MCP server — 194 tools across prompts, configs, keys, analytics, governance, deployments, and more.

[!IMPORTANT]

Active compatibility development. Palo Alto Networks completed its Portkey acquisition on 2026‑05‑29 and now presents Portkey as the core of Prisma AIRS AI Gateway. The Portkey Admin API remains live, and its official OpenAPI and product changelog continued adding control-plane surfaces through October 2026; this project has therefore resumed API-coverage work. It targets the Portkey-compatible API (x-portkey-api-key), not Prisma AIRS/Strata Cloud Manager directly. Palo Alto now publishes a Prisma AIRS management specification, but it uses different authentication, multiple management bases, and a smaller domain set, so it is not a PORTKEY_BASE_URL swap. See the short Prisma AIRS interoperability guide for the supported side-by-side model and adapter criteria.

Contents

• Documentation
• Quick Start
• What You Can Do
• API Key Scopes
• HTTP Server (Experimental)
• Architecture
• Distribution and directories
• Prisma AIRS interoperability
• Verify a release
• Development
• Roadmap
• Community
• Star History
• Built With
• Contributing
• Governance
• Security assurance
• Full tool list — ENDPOINTS.md

Documentation

Quick Start

You need a Portkey API key with appropriate scopes. Get one from your Portkey dashboard under API Keys.

Version 0.15.0 uses MCP SDK v2 and serves protocol revision 2026-07-28 and older clients on the same endpoint. It retires HTTP sessions and replay; obsolete settings warn and are ignored. See compatibility and deprecations before upgrading from 0.14.x.

Claude Code

claude mcp add -e PORTKEY_API_KEY=your_key portkey-admin -- npx -y portkey-admin-mcp

Cursor / Windsurf

Add to your MCP config (Cursor: .cursor/mcp.json or ~/.cursor/mcp.json; Windsurf: ~/.codeium/windsurf/mcp_config.json):

{

"mcpServers": { "portkey-admin": { "command": "npx", "args": ["-y", "portkey-admin-mcp"], "env": { "PORTKEY_API_KEY": "your_api_key" } } } }

VS Code

VS Code's .vscode/mcp.json uses a top-level servers key and needs a type:

{

"servers": { "portkey-admin": { "type": "stdio", "command": "npx", "args": ["-y", "portkey-admin-mcp"], "env": { "PORTKEY_API_KEY": "your_api_key" } } } }

Run directly

PORTKEY_API_KEY=your_key npx -y portkey-admin-mcp

To expose only a focused subset of tools in stdio clients, set PORTKEY_TOOL_DOMAINS:

PORTKEY_API_KEY=your_key \

PORTKEY_TOOL_DOMAINS=prompts,analytics \ npx -y portkey-admin-mcp

Scoping domains is also the biggest lever on context cost, not just access. tools/list is paginated, and the complete 194-tool catalog is roughly 400 KB once a client follows nextCursor through every page. Narrowing to the domains a client actually needs cuts that roughly proportionally.

Build from source

git clone https://github.com/CodesWhat/portkey-admin-mcp.git

cd portkey-admin-mcp npm install && npm run build

Then use this config:

{

"mcpServers": { "portkey-admin": { "command": "node", "args": ["/path/to/portkey-admin-mcp/build/index.js"], "env": { "PORTKEY_API_KEY": "your_api_key" } } } }

What You Can Do

194 tools total across 22 tool domains. See ENDPOINTS.md for the full list with descriptions.

Portkey's newer product language increasingly presents provider credentials as Providers, while the current Admin API still exposes both /virtual-keys and /providers. This server keeps both domains: Virtual Keys manage provider access credentials, and Providers manage workspace provider configurations.

API Key Scopes

Most tools work with a workspace-scoped service key that has Select All permissions enabled. That covers prompts, configs, virtual/API keys, providers, guardrails, workspace integrations, MCP servers, rate/usage limits, logs, prompt completions, and workspace user management.

If a tool returns a 403 with Portkey error AB03, it means missing scopes — not a broken endpoint.

Enterprise-gated tools and other scope requirements

Enterprise-gated tools (56)

The following tools require an organisation-level scope that is only available on Portkey Enterprise plans. They return 403 You do not have enough permissions to execute this request on workspace plans. Their descriptions include an Enterprise-gated. Returns 403 on non-Enterprise Portkey plans. suffix so MCP clients know upfront.

| Analytics (25) | get_cost_analytics, get_request_analytics, get_token_analytics, get_latency_analytics, get_error_analytics, get_error_rate_analytics, get_cache_hit_latency, get_cache_hit_rate, get_cache_summary, get_users_analytics, get_error_stacks_analytics, get_error_status_codes_analytics, get_user_requests_analytics, get_rescued_requests_analytics, get_feedback_analytics, get_feedback_models_analytics, get_feedback_scores_analytics, get_feedback_weighted_analytics, get_analytics_group_users, get_analytics_group_models, get_analytics_group_metadata, get_analytics_group_providers, get_analytics_group_mcp, get_analytics_group_a2a, get_analytics_group_workspaces | org-level `an