Skip to main content

Settings Page (Web UI)

The Web UI Configuration page (/ui/settings) presents mcpproxy's config as friendly, prioritized form sections instead of raw JSON:

  • Security & Access — API key (masked, show/regenerate), require MCP auth, quarantine, global Docker isolation, code execution, read-only mode, sensitive-data detection, reveal secret headers, listen address.
  • General — routing mode, the two response-detail modes (tool_response_mode for Retrieve, direct_tool_response_mode for Direct), tool limits, response limit, call timeout, log level, telemetry, prompts.
  • Advanced — collapsible accordions per subsystem (code execution, Docker isolation, sensitive-data detection, output validation, output sanitisation, activity retention, logging, TLS, …).
  • Raw JSON — the full Monaco editor, kept as an escape hatch.
  • Server Edition — server edition only: admin_emails, front-door keys, OAuth provider settings and the access group-to-server map that decides tenant entitlement (see Server Edition).

How saving works​

Each section saves only the fields you changed via PATCH /api/v1/config, a partial deep-merge that routes through the normal validate → persist → hot-reload pipeline. Because the merge starts from the live config and overlays just your changes, unrelated values and masked secrets (API key, secret headers) are never overwritten.

Fields that need a restart (listen, api_key, routing_mode, tls.*, code_execution_pool_size, and most of server_edition — enabled, oauth.*, public_url, session_cookie_secure, session_ttl, bearer_token_ttl, credential_encryption_key) show a restart badge — the two response-detail modes deliberately carry no badge, because they hot-reload; likewise server_edition.admin_emails and server_edition.access (the group-to-server map) apply on the next request with no restart and no badge, so editing who is an administrator or which group sees which server never needs a bounce. Sensitive changes (reveal secret headers, disabling quarantine/management, binding to a non-loopback address) require an explicit confirmation before they apply.

# Equivalent API call — change one field, everything else preserved
curl -X PATCH -H "X-API-Key: $KEY" -H 'Content-Type: application/json' \
  -d '{"quarantine_enabled": false}' http://127.0.0.1:8080/api/v1/config

Complex lists/maps (Docker image map, custom detection patterns, environment vars) and mcpServers / registries are managed on their own pages or the Raw JSON tab. See the configuration reference for the full option list.