Portkey MCP server: MCP Gateway, plus community admin tools

Portkey, now part of Palo Alto Networks' Prisma AIRS, governs MCP traffic to other vendors' servers. Reading Portkey's own spend and logs takes its Admin API or a community wrapper around it.

Checked 3 October 2026 · from Portkey's MCP Gateway and Admin API docs, Palo Alto Networks' 29 May 2026 press release, npm, GitHub and the official MCP registry

One of 91 guides to monitoring and developer tools. Each covers what an AI coding agent can get out of the tool through MCP, the protocol that lets the agent query the tool directly.

How Portkey works with MCP

Portkey is an AI gateway. It sits in front of model providers and adds routing, caching, guardrails, budgets and request logs.

The MCP Gateway applies the same idea to tools. An admin registers a server once in the MCP Registry and provisions it to workspaces, and agents connect to https://mcp.portkey.ai/{server-slug}/mcp.

On each call the gateway checks the agent's Portkey key or identity-provider token, and its access to the server and tool. It then injects the upstream credentials. Every tool call is logged with user, parameters and response.

Spend, request logs and keys sit behind the Admin API at https://api.portkey.ai/v1. Its analytics endpoints, such as GET /analytics/graphs/cost, are marked beta.

Every vendor here gets the same four checks: official, maintained, distributed and usable. Portkey passes 0 of them.

Portkey's gateway data reaches MCP only through the community server. On non-Enterprise plans its analytics tools return 403, so spend questions there still need the dashboard or an Enterprise key.

What can an AI agent do with Portkey?

How to configure Portkey MCP for agents

1. 1

   Register before connecting

   An org admin adds the server under MCP Registry and provisions workspaces. Only then does a connection URL appear on the workspace MCP page.

2. 2

   The slug becomes the address

   Every connection is https://mcp.portkey.ai/{server-slug}/mcp, and self-hosted installs swap in their own gateway host.

3. 3

   Choose OAuth or a key per client

   OAuth 2.1 prompts on first use. Otherwise send a workspace user key with MCP Invoke permission in x-portkey-api-key.

4. 4

   Authenticate even for public servers

   Portkey's quickstart notes that DeepWiki needs no upstream credential, yet the gateway still requires OAuth or a Portkey key.

Paste this into your agent’s instructions

When you answer from Portkey data, state:
- Whether it came from the Admin API or from an upstream
  server behind the MCP Gateway.
- The workspace and time range of any cost figure.
If an analytics tool returns 403, report a scope problem.
Do not report it as zero spend.

Do you need the MCP server at all?

For spend in a script or dashboard, call the Admin API directly. GET /analytics/graphs/cost returns cost over time, with sibling endpoints for tokens, latency, errors and cache hit rate.

For an agent, portkey-admin-mcp is the MCP route. Its README puts the full 184-tool catalog at roughly 400 KB, so PORTKEY_TOOL_DOMAINS is worth setting.

An older community server, r-huijts/portkey-admin-mcp-server, was last pushed on 26 August 2025. The CodesWhat package has been on npm since 4 March 2026 and shipped 0.13.0 on 3 October 2026.

Use the MCP Gateway to govern other servers. Use the Admin API, directly or through portkey-admin-mcp, to read Portkey itself.

Portkey integration setup

Two setups cover the two jobs: the community server for Portkey's own data, and the gateway for other vendors' servers.

claude mcp add -e PORTKEY_API_KEY=<your-key> \
  -e PORTKEY_TOOL_DOMAINS=analytics,logging \
  portkey-admin -- npx -y portkey-admin-mcp

{"mcpServers":{"linear":{
  "url":"https://mcp.portkey.ai/linear/mcp",
  "headers":{"x-portkey-api-key":"<your-key>"}}}}

{"mcpServers":{"portkey-docs":{
  "url":"https://portkey.ai/docs/mcp"}}}

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

Name         deepwiki-test-mcp-server
URL          https://mcp.deepwiki.com/mcp
Slug         deepwiki-test-mcp-server
Server Type  Http
Auth Type    None

url = "https://mcp.portkey.ai/linear/mcp"
headers = {"x-portkey-api-key": "<your-key>"}

Read-only access, permissions and security

• One key serves every caller

  The portkey-admin-mcp README says all authenticated principals share the configured PORTKEY_API_KEY and can invoke any enabled tool it grants.

• Narrow by domain

  PORTKEY_TOOL_DOMAINS is a server-side allowlist over 20 domains, including analytics, logging, keys and configs.

• Prisma AIRS URLs do not work with it

  PORTKEY_BASE_URL must point at the Portkey Admin API; the README says Prisma AIRS and SCM URLs are not compatible.

• Gateway calls are logged

  Portkey records each MCP tool call with user, parameters and response, filterable by server, user or time range.

What the vendor documents

Portkey's docs describe the MCP Gateway as "a proxy between MCP Clients and MCP servers, handling authentication, access control, and logging". They describe the Admin API as REST endpoints, with no MCP wrapper of Portkey's own.

Should you connect an agent to Portkey?

Yes, through the community `portkey-admin-mcp` for Portkey data, or through the gateway for other servers. Best for portkey Enterprise teams who want an agent to report spend, and any team governing tool access centrally.

Strongest fit

Yes, through the community portkey-admin-mcp for Portkey data, or through the gateway for other servers.

Main advantage

One gateway URL per upstream server, with central authentication, provisioning and tool-call logs.

Main weakness

Portkey's own analytics reach MCP only through a third-party package, and those tools need Enterprise scope.

Operational risk

An Admin API key in an agent's environment can create keys and change configs unless domains are restricted.

Frequently asked questions