MCP Server and Inspector¶
The portal exposes its actions through a Model Context Protocol (MCP) server. The same actions drive the AI agents. A developer can also connect an editor or another agent to it, and call the portal's tools from the day-to-day development environment.
Endpoint¶
| Path | /api/mcp-actions/v1 on the portal's own URL, for example https://<portal-host>/api/mcp-actions/v1 |
| Transport | HTTP, as exposed by the Backstage MCP actions backend |
| Server | The Backstage MCP actions backend. Each backend plugin registers its tools as actions; tool names are not prefixed by the plugin. |
| Local development | http://localhost:7007/api/mcp-actions/v1 |
Example configuration for an editor that supports HTTP MCP servers (local portal shown):
{
"servers": {
"portal": {
"url": "http://localhost:7007/api/mcp-actions/v1",
"type": "http"
}
}
}
To list the tools of a server by hand, send the MCP tools/list request with an Authorization: Bearer <token> header. The Inspector below does the same from a browser.
Authentication¶
| Mechanism | Detail |
|---|---|
| Static token | The configuration can define a static token for external callers, with a subject for MCP clients. The token comes from an app setting. The reference configuration of the provider's own environment does this. |
| OAuth | The portal enables dynamic client registration and client ID metadata documents on its auth backend, so that MCP clients can sign in as a user |
Tools run with the identity of the caller, as far as the token carries a user. Ownership-based access applies to MCP calls in the same way as to the web pages (Authentication and access). Which mechanism your clients use is a platform decision; ask your platform team for the URL and the way to authenticate.
Tools¶
The tools come from these plugins. Which ones are available depends on the features enabled in your environment.
| Area | Tools |
|---|---|
| Catalog and search | The tools of the Backstage catalog actions, and query, which searches all indexed document types and TechDocs |
| Cost | get-azure-costs (costs grouped by entity and time resolution) |
| Security | get-azure-security-summary, get-azure-security-recommendations, get-azure-security-sync-status |
| Compliance | get-azure-regulatory-compliance-status, get-azure-regulatory-compliance-policies, get-azure-regulatory-compliance-sync-status |
| Network | get-firewall-blocked-requests, get-application-gateway-logs |
| Spoke configuration | spoke-list-files, spoke-get-file-content, spoke-get-json-schema, spoke-get-cidrs, spoke-check-cidr-availability, spoke-get-next-free-cidr, spoke-validate-json, spoke-create-pr |
| Integration platform configuration | integration-list-files, integration-get-file-content, integration-validate-platform-config, integration-create-pr, integration-update-branch |
| Agent support | get-skill (loads the instructions of a skill), current-date |
The spoke and integration tools exist only when the corresponding agent is configured, because they need the repository settings of that agent. Tools that create pull requests need write access of the portal's identity on the repository.
MCP inspector¶
The MCP Inspector page (bottom of the menu, enabled with the feature flag features.mcp_inspector) connects from your
browser to an MCP server URL that you enter. It lists the tools, resources and prompts of the server, lets you call a tool
with your own input and shows the connection log. Use it to check what a tool returns before you rely on it in an agent,
and to check that the tool list is not empty after a deployment.