portkey-admin-mcp 0.13.0 → 0.14.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/COMPATIBILITY.md +67 -0
  2. package/ENDPOINTS.md +29 -1
  3. package/README.md +74 -24
  4. package/build/index.js +1354 -950
  5. package/build/server.js +1354 -950
  6. package/docs/DISTRIBUTION.md +28 -8
  7. package/docs/PRISMA_AIRS_INTEROPERABILITY.md +34 -9
  8. package/docs/VERCEL_DEPLOYMENT.md +6 -0
  9. package/package.json +18 -16
package/COMPATIBILITY.md ADDED
@@ -0,0 +1,67 @@
1
+ # Compatibility and deprecations
2
+
3
+ Last reviewed: 2026-10-24. Package versions, SDK versions, and negotiated MCP
4
+ protocol revisions are separate compatibility boundaries.
5
+
6
+ ## Release lines
7
+
8
+ | Package release | MCP SDK | MCP protocol | Support and behavior |
9
+ | --- | --- | --- | --- |
10
+ | 0.14.1 | v1; dependency floor 1.32.1 | Latest supported revision: `2025-11-25` | Current published minor, 194 tools across 22 domains, Node.js 24+. Stateful HTTP sessions and optional replay stores remain active. |
11
+ | 0.13.0 | v1; dependency floor 1.31.0 | Latest supported revision: `2025-11-25` | Historical release, 184 tools across 20 domains. Upgrade to the latest published minor for security fixes. |
12
+ | Planned migration, minor release number unassigned | v2, exact version to be selected and tested | Native `2026-07-28` plus older clients on the same endpoint | Not shipped. Planned to retire HTTP session and replay stores and change configuration behavior. |
13
+
14
+ The current SDK supports `2025-11-25`, `2025-06-18`, `2025-03-26`,
15
+ `2024-11-05`, and `2024-10-07`. A newer client that negotiates an older
16
+ revision can use this server; that fallback does not mean the server natively
17
+ supports `2026-07-28`. The migration must verify both modern and older clients
18
+ over HTTP and stdio before release.
19
+
20
+ [SECURITY.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY.md) owns the security-support policy: fixes ship on the
21
+ latest published minor line; older minor lines do not receive backports.
22
+ See [CHANGELOG.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CHANGELOG.md) for changes in each published release.
23
+
24
+ ## Configuration lifecycle
25
+
26
+ No deprecation warnings or removals for the settings below ship in 0.14.x.
27
+ The planned migration has no assigned package release number. Its release
28
+ notes must identify the first warning, ignored-setting, and removal versions
29
+ before operators are asked to upgrade.
30
+
31
+ | Setting or behavior | 0.14.x | Planned migration | First warning / ignored / removal release |
32
+ | --- | --- | --- | --- |
33
+ | `MCP_SESSION_MODE`, `MCP_SESSION_TIMEOUT` | Active; stateful mode is the default | Retire session storage; serve older clients without persistent sessions | Unassigned / unassigned / unassigned |
34
+ | `MCP_EVENT_STORE`, `MCP_EVENT_TTL_SECONDS`, `MCP_EVENT_STORE_MAX_EVENTS`, `MCP_EVENT_STORE_MAX_BYTES`, `MCP_EVENT_STORE_COMMAND_TIMEOUT_MS` | Active replay configuration | Retire replay storage and warn about obsolete settings | Unassigned / unassigned / unassigned |
35
+ | `MCP_EVENT_ENCRYPTION_KEY`, `MCP_REDIS_KEY_PREFIX` | Active Redis replay configuration | Retire with the replay store | Unassigned / unassigned / unassigned |
36
+ | HTTP GET stream, `Last-Event-ID` recovery, session identifiers | Active under the configured HTTP mode | Retire legacy sessions and replay; document the resulting recovery changes | Unassigned / unassigned / unassigned |
37
+ | `RATE_LIMIT_*` | Active rate-limit configuration | Retained, including shared Redis limiting | No removal planned |
38
+ | `RATE_LIMIT_REDIS_URL`, `MCP_REDIS_URL`, `REDIS_URL` | Rate limiter uses these URL sources in that order; replay uses the latter two | Preserve a documented Redis connection path for rate limiting when replay is retired | No removal assigned |
39
+ | `MCP_MAX_SESSIONS` | Bounds stateful sessions or active stateless request handlers | Retain the stateless concurrency bound | No removal planned |
40
+ | `MCP_TOOL_DOMAINS`, `CORS_ORIGIN` | Supported fallbacks for `PORTKEY_TOOL_DOMAINS`, `ALLOWED_ORIGINS` | No change assigned | No removal planned |
41
+
42
+ Redis rate limiting and Redis replay are separate features. Retiring the replay
43
+ store does not remove the need for a shared rate limiter in multi-instance or
44
+ serverless deployments. Do not remove working settings from a 0.14.x deployment
45
+ based on the migration plan.
46
+
47
+ ## Migration preparation
48
+
49
+ Work starts by 2026-12-01, or earlier if the v1 SDK stops receiving a needed
50
+ security fix or announces end of life, a targeted client drops the older
51
+ handshake or fails when pinned to `2026-07-28`, or 30 days pass without a v2
52
+ server release carrying upgrade notes. Target completion is before 2027-01-27.
53
+ These are project planning dates, not announced configuration-removal dates or
54
+ an SDK end-of-life guarantee. [ROADMAP.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/ROADMAP.md) tracks the work.
55
+
56
+ Before that release, operators need a versioned upgrade guide covering:
57
+
58
+ - warning and removal behavior for every retired setting;
59
+ - loss of session affinity, the GET stream, and `Last-Event-ID` recovery;
60
+ - how to inspect Portkey state after an interrupted mutation before retrying,
61
+ since an automatic retry can repeat a successful write;
62
+ - retained Redis rate-limit configuration and concurrency bounds; and
63
+ - client, reverse-proxy, Vercel, and marketplace compatibility checks.
64
+
65
+ The release must update this table, the README configuration reference,
66
+ [architecture](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/ARCHITECTURE.md), [Vercel guide](docs/VERCEL_DEPLOYMENT.md),
67
+ [security assurance case](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY-ASSURANCE.md), and changelog together.
package/ENDPOINTS.md CHANGED
@@ -6,7 +6,7 @@ Route mappings were reviewed against the official Portkey OpenAPI on 2026-09-08.
6
6
  - Base URL: `https://api.portkey.ai/v1`
7
7
  - Authentication: `x-portkey-api-key`
8
8
  - Public catalog exception: `get_model_pricing` uses `https://api.portkey.ai` without authentication
9
- - Total: 184 tools across 20 domains
9
+ - Total: 194 tools across 22 domains
10
10
  - Enterprise-gated names and counts are maintained in `src/tools/index.ts` and verified against README by `npm run verify:readme-tools`
11
11
 
12
12
  The route lists are domain-level service routes. The tool tables are the complete
@@ -58,6 +58,34 @@ the public Portkey OpenAPI, so their contracts can change without a spec diff.
58
58
  | `get_analytics_group_workspaces` | GET `/analytics/groups/workspaces` |
59
59
 
60
60
  <!-- tool-catalog:start -->
61
+ ## access-policies (5)
62
+
63
+ Routes:
64
+
65
+ - GET/POST `/policies/access`; GET/PUT/DELETE `/policies/access/{accessPolicyId}`
66
+
67
+ | Tool | Selection guidance and result |
68
+ |---|---|
69
+ | `create_access_policy` | Create a workspace access policy for users, groups, and agents targeting MCP tools or provider models. Changes who may access those targets. An omitted effect becomes deny only when both user ANY and agent ANY are present; otherwise allow, which requires a specific subject. Returns the policy UUID; use get_access_policy before later updates. |
70
+ | `list_access_policies` | Inspect active workspace access policies, newest first, without changing permissions. Filter by subject, MCP server, effect, enabled state, or creation time. Returns total and the current page of policy summaries with versions; use get_access_policy for complete subjects and targets. |
71
+ | `get_access_policy` | Read one access policy's complete subjects, targets, effect, and current version. Use this before update_access_policy so replacement lists and optimistic concurrency use the latest state. Returns policy details; a missing policy returns HTTP 404. |
72
+ | `update_access_policy` | Replace an access policy's complete subjects and targets, changing access permissions. Requires the current version from get_access_policy; a stale version returns HTTP 409 without retrying. Omitted name, description, effect, and enabled retain their stored values. Returns Portkey's acknowledgement; reread before retrying a conflict. |
73
+ | `delete_access_policy` | Delete an access policy by UUID, removing its allow or deny rule and changing access permissions. This cannot be undone by this tool. Inspect get_access_policy first; returns Portkey's acknowledgement, or HTTP 404 when the policy is missing. |
74
+
75
+ ## egress-allowlist (5)
76
+
77
+ Routes:
78
+
79
+ - GET/POST `/egress-allowlist`; GET/PUT/DELETE `/egress-allowlist/{egressAllowlistId}`. Uses the `/v2` base: hosted `/v1` returns the inference gateway fallback, while `/v2` reaches the organisation permission check; the public OpenAPI still lists `/v1`.
80
+
81
+ | Tool | Selection guidance and result |
82
+ |---|---|
83
+ | `list_egress_allowlist` | Inspect the organisation's trusted custom-host egress allowlist without changing destinations. Returns total and the current page of entries; filter by domain before creating duplicates, and use get_egress_allowlist_entry to inspect one entry. Requires organisation permission. |
84
+ | `create_egress_allowlist_entry` | Trust a custom hostname, IP literal, or wildcard for organisation egress, widening permitted outbound destinations. Use list_egress_allowlist to inspect existing trust first. Portkey rejects metadata destinations and duplicates. Returns the new UUID and normalized domain; requires organisation permission. |
85
+ | `get_egress_allowlist_entry` | Read one organisation egress allowlist entry's trusted domain, description, and audit fields. Use this before changing or deleting a destination. Returns entry details, or HTTP 404 if it is missing; requires organisation permission. |
86
+ | `update_egress_allowlist_entry` | Change an organisation egress allowlist domain or description, potentially changing trusted outbound destinations. Inspect get_egress_allowlist_entry first. Omitted fields stay unchanged; description null clears it. At least one changed field is required. Returns Portkey's acknowledgement; requires organisation permission. |
87
+ | `delete_egress_allowlist_entry` | Remove an organisation egress allowlist entry, revoking trust in its outbound destination and potentially breaking integrations that use it. Inspect get_egress_allowlist_entry first. Deletion cannot be undone by this tool. Returns Portkey's acknowledgement or HTTP 404; requires organisation permission. |
88
+
61
89
  ## users (10)
62
90
 
63
91
  Routes:
package/README.md CHANGED
@@ -4,7 +4,7 @@
4
4
 
5
5
  <h1>Portkey Admin MCP Server</h1>
6
6
 
7
- **The [Portkey](https://portkey.ai/) Admin API as an MCP server — 184 tools across prompts, configs, keys, analytics, governance, deployments, and more.**
7
+ **The [Portkey](https://portkey.ai/) Admin API as an MCP server — 194 tools across prompts, configs, keys, analytics, governance, deployments, and more.**
8
8
 
9
9
  </div>
10
10
 
@@ -32,31 +32,56 @@
32
32
  <hr>
33
33
 
34
34
  > [!IMPORTANT]
35
- > **Active compatibility development.** Palo Alto Networks completed its Portkey acquisition on 2026‑05‑29 and now presents Portkey as the core of Prisma AIRS AI Gateway. The Portkey Admin API remains live, and its official OpenAPI and product changelog continued adding control-plane surfaces through September 2026; this project has therefore resumed API-coverage work. It targets the Portkey-compatible API (`x-portkey-api-key`), not Prisma AIRS/Strata Cloud Manager directly. Prisma AIRS AI Gateway currently has a different management and authentication surface, so it is not a `PORTKEY_BASE_URL` swap. See the short [Prisma AIRS interoperability guide](./docs/PRISMA_AIRS_INTEROPERABILITY.md) for the supported side-by-side model and adapter criteria.
35
+ > **Active compatibility development.** Palo Alto Networks completed its Portkey acquisition on 2026‑05‑29 and now presents Portkey as the core of Prisma AIRS AI Gateway. The Portkey Admin API remains live, and its official OpenAPI and product changelog continued adding control-plane surfaces through October 2026; this project has therefore resumed API-coverage work. It targets the Portkey-compatible API (`x-portkey-api-key`), not Prisma AIRS/Strata Cloud Manager directly. Palo Alto now publishes a Prisma AIRS management specification, but it uses different authentication, multiple management bases, and a smaller domain set, so it is not a `PORTKEY_BASE_URL` swap. See the short [Prisma AIRS interoperability guide](./docs/PRISMA_AIRS_INTEROPERABILITY.md) for the supported side-by-side model and adapter criteria.
36
36
 
37
37
  <h2 align="center">Contents</h2>
38
38
 
39
+ - [Documentation](#documentation)
39
40
  - [Quick Start](#quick-start)
40
41
  - [What You Can Do](#what-you-can-do)
41
42
  - [API Key Scopes](#api-key-scopes)
42
43
  - [HTTP Server (Experimental)](#http-server)
43
- - [Architecture](./docs/ARCHITECTURE.md)
44
+ - [Architecture](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/ARCHITECTURE.md)
44
45
  - [Distribution and directories](./docs/DISTRIBUTION.md)
45
46
  - [Prisma AIRS interoperability](./docs/PRISMA_AIRS_INTEROPERABILITY.md)
46
- - [Verify a release](./docs/VERIFY_RELEASE.md)
47
+ - [Verify a release](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/VERIFY_RELEASE.md)
47
48
  - [Development](#development)
49
+ - [Roadmap](#roadmap)
48
50
  - [Community](#community)
49
- - [Contributing](./CONTRIBUTING.md)
50
- - [Governance](./GOVERNANCE.md)
51
- - [Security assurance](./SECURITY-ASSURANCE.md)
51
+ - [Built With](#built-with)
52
+ - [Contributing](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CONTRIBUTING.md)
53
+ - [Governance](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/GOVERNANCE.md)
54
+ - [Security assurance](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY-ASSURANCE.md)
52
55
  - [Full tool list — ENDPOINTS.md](./ENDPOINTS.md)
53
56
 
54
57
  <hr>
55
58
 
59
+ <h2 align="center" id="documentation">Documentation</h2>
60
+
61
+ | Resource | Link |
62
+ | --- | --- |
63
+ | Tool reference | [ENDPOINTS.md](./ENDPOINTS.md) |
64
+ | Compatibility and deprecations | [COMPATIBILITY.md](./COMPATIBILITY.md) |
65
+ | Changelog | [CHANGELOG.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CHANGELOG.md) |
66
+ | Roadmap | [ROADMAP.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/ROADMAP.md) |
67
+ | Architecture | [Architecture](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/ARCHITECTURE.md) |
68
+ | Deployment | [HTTP configuration](#http-server), [Vercel guide](./docs/VERCEL_DEPLOYMENT.md) |
69
+ | Distribution | [Directories and release records](./docs/DISTRIBUTION.md), [verify a release](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/docs/VERIFY_RELEASE.md) |
70
+ | Prisma AIRS | [Interoperability guide](./docs/PRISMA_AIRS_INTEROPERABILITY.md) |
71
+ | Contributing and governance | [CONTRIBUTING.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CONTRIBUTING.md), [GOVERNANCE.md](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/GOVERNANCE.md), [Code of Conduct](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CODE_OF_CONDUCT.md) |
72
+ | Security | [Reporting policy](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY.md), [assurance case](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY-ASSURANCE.md) |
73
+
74
+ <hr>
75
+
56
76
  <h2 align="center" id="quick-start">Quick Start</h2>
57
77
 
58
78
  You need a **Portkey API key** with appropriate scopes. Get one from your [Portkey dashboard](https://app.portkey.ai/) under API Keys.
59
79
 
80
+ Version 0.14.0 uses MCP SDK v1 and supports protocol revisions through
81
+ `2025-11-25`. Session and replay settings remain active. See
82
+ [compatibility and deprecations](./COMPATIBILITY.md) before upgrading; the
83
+ planned MCP v2 migration has no assigned release number or removal date.
84
+
60
85
  ### Claude Code
61
86
 
62
87
  ```bash
@@ -96,7 +121,7 @@ npx -y portkey-admin-mcp
96
121
  ```
97
122
 
98
123
  Scoping domains is also the biggest lever on context cost, not just access. `tools/list`
99
- is paginated, and the complete 184-tool catalog is roughly 400 KB once a
124
+ is paginated, and the complete 194-tool catalog is roughly 400 KB once a
100
125
  client follows `nextCursor` through every page. Narrowing to the domains a client
101
126
  actually needs cuts that roughly proportionally.
102
127
 
@@ -146,6 +171,8 @@ Then use this config:
146
171
  | **MCP Integrations** | 10 | External MCP tool integrations |
147
172
  | **MCP Servers** | 12 | MCP server registry, capabilities, and live connections |
148
173
  | **Guardrails** | 14 | LLM and MCP-tool policies, server mappings, organisation defaults, workspace exclusions |
174
+ | **Access Policies** | 5 | Allow/deny users, groups, and agents access to MCP tools and provider models |
175
+ | **Egress Allowlist** | 5 | Organisation trust for custom outbound hosts |
149
176
  | **Usage Limits** | 7 | Cost and token consumption limits |
150
177
  | **Rate Limits** | 5 | Request frequency controls |
151
178
  | **Analytics** | 25 | Cost, latency, errors, tokens, cache, feedback, provider, MCP, A2A, and workspace groups |
@@ -154,7 +181,7 @@ Then use this config:
154
181
  | **Users & Workspaces** | 24 | User management, invites, workspace members, SCIM group mappings |
155
182
  | **Audit** | 1 | Audit log access |
156
183
 
157
- **184 tools total across 20 tool domains.** See [ENDPOINTS.md](./ENDPOINTS.md) for the full list with descriptions.
184
+ **194 tools total across 22 tool domains.** See [ENDPOINTS.md](./ENDPOINTS.md) for the full list with descriptions.
158
185
 
159
186
  Portkey's newer product language increasingly presents provider credentials as
160
187
  Providers, while the current Admin API still exposes both `/virtual-keys` and
@@ -237,7 +264,7 @@ For local-only HTTP use, leave `MCP_HOST` at its default `127.0.0.1`. Set `MCP_H
237
264
  | `PORTKEY_BASE_URL` | `https://api.portkey.ai/v1` | Portkey Admin API base URL. Prisma AIRS/SCM URLs are not compatible; credentialed requests never auto-follow redirects |
238
265
  | `PORTKEY_ALLOW_PRIVATE_BASE_URL` | — | Set to `true` to allow a literal loopback/private `PORTKEY_BASE_URL` |
239
266
  | `PORTKEY_ALLOW_INSECURE_HTTP` | — | Separately set to `true` only when a trusted self-hosted gateway cannot use HTTPS |
240
- | `PORTKEY_TOOL_DOMAINS` | — | Server-side allowlist of the 20 domains: `users`, `workspaces`, `configs`, `deployments`, `keys`, `collections`, `prompts`, `analytics`, `guardrails`, `limits`, `audit`, `labels`, `partials`, `tracing`, `logging`, `providers`, `secret-references`, `integrations`, `mcp-integrations`, `mcp-servers`. HTTP `?tools=` may narrow it but cannot expand it |
267
+ | `PORTKEY_TOOL_DOMAINS` | — | Server-side allowlist of the 22 domains: `users`, `workspaces`, `configs`, `deployments`, `keys`, `collections`, `prompts`, `analytics`, `guardrails`, `limits`, `audit`, `labels`, `partials`, `tracing`, `logging`, `providers`, `secret-references`, `integrations`, `mcp-integrations`, `mcp-servers`, `access-policies`, `egress-allowlist`. HTTP `?tools=` may narrow it but cannot expand it |
241
268
  | `MCP_TOOL_DOMAINS` | — | Fallback for `PORTKEY_TOOL_DOMAINS`, used only when that is unset |
242
269
  | `MCP_TRANSPORT` | `stdio` | `stdio` or `http`; the Docker image picks its entrypoint from this (set `http` for the HTTP server) |
243
270
  | `MCP_HOST` | `127.0.0.1` | Bind address |
@@ -267,7 +294,7 @@ For local-only HTTP use, leave `MCP_HOST` at its default `127.0.0.1`. Set `MCP_H
267
294
  | `MCP_TLS_CERT_PATH` | — | TLS cert for native HTTPS |
268
295
  | `MCP_TLS_CA_PATH` | — | Optional CA bundle for native HTTPS; only used when the TLS key and cert are set |
269
296
  | `MCP_SHUTDOWN_TIMEOUT_MS` | `10000` | How long graceful shutdown waits before the process is forced to exit, in milliseconds; must be positive |
270
- | `MCP_MAX_REQUEST_SIZE` | `1mb` | Maximum HTTP request body size |
297
+ | `MCP_MAX_REQUEST_SIZE` | `1mb` | Maximum HTTP request body size; tool arguments also have a fixed budget of 10,000 array elements and object members, counted across nested input |
271
298
  | `MCP_READY_CHECK_MODE` | `local` | `local` or `portkey`; `portkey` makes `/ready` also check Portkey connectivity |
272
299
  | `LOG_LEVEL` | `info` | `debug`, `info`, `warn`, or `error` |
273
300
  | `ALLOWED_ORIGINS` | — | CORS allow-list; also used to validate the `Host` header (DNS-rebinding protection) when `MCP_AUTH_MODE=none` |
@@ -315,10 +342,14 @@ docker run \
315
342
  -e MCP_PORT=3000 \
316
343
  -e MCP_AUTH_MODE=bearer \
317
344
  -e MCP_AUTH_TOKEN=your_secret \
345
+ -e RATE_LIMIT_SINGLE_PROCESS=true \
318
346
  -p 3000:3000 \
319
347
  portkey-admin-mcp
320
348
  ```
321
349
 
350
+ This example runs one long-lived container with in-memory rate limiting. Use
351
+ `RATE_LIMIT_STORE=redis` and a TLS Redis URL for multiple instances.
352
+
322
353
  </details>
323
354
 
324
355
  ### Health Endpoints
@@ -352,19 +383,36 @@ network errors, and response-contract failures still fail the run.
352
383
  `PORTKEY_ORGANISATION_ID` is set. Set it to your organisation ID to exercise that route.
353
384
 
354
385
  The required CI and release gates measure every TypeScript source file and fail
355
- below 80% line coverage. The current full report is 98.19% lines, 91.92%
356
- branches, and 98.58% functions.
386
+ below 80% line coverage. The CI and Coverage workflow reports show the current
387
+ line, branch, and function coverage.
388
+
389
+ The [CI workflow](https://github.com/CodesWhat/portkey-admin-mcp/actions/workflows/ci.yml)
390
+ also runs the standalone Qlty CLI and publishes `quality-reports` artifacts for
391
+ each analyzed commit, including lint/security results, duplication, complexity,
392
+ and metrics. The existing Qlty maintainability and coverage badges remain
393
+ Cloud-generated; local analysis does not update those badges. Coverage uploads
394
+ and Cloud analysis still consume Qlty analysis minutes.
357
395
 
358
396
  `npm run dev:http` now requires `MCP_AUTH_MODE=bearer` or `MCP_AUTH_MODE=clerk` by default. For deliberate local-only unauthenticated testing, set `MCP_ALLOW_UNAUTHENTICATED_HTTP=true`.
359
397
 
360
398
  Contributions use pull requests and the checks documented in
361
- [`CONTRIBUTING.md`](CONTRIBUTING.md). Project decisions and maintainer roles are
362
- documented in [`GOVERNANCE.md`](GOVERNANCE.md). Report vulnerabilities through
363
- [`SECURITY.md`](SECURITY.md), and see [`SECURITY-ASSURANCE.md`](SECURITY-ASSURANCE.md)
399
+ [`CONTRIBUTING.md`](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/CONTRIBUTING.md). Project decisions and maintainer roles are
400
+ documented in [`GOVERNANCE.md`](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/GOVERNANCE.md). Report vulnerabilities through
401
+ [`SECURITY.md`](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY.md), and see [`SECURITY-ASSURANCE.md`](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/SECURITY-ASSURANCE.md)
364
402
  for the public threat model and assurance case.
365
403
 
366
404
  <hr>
367
405
 
406
+ <h2 align="center" id="roadmap">Roadmap</h2>
407
+
408
+ Release 0.14.0 adds access policies, egress allowlists, and security maintenance.
409
+ The [roadmap](https://github.com/CodesWhat/portkey-admin-mcp/blob/main/ROADMAP.md) separates completed work from upstream contract and
410
+ tenant-verification gates. The planned MCP v2 migration keeps older clients on
411
+ the same endpoint; its package version and configuration-removal releases are
412
+ still unassigned. See [compatibility and deprecations](./COMPATIBILITY.md).
413
+
414
+ <hr>
415
+
368
416
  <h2 align="center" id="community">Community</h2>
369
417
 
370
418
  Questions and bug reports belong in [Issues](https://github.com/CodesWhat/portkey-admin-mcp/issues); broader discussion, ideas, and help using the server belong in [Discussions](https://github.com/CodesWhat/portkey-admin-mcp/discussions).
@@ -377,10 +425,10 @@ tool catalog in this repository as authoritative when a third-party index lags.
377
425
 
378
426
  <div align="center">
379
427
 
380
- ### Built With
428
+ <h2 align="center" id="built-with">Built With</h2>
381
429
 
382
430
  [![TypeScript](https://img.shields.io/badge/TypeScript_7.0-3178C6?logo=typescript&logoColor=fff)](https://www.typescriptlang.org/)
383
- [![MCP SDK](https://img.shields.io/badge/MCP_SDK_1.31-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
431
+ [![MCP SDK](https://img.shields.io/badge/MCP_SDK_1.32-000?logo=modelcontextprotocol&logoColor=fff)](https://github.com/modelcontextprotocol/typescript-sdk)
384
432
  [![Zod 4](https://img.shields.io/badge/Zod_4-3E67B1?logo=zod&logoColor=fff)](https://zod.dev/)
385
433
  [![Biome](https://img.shields.io/badge/Biome_2.5-60a5fa?logo=biome&logoColor=fff)](https://biomejs.dev/)
386
434
  [![Node 24](https://img.shields.io/badge/Node_24-339933?logo=nodedotjs&logoColor=fff)](https://nodejs.org/)
@@ -390,6 +438,14 @@ tool catalog in this repository as authoritative when a third-party index lags.
390
438
  [![Conventional Commits](https://img.shields.io/badge/commits-conventional-fe5196?logo=conventionalcommits&logoColor=fff)](https://www.conventionalcommits.org/)
391
439
  [![Keep a Changelog](https://img.shields.io/badge/changelog-Keep%20a%20Changelog-E05735)](https://keepachangelog.com/)
392
440
 
441
+ Marketplace listings on [LobeHub](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp) and [Glama](https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp):
442
+
443
+ [![LobeHub MCP](https://lobehub.com/badge/mcp/codeswhat-portkey-admin-mcp)](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp)
444
+
445
+ <a href="https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp"><img src="https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp/badges/card.svg" alt="portkey-admin-mcp MCP server"></a>
446
+
447
+ ---
448
+
393
449
  **[MIT License](LICENSE)** · Inspired by [r-huijts/portkey-admin-mcp-server](https://github.com/r-huijts/portkey-admin-mcp-server)
394
450
 
395
451
  <a href="https://github.com/CodesWhat">
@@ -400,12 +456,6 @@ tool catalog in this repository as authoritative when a third-party index lags.
400
456
  </picture>
401
457
  </a>
402
458
 
403
- Marketplace listings on [LobeHub](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp) and [Glama](https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp):
404
-
405
- [![LobeHub MCP](https://lobehub.com/badge/mcp/codeswhat-portkey-admin-mcp)](https://lobehub.com/mcp/codeswhat-portkey-admin-mcp)
406
-
407
- <a href="https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp"><img src="https://glama.ai/mcp/servers/CodesWhat/portkey-admin-mcp/badges/card.svg" alt="portkey-admin-mcp MCP server"></a>
408
-
409
459
  <a href="#portkey-admin-mcp-server">Back to top</a>
410
460
 
411
461
  </div>