cloudflare 7.0.0 → 7.1.0

package/resources/zero-trust/access/ai-controls/mcp/servers.d.mts

@@ -5,7 +5,7 @@ import { RequestOptions } from "../../../../../internal/request-options.mjs";
 export declare class BaseServers extends APIResource {
     static readonly _key: readonly ['zeroTrust', 'access', 'aiControls', 'mcp', 'servers'];
     /**
-     * Creates a new MCP portal for managing AI tool access through Cloudflare Access.
+     * Creates a new MCP server for connecting to an upstream MCP endpoint.
      *
      * @example
      * ```ts
@@ -23,7 +23,7 @@ export declare class BaseServers extends APIResource {
      */
     create(params: ServerCreateParams, options?: RequestOptions): APIPromise<ServerCreateResponse>;
     /**
-     * Updates an MCP portal configuration.
+     * Updates an MCP server's configuration and credentials.
      *
      * @example
      * ```ts
@@ -36,7 +36,7 @@ export declare class BaseServers extends APIResource {
      */
     update(id: string, params: ServerUpdateParams, options?: RequestOptions): APIPromise<ServerUpdateResponse>;
     /**
-     * Lists all MCP portals configured for the account.
+     * Lists all MCP servers configured for the account.
      *
      * @example
      * ```ts
@@ -50,7 +50,7 @@ export declare class BaseServers extends APIResource {
      */
     list(params: ServerListParams, options?: RequestOptions): PagePromise<ServerListResponsesV4PagePaginationArray, ServerListResponse>;
     /**
-     * Deletes an MCP portal from the account.
+     * Deletes an MCP server from the account.
      *
      * @example
      * ```ts
@@ -63,7 +63,7 @@ export declare class BaseServers extends APIResource {
      */
     delete(id: string, params: ServerDeleteParams, options?: RequestOptions): APIPromise<ServerDeleteResponse>;
     /**
-     * Retrieves gateway configuration for MCP portals.
+     * Retrieves an MCP server's configuration and capability sync state.
      *
      * @example
      * ```ts
@@ -83,7 +83,7 @@ export declare class BaseServers extends APIResource {
      * ```ts
      * const response =
      *   await client.zeroTrust.access.aiControls.mcp.servers.sync(
-     *     'my-mcp-portal',
+     *     'my-mcp-server',
      *     { account_id: 'a86a8f5c339544d7bdc89926de14fb8c' },
      *   );
      * ```
@@ -95,11 +95,20 @@ export declare class Servers extends BaseServers {
 export type ServerListResponsesV4PagePaginationArray = V4PagePaginationArray<ServerListResponse>;
 export interface ServerCreateResponse {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     id: string;
+    /**
+     * Authentication method used to connect to the upstream MCP server.
+     */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
+    /**
+     * URL of the upstream MCP endpoint.
+     */
     hostname: string;
+    /**
+     * Display name for the MCP server.
+     */
     name: string;
     prompts: Array<{
         [key: string]: unknown;
@@ -107,8 +116,23 @@ export interface ServerCreateResponse {
     tools: Array<{
         [key: string]: unknown;
     }>;
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    auth_config_summary?: ServerCreateResponse.AuthConfigSummary;
+    /**
+     * Whether administrative authentication is required before capabilities can be
+     * synced. Manual OAuth is user-managed and has no administrative authentication
+     * flow.
+     */
+    authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
     created_at?: string;
     created_by?: string;
+    /**
+     * Optional description of the MCP server.
+     */
     description?: string | null;
     error?: string;
     error_details?: ServerCreateResponse.ErrorDetails;
@@ -116,8 +140,7 @@ export interface ServerCreateResponse {
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
      * customer portal hostname. Defaults to false (off); opt in per server by setting
-     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
-     * KV key.
+     * true.
      */
     is_shared_oauth_callback_enabled?: boolean;
     last_successful_sync?: string;
@@ -125,14 +148,50 @@ export interface ServerCreateResponse {
     modified_at?: string;
     modified_by?: string;
     /**
-     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
      */
     secure_web_gateway?: boolean;
-    status?: string;
+    /**
+     * Current sync state of the server
+     */
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
+    /**
+     * Server-wide prompt capability overrides.
+     */
     updated_prompts?: Array<ServerCreateResponse.UpdatedPrompt>;
+    /**
+     * Server-wide tool capability overrides.
+     */
     updated_tools?: Array<ServerCreateResponse.UpdatedTool>;
 }
 export declare namespace ServerCreateResponse {
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    interface AuthConfigSummary {
+        auth_mode?: 'dcr' | 'manual';
+        client_secret_version?: number;
+        config?: AuthConfigSummary.Config;
+        has_client_secret?: boolean;
+        registration_info?: AuthConfigSummary.RegistrationInfo;
+    }
+    namespace AuthConfigSummary {
+        interface Config {
+            authorization_endpoint?: string;
+            issuer?: string;
+            resource?: string;
+            revocation_endpoint?: string;
+            token_endpoint?: string;
+        }
+        interface RegistrationInfo {
+            client_id?: string;
+            redirect_uris?: Array<string>;
+            scope?: string;
+            token_endpoint_auth_method?: string;
+        }
+    }
     interface ErrorDetails {
         /**
          * Underlying error message
@@ -156,25 +215,58 @@ export declare namespace ServerCreateResponse {
         status_code?: number;
     }
     interface UpdatedPrompt {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
     interface UpdatedTool {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
 }
 export interface ServerUpdateResponse {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     id: string;
+    /**
+     * Authentication method used to connect to the upstream MCP server.
+     */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
+    /**
+     * URL of the upstream MCP endpoint.
+     */
     hostname: string;
+    /**
+     * Display name for the MCP server.
+     */
     name: string;
     prompts: Array<{
         [key: string]: unknown;
@@ -182,8 +274,23 @@ export interface ServerUpdateResponse {
     tools: Array<{
         [key: string]: unknown;
     }>;
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    auth_config_summary?: ServerUpdateResponse.AuthConfigSummary;
+    /**
+     * Whether administrative authentication is required before capabilities can be
+     * synced. Manual OAuth is user-managed and has no administrative authentication
+     * flow.
+     */
+    authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
     created_at?: string;
     created_by?: string;
+    /**
+     * Optional description of the MCP server.
+     */
     description?: string | null;
     error?: string;
     error_details?: ServerUpdateResponse.ErrorDetails;
@@ -191,8 +298,7 @@ export interface ServerUpdateResponse {
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
      * customer portal hostname. Defaults to false (off); opt in per server by setting
-     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
-     * KV key.
+     * true.
      */
     is_shared_oauth_callback_enabled?: boolean;
     last_successful_sync?: string;
@@ -200,14 +306,50 @@ export interface ServerUpdateResponse {
     modified_at?: string;
     modified_by?: string;
     /**
-     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
      */
     secure_web_gateway?: boolean;
-    status?: string;
+    /**
+     * Current sync state of the server
+     */
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
+    /**
+     * Server-wide prompt capability overrides.
+     */
     updated_prompts?: Array<ServerUpdateResponse.UpdatedPrompt>;
+    /**
+     * Server-wide tool capability overrides.
+     */
     updated_tools?: Array<ServerUpdateResponse.UpdatedTool>;
 }
 export declare namespace ServerUpdateResponse {
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    interface AuthConfigSummary {
+        auth_mode?: 'dcr' | 'manual';
+        client_secret_version?: number;
+        config?: AuthConfigSummary.Config;
+        has_client_secret?: boolean;
+        registration_info?: AuthConfigSummary.RegistrationInfo;
+    }
+    namespace AuthConfigSummary {
+        interface Config {
+            authorization_endpoint?: string;
+            issuer?: string;
+            resource?: string;
+            revocation_endpoint?: string;
+            token_endpoint?: string;
+        }
+        interface RegistrationInfo {
+            client_id?: string;
+            redirect_uris?: Array<string>;
+            scope?: string;
+            token_endpoint_auth_method?: string;
+        }
+    }
     interface ErrorDetails {
         /**
          * Underlying error message
@@ -231,25 +373,58 @@ export declare namespace ServerUpdateResponse {
         status_code?: number;
     }
     interface UpdatedPrompt {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
     interface UpdatedTool {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
 }
 export interface ServerListResponse {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     id: string;
+    /**
+     * Authentication method used to connect to the upstream MCP server.
+     */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
+    /**
+     * URL of the upstream MCP endpoint.
+     */
     hostname: string;
+    /**
+     * Display name for the MCP server.
+     */
     name: string;
     prompts: Array<{
         [key: string]: unknown;
@@ -257,8 +432,23 @@ export interface ServerListResponse {
     tools: Array<{
         [key: string]: unknown;
     }>;
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    auth_config_summary?: ServerListResponse.AuthConfigSummary;
+    /**
+     * Whether administrative authentication is required before capabilities can be
+     * synced. Manual OAuth is user-managed and has no administrative authentication
+     * flow.
+     */
+    authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
     created_at?: string;
     created_by?: string;
+    /**
+     * Optional description of the MCP server.
+     */
     description?: string | null;
     error?: string;
     error_details?: ServerListResponse.ErrorDetails;
@@ -266,8 +456,7 @@ export interface ServerListResponse {
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
      * customer portal hostname. Defaults to false (off); opt in per server by setting
-     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
-     * KV key.
+     * true.
      */
     is_shared_oauth_callback_enabled?: boolean;
     last_successful_sync?: string;
@@ -275,14 +464,50 @@ export interface ServerListResponse {
     modified_at?: string;
     modified_by?: string;
     /**
-     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
      */
     secure_web_gateway?: boolean;
-    status?: string;
+    /**
+     * Current sync state of the server
+     */
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
+    /**
+     * Server-wide prompt capability overrides.
+     */
     updated_prompts?: Array<ServerListResponse.UpdatedPrompt>;
+    /**
+     * Server-wide tool capability overrides.
+     */
     updated_tools?: Array<ServerListResponse.UpdatedTool>;
 }
 export declare namespace ServerListResponse {
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    interface AuthConfigSummary {
+        auth_mode?: 'dcr' | 'manual';
+        client_secret_version?: number;
+        config?: AuthConfigSummary.Config;
+        has_client_secret?: boolean;
+        registration_info?: AuthConfigSummary.RegistrationInfo;
+    }
+    namespace AuthConfigSummary {
+        interface Config {
+            authorization_endpoint?: string;
+            issuer?: string;
+            resource?: string;
+            revocation_endpoint?: string;
+            token_endpoint?: string;
+        }
+        interface RegistrationInfo {
+            client_id?: string;
+            redirect_uris?: Array<string>;
+            scope?: string;
+            token_endpoint_auth_method?: string;
+        }
+    }
     interface ErrorDetails {
         /**
          * Underlying error message
@@ -306,25 +531,58 @@ export declare namespace ServerListResponse {
         status_code?: number;
     }
     interface UpdatedPrompt {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
     interface UpdatedTool {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
 }
 export interface ServerDeleteResponse {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     id: string;
+    /**
+     * Authentication method used to connect to the upstream MCP server.
+     */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
+    /**
+     * URL of the upstream MCP endpoint.
+     */
     hostname: string;
+    /**
+     * Display name for the MCP server.
+     */
     name: string;
     prompts: Array<{
         [key: string]: unknown;
@@ -332,8 +590,23 @@ export interface ServerDeleteResponse {
     tools: Array<{
         [key: string]: unknown;
     }>;
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    auth_config_summary?: ServerDeleteResponse.AuthConfigSummary;
+    /**
+     * Whether administrative authentication is required before capabilities can be
+     * synced. Manual OAuth is user-managed and has no administrative authentication
+     * flow.
+     */
+    authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
     created_at?: string;
     created_by?: string;
+    /**
+     * Optional description of the MCP server.
+     */
     description?: string | null;
     error?: string;
     error_details?: ServerDeleteResponse.ErrorDetails;
@@ -341,8 +614,7 @@ export interface ServerDeleteResponse {
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
      * customer portal hostname. Defaults to false (off); opt in per server by setting
-     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
-     * KV key.
+     * true.
      */
     is_shared_oauth_callback_enabled?: boolean;
     last_successful_sync?: string;
@@ -350,14 +622,50 @@ export interface ServerDeleteResponse {
     modified_at?: string;
     modified_by?: string;
     /**
-     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
      */
     secure_web_gateway?: boolean;
-    status?: string;
+    /**
+     * Current sync state of the server
+     */
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
+    /**
+     * Server-wide prompt capability overrides.
+     */
     updated_prompts?: Array<ServerDeleteResponse.UpdatedPrompt>;
+    /**
+     * Server-wide tool capability overrides.
+     */
     updated_tools?: Array<ServerDeleteResponse.UpdatedTool>;
 }
 export declare namespace ServerDeleteResponse {
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    interface AuthConfigSummary {
+        auth_mode?: 'dcr' | 'manual';
+        client_secret_version?: number;
+        config?: AuthConfigSummary.Config;
+        has_client_secret?: boolean;
+        registration_info?: AuthConfigSummary.RegistrationInfo;
+    }
+    namespace AuthConfigSummary {
+        interface Config {
+            authorization_endpoint?: string;
+            issuer?: string;
+            resource?: string;
+            revocation_endpoint?: string;
+            token_endpoint?: string;
+        }
+        interface RegistrationInfo {
+            client_id?: string;
+            redirect_uris?: Array<string>;
+            scope?: string;
+            token_endpoint_auth_method?: string;
+        }
+    }
     interface ErrorDetails {
         /**
          * Underlying error message
@@ -381,25 +689,58 @@ export declare namespace ServerDeleteResponse {
         status_code?: number;
     }
     interface UpdatedPrompt {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
     interface UpdatedTool {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
 }
 export interface ServerReadResponse {
     /**
-     * server id
+     * Unique identifier for the MCP server.
      */
     id: string;
+    /**
+     * Authentication method used to connect to the upstream MCP server.
+     */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
+    /**
+     * URL of the upstream MCP endpoint.
+     */
     hostname: string;
+    /**
+     * Display name for the MCP server.
+     */
     name: string;
     prompts: Array<{
         [key: string]: unknown;
@@ -407,8 +748,23 @@ export interface ServerReadResponse {
     tools: Array<{
         [key: string]: unknown;
     }>;
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    auth_config_summary?: ServerReadResponse.AuthConfigSummary;
+    /**
+     * Whether administrative authentication is required before capabilities can be
+     * synced. Manual OAuth is user-managed and has no administrative authentication
+     * flow.
+     */
+    authentication_status?: 'not_required' | 'required' | 'connected' | 'stale' | 'manual';
     created_at?: string;
     created_by?: string;
+    /**
+     * Optional description of the MCP server.
+     */
     description?: string | null;
     error?: string;
     error_details?: ServerReadResponse.ErrorDetails;
@@ -416,8 +772,7 @@ export interface ServerReadResponse {
      * When true, the gateway worker uses the shared Cloudflare-owned OAuth callback
      * endpoint as the redirect_uri for upstream on-behalf OAuth, instead of the
      * customer portal hostname. Defaults to false (off); opt in per server by setting
-     * true. Effective behavior is gated by the gateway worker's per-env rollout mode
-     * KV key.
+     * true.
      */
     is_shared_oauth_callback_enabled?: boolean;
     last_successful_sync?: string;
@@ -425,14 +780,50 @@ export interface ServerReadResponse {
     modified_at?: string;
     modified_by?: string;
     /**
-     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway
+     * Route outbound traffic to this MCP server through Zero Trust Secure Web Gateway.
      */
     secure_web_gateway?: boolean;
-    status?: string;
+    /**
+     * Current sync state of the server
+     */
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
+    /**
+     * Server-wide prompt capability overrides.
+     */
     updated_prompts?: Array<ServerReadResponse.UpdatedPrompt>;
+    /**
+     * Server-wide tool capability overrides.
+     */
     updated_tools?: Array<ServerReadResponse.UpdatedTool>;
 }
 export declare namespace ServerReadResponse {
+    /**
+     * Safe subset of auth_credentials surfaced to the dashboard. Includes auth_mode
+     * (dcr|manual), has_client_secret, client_secret_version, and the OAuth
+     * endpoints + client_id for manual servers. Never includes the secret value.
+     */
+    interface AuthConfigSummary {
+        auth_mode?: 'dcr' | 'manual';
+        client_secret_version?: number;
+        config?: AuthConfigSummary.Config;
+        has_client_secret?: boolean;
+        registration_info?: AuthConfigSummary.RegistrationInfo;
+    }
+    namespace AuthConfigSummary {
+        interface Config {
+            authorization_endpoint?: string;
+            issuer?: string;
+            resource?: string;
+            revocation_endpoint?: string;
+            token_endpoint?: string;
+        }
+        interface RegistrationInfo {
+            client_id?: string;
+            redirect_uris?: Array<string>;
+            scope?: string;
+            token_endpoint_auth_method?: string;
+        }
+    }
     interface ErrorDetails {
         /**
          * Underlying error message
@@ -456,22 +847,46 @@ export declare namespace ServerReadResponse {
         status_code?: number;
     }
     interface UpdatedPrompt {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
     interface UpdatedTool {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
 }
 export interface ServerSyncResponse {
     error?: string;
     error_details?: ServerSyncResponse.ErrorDetails;
-    status?: string;
+    status?: 'waiting' | 'ready' | 'stale' | 'error';
 }
 export declare namespace ServerSyncResponse {
     interface ErrorDetails {
@@ -503,62 +918,96 @@ export interface ServerCreateParams {
      */
     account_id: string;
     /**
-     * Body param: server id
+     * Body param: Unique identifier for the MCP server.
      */
     id: string;
     /**
-     * Body param
+     * Body param: Authentication method used to connect to the upstream MCP server.
      */
     auth_type: 'oauth' | 'bearer' | 'unauthenticated';
     /**
-     * Body param
+     * Body param: URL of the upstream MCP endpoint.
      */
     hostname: string;
     /**
-     * Body param
+     * Body param: Display name for the MCP server.
      */
     name: string;
     /**
-     * Body param
+     * Body param: Static credential for the upstream MCP server. For auth_type
+     * "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped
+     * server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the
+     * form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static
+     * headers (e.g. Cloudflare Access service tokens:
+     * `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`).
      */
     auth_credentials?: string;
     /**
-     * Body param
+     * Body param: Pre-registered OAuth client_secret. Write-only - accepted on
+     * create/update when auth_credentials.auth_mode is 'manual'. Stored
+     * AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.
+     */
+    client_secret?: string;
+    /**
+     * Body param: Optional description of the MCP server.
      */
     description?: string | null;
     /**
      * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
      * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
      * the customer portal hostname. Defaults to false (off); opt in per server by
-     * setting true. Effective behavior is gated by the gateway worker's per-env
-     * rollout mode KV key.
+     * setting true.
      */
     is_shared_oauth_callback_enabled?: boolean;
     /**
      * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
-     * Web Gateway
+     * Web Gateway.
      */
     secure_web_gateway?: boolean;
     /**
-     * Body param
+     * Body param: Server-wide prompt capability overrides.
      */
     updated_prompts?: Array<ServerCreateParams.UpdatedPrompt>;
     /**
-     * Body param
+     * Body param: Server-wide tool capability overrides.
      */
     updated_tools?: Array<ServerCreateParams.UpdatedTool>;
 }
 export declare namespace ServerCreateParams {
     interface UpdatedPrompt {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
     interface UpdatedTool {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
 }
@@ -568,50 +1017,84 @@ export interface ServerUpdateParams {
      */
     account_id: string;
     /**
-     * Body param
+     * Body param: Static credential for the upstream MCP server. For auth_type
+     * "bearer", either a raw token string (e.g. "sk-abc123"), which is wrapped
+     * server-side as `Authorization: Bearer <token>`, or a JSON-encoded object of the
+     * form `{"headers":{"Header-Name":"value",...}}` for custom or multiple static
+     * headers (e.g. Cloudflare Access service tokens:
+     * `{"headers":{"cf-access-client-id":"...","cf-access-client-secret":"..."}}`).
      */
     auth_credentials?: string;
     /**
-     * Body param
+     * Body param: Pre-registered OAuth client_secret. Write-only - accepted on
+     * create/update when auth_credentials.auth_mode is 'manual'. Stored
+     * AES-GCM-encrypted in server_oauth_secrets; never returned by read endpoints.
+     */
+    client_secret?: string;
+    /**
+     * Body param: Optional description of the MCP server.
      */
     description?: string | null;
     /**
      * Body param: When true, the gateway worker uses the shared Cloudflare-owned OAuth
      * callback endpoint as the redirect_uri for upstream on-behalf OAuth, instead of
      * the customer portal hostname. Defaults to false (off); opt in per server by
-     * setting true. Effective behavior is gated by the gateway worker's per-env
-     * rollout mode KV key.
+     * setting true.
      */
     is_shared_oauth_callback_enabled?: boolean;
     /**
-     * Body param
+     * Body param: Display name for the MCP server.
      */
     name?: string;
     /**
      * Body param: Route outbound traffic to this MCP server through Zero Trust Secure
-     * Web Gateway
+     * Web Gateway.
      */
     secure_web_gateway?: boolean;
     /**
-     * Body param
+     * Body param: Server-wide prompt capability overrides.
      */
     updated_prompts?: Array<ServerUpdateParams.UpdatedPrompt>;
     /**
-     * Body param
+     * Body param: Server-wide tool capability overrides.
      */
     updated_tools?: Array<ServerUpdateParams.UpdatedTool>;
 }
 export declare namespace ServerUpdateParams {
     interface UpdatedPrompt {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
     interface UpdatedTool {
+        /**
+         * Name of the tool or prompt capability to override.
+         */
         name: string;
+        /**
+         * Custom name exposed for the capability.
+         */
         alias?: string;
+        /**
+         * Custom description exposed for the capability.
+         */
         description?: string;
+        /**
+         * Whether the capability is available through the MCP server.
+         */
         enabled?: boolean;
     }
 }