The Management MCP surface exposes 57 tools across 10 categories. These tools allow AI agents and automation systems to manage the full Zerq platform — creating collections, configuring proxies, managing clients, rotating credentials, and querying observability data.
All Management MCP requests require an OIDC token: Authorization: Bearer <id_token>. Access is controlled by RBAC roles assigned to the authenticated user.
| Category | Count | Description |
|---|
| Collections | 7 | Create, read, update, delete, and toggle collection status |
| Proxies | 5 | Manage proxy routes within collections |
| Workflow | 9 | Manage, validate, and test proxy workflows and trigger capture |
| Policies | 6 | Rate limit and quota policies |
| Clients | 6 | Manage API consumer clients |
| Profiles | 8 | Manage auth profiles and credentials |
| Credentials | 5 | Manage backend secrets |
| Audit | 2 | Query audit logs |
| Metrics | 6 | Query dashboard metrics |
| Logs | 3 | Query and delete request logs |
| Tool | Description |
|---|
list_collections | Returns all collections with name, base path, status, and endpoint count |
get_collection | Returns full detail for one collection including target URL, headers, and credential |
get_collection_proxies | Returns all proxies for a specific collection |
create_collection | Creates a new collection (name, base_path, endpoint URL, headers, credential) |
update_collection | Updates collection settings (name, description, endpoint, headers, credential) |
delete_collection | Permanently deletes a collection and all its proxies |
toggle_collection_status | Publishes or unpublishes a collection |
| Tool | Description |
|---|
list_proxies | Returns all proxies, optionally filtered by collection |
get_proxy | Returns full proxy detail including headers, parameters, schemas, and workflow status |
create_proxy | Creates a proxy (collection, name, method, path, target_path, headers, params, schema, streaming) |
update_proxy | Updates an existing proxy's settings |
delete_proxy | Permanently removes a proxy |
| Tool | Description |
|---|
workflow_list_nodes | Returns all workflow node types with schemas plus authoring metadata (entry_trigger, terminal_node, requires_source_handle, supported_source_handles, default_source_handle, dynamic_source_handles, wiring_hint) |
workflow_list_templates | Returns all available prebuilt workflow templates |
workflow_test_node | Executes a single node in isolation for testing |
workflow_test_workflow_stream | Executes a full workflow test and returns streamed progress events |
workflow_trigger_test_listen | Starts a trigger test-listen session (HTTP webhook or IMAP capture) |
workflow_trigger_test_stream | Reads the captured trigger event for a test-listen session |
get_proxy_workflow | Returns the current workflow definition for a proxy |
update_proxy_workflow | Saves a new workflow definition for a proxy |
validate_proxy_workflow | Validates a workflow definition and returns any schema or logic errors |
Workflow entry triggers supported by workflow validation and update flows are http_trigger, manual_trigger, cron_trigger, kafka_consumer, and imap_trigger.
| Tool | Description |
|---|
list_policies | Returns all policies with rate limit and quota settings |
get_policy | Returns full detail for one policy |
create_policy | Creates a rate limit/quota policy |
update_policy | Updates policy limits or window settings |
toggle_policy_status | Enables or disables a policy |
delete_policy | Permanently removes a policy |
| Tool | Description |
|---|
list_clients | Returns all clients with status, email, and collection count |
get_client | Returns full client detail including portal access settings and authorized emails |
create_client | Creates a client (name, email, collections, policy, portal access) |
update_client | Updates client settings including authorized emails and portal access toggle |
toggle_client_status | Activates or deactivates a client |
delete_client | Permanently removes a client and all its profiles |
| Tool | Description |
|---|
list_profiles | Returns all profiles for a client with auth type and status |
get_profile | Returns full profile detail including method restrictions and IP allowlist |
create_profile | Creates a profile (name, auth_type, allowed_methods, allowed_ips) |
update_profile | Updates profile settings |
delete_profile | Permanently removes a profile |
get_profile_credentials | Returns the current credential metadata (not secret values) |
rotate_profile_credentials | Generates new credentials; old credentials are immediately invalidated |
set_profile_auth_type | Changes the auth type of an existing profile |
| Tool | Description |
|---|
list_credentials | Returns all credentials with name and type |
get_credentials | Returns credential metadata (type, fields) — never returns secret values |
create_credentials | Creates a credential of any supported type |
update_credentials | Updates credential field values |
delete_credentials | Permanently removes a credential |
| Tool | Description |
|---|
list_audit_logs | Returns audit log entries with filters (actor, action, resource, time range) |
get_audit_log | Returns full detail for one audit log entry |
| Tool | Description |
|---|
get_metrics_overview | Returns total requests, success rate, average latency, error count for a time period |
get_metrics_status_distribution | Returns request counts grouped by HTTP status class |
get_metrics_method_distribution | Returns request counts grouped by HTTP method |
get_metrics_top_endpoints | Returns the most-called endpoints ranked by request volume |
get_metrics_failed_endpoints | Returns endpoints with the highest error rates |
get_metrics_requests_over_time | Returns request volume time series (interval: minute/hour/day/month) |
| Tool | Description |
|---|
list_logs | Returns request log entries with filters (path, method, status, client, latency, payload search) |
get_log | Returns full detail for one log entry including headers, body, and error |
delete_log | Deletes a specific log entry (admin only) |