/ 100

22 days ago

glama

portkey-admin-mcp

MCP server for Portkey Admin API - 116 tools for prompts, configs, analytics & more.

→ s-b-e-n-s-o-n/portkey-admin-mcp · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: ANTHROPIC_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 3 credentials: ANTHROPIC_API_KEY, MCP_AUTH_TOKEN, PORTKEY_API_KEY

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// known CVEs in dependencies1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

lowesbuild@0.28.0GHSA-g7r4-m6w7-qqqr

esbuild allows arbitrary file read when running the development server on Windows

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configALLOWED_ORIGINS— CORS allow-list; also used to validate the Host header (DNS-rebinding protection) when MCP_AUTH_MODE=none

🔐 secretANTHROPIC_API_KEY

configANTHROPIC_BASE_URL

configCLERK_AUDIENCE

configCLERK_ISSUER

configCLERK_JWKS_URL

configCORS_ORIGIN

configLOG_LEVEL

configMCP_AUTH_MODE— PORTKEY_API_KEY=your_key =bearer MCP_AUTH_TOKEN=your_secret \

🔐 secretMCP_AUTH_TOKEN— your_secret \

configMCP_EVENT_STORE— off off, memory, or redis

configMCP_EVENT_TTL_SECONDS

configMCP_HOST— 127.0.0.1 \

configMCP_MAX_REQUEST_SIZE

configMCP_MAX_SESSIONS— 100 Maximum concurrent stateful MCP sessions before new initialize requests are rejected

configMCP_PORT— 3000 Port

configMCP_PUBLIC_BASE_URL— Public absolute base URL to advertise from /auth/info and the status page; recommended for hosted deployments

configMCP_READY_CHECK_MODE

configMCP_REDIS_KEY_PREFIX

configMCP_REDIS_URL— Redis URL for shared event store

configMCP_SESSION_MODE— stateful stateful or stateless

configMCP_SESSION_TIMEOUT

configMCP_SHUTDOWN_TIMEOUT_MS

configMCP_TLS_CA_PATH

configMCP_TLS_CERT_PATH— TLS cert for native HTTPS

configMCP_TLS_KEY_PATH— TLS key for native HTTPS

configMCP_TOOL_DOMAINS

configMCP_TRANSPORT

configMCP_TRUST_PROXY— false Trust proxy headers (for reverse proxies)

configPORT

configPORTKEY_ALLOW_PRIVATE_BASE_URL— PORTKEY_BASE_URL https://api.portkey.ai/v1 Portkey Admin API base URL. Point at a self-hosted Portkey gateway if needed. Loopback/private-network hosts are rejected unless =true

🔐 secretPORTKEY_API_KEY— claude mcp add -e =your_key portkey-admin -- npx -y portkey-admin-mcp

configPORTKEY_BASE_URL— PORTKEY_ALLOW_PRIVATE_BASE_URL — Set to true to allow a on loopback or a private network (e.g. a self-hosted gateway at http://localhost:8787)

configPORTKEY_TOOL_DOMAINS— To expose only a focused subset of tools in stdio clients, set :

configRATE_LIMIT_ENABLED

configREDIS_URL

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/s-b-e-n-s-o-n-portkey-admin-mcp-4p38vi)](https://m8ven.ai/mcp/s-b-e-n-s-o-n-portkey-admin-mcp-4p38vi)

commit: 893805c1f2567ee1a16d43dbfc17922ea5a4b94c

code hash: 080cea09ada1ae25890b77b75a7845411c3aef541d5e17fe4eef55b2e1454ccd

verified: 6/18/2026, 11:30:39 AM

view raw JSON →