MCP Hub
How MCP Hub curates MCP servers into a catalogue that people and agents can discover and use.
Enterprise module
MCP Hub is the enterprise mcp-hub module. The MCP Hubs entry shows in the MCP sub-nav on every install, but a workspace without the module gets 402 from the hub API.
An MCP hub is a curated catalog of MCP servers. You choose which of your servers belong in it, put them in the order you want, and publish the catalog so that people and tools can discover what is available and where to connect, in the format of the MCP Registry.
A hub never runs tools. Each catalog entry carries connection information that points at the server's own endpoint, so the server's access mode, permissions, guardrails and audit keep working exactly as they do without a hub.
Create a hub
- Open Build → MCP Servers → MCP Hubs, then create a hub with a Name and an optional Description.
- Open the hub. In the members list, add a server or Knowledge Base from the select. Use the arrows to reorder entries and Remove from hub to take one out. Order is kept in the catalog.
- Choose who can read the catalog (below), set the status, and copy the catalog URL.
You can also add a server to a hub while you create it: the Add to hub select on the MCP server form lists your hubs and offers + Create new hub.
Adding a Knowledge Base creates (or reuses) the internal MCP server that publishes that Knowledge Engine module and attaches it, so you do not have to visit MCP Servers first.
Who can read the catalog
| Hub access | Who | URL |
|---|---|---|
| Token (default) | Holders of an API token of the workspace | GET /api/client/v1/mcp/hubs/{hubKey}/servers |
| Public | Anyone with the link | GET /api/public/mcp/hubs/{tenantId}/{hubSlug}/servers |
The hub page shows the catalog URL for its access mode, with a ready-to-run example. A public hub is addressed by an unguessable {tenantId, hubSlug} pair.
Only hubs with status active are served. A disabled hub answers 404.
A public hub still lists token-protected servers
Servers that are themselves token-gated are listed for discovery only on a public hub, and their tool parameter schemas stay behind the token surface. If you do not want token-protected members listed publicly at all, the operator can set MCP_HUB_PUBLIC_TOKEN_MEMBERS=off on the Console server.
Read a catalog
The catalog follows the MCP Registry envelope: { "servers": [...], "metadata": { "count", "nextCursor" } }, with Cognipeer-specific fields under _meta["com.cognipeer/mcp-hub"]. Entries are whitelist-serialized: upstream credentials, stdio environment values and vault material are never included.
| Endpoint | Returns |
|---|---|
GET /api/client/v1/mcp/hubs | The hubs visible to the token |
GET /api/client/v1/mcp/hubs/{hubKey} | The hub summary and the first page of its catalog |
GET /api/client/v1/mcp/hubs/{hubKey}/servers | A page of the catalog |
GET /api/client/v1/mcp/hubs/{hubKey}/servers/{serverKey} | One catalog entry in detail |
The listing endpoints take search (free text over the member servers), cursor (the metadata.nextCursor of the previous page) and limit (default 50, at most 100).
curl -H "Authorization: Bearer $TOKEN" \
"$BASE/api/client/v1/mcp/hubs/platform-tools/servers?search=ticket&limit=20"To use a server from the catalog, connect to the endpoint in its entry (/api/client/v1/mcp/{serverKey}/... with a token, or the public path for a public server), or bind it to an agent as described in Tools overview.
Manage hubs with the API
The dashboard API, under /api/mcp/hubs, supports GET and POST on the collection, GET, PATCH and DELETE on /api/mcp/hubs/{id}, and POST /api/mcp/hubs/{id}/attach-internal (body: provider, instanceKey) for the Knowledge Base shortcut. A hub has a key, name, description, serverKeys (ordered), exposure.accessMode (token or public) and status (active or disabled).
Hubs belong to a project. A member of one project cannot read, change or delete another project's hub; owners and administrators keep workspace-wide reach.
Who can do this
Hub administration is part of the mcp service: mcp.read to see hubs, mcp.write to change them. Reading the catalog through the client API is a read of the same service. See the Permissions reference.