secure-mcp-server

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Secure MCP Server

保护 MCP Server

Overview

概述

Applies a security or traffic management policy to an MCP server and deploys it to a self-managed Omni Gateway, walking through the full process from identifying the target MCP server to selecting a policy, configuring it, and deploying. Supports multiple starting points depending on what the user already has set up — an API Manager instance, an Exchange asset, or just an MCP server specification.

What you'll build: A fully configured policy enforced on your MCP server instance, deployed to a Omni Gateway

将安全或流量管理 Policy 应用于 MCP Server，并将其部署到自管理的 Omni Gateway；整个流程涵盖从识别目标 MCP Server，到选择、配置并部署 Policy 的完整过程。根据用户当前已有的设置，支持多种起始路径——API Manager 实例、Exchange 资产，或仅有 MCP Server 规范。

你将构建： 一个配置完备、已在 MCP Server 实例上强制执行并部署到 Omni Gateway 的 Policy

Architecture

架构

mermaid

sequenceDiagram
    participant User
    participant Exchange
    participant API Manager
    participant Omni Gateway
    participant Policy Catalog

    User->>Exchange: Publish MCP Server spec
    User->>Exchange: Find MCP Server asset
    Exchange-->>User: groupId, assetId, version
    User->>API Manager: Create Instance
    API Manager-->>User: instanceId
    User->>Omni Gateway: Deploy Instance
    Omni Gateway-->>User: Deployment active
    User->>Policy Catalog: Browse compatible policies
    Policy Catalog-->>User: Policy template + config schema
    User->>API Manager: Apply policy with config
    API Manager-->>Omni Gateway: Policy enforced

mermaid

sequenceDiagram
    participant User
    participant Exchange
    participant API Manager
    participant Omni Gateway
    participant Policy Catalog

    User->>Exchange: Publish MCP Server spec
    User->>Exchange: Find MCP Server asset
    Exchange-->>User: groupId, assetId, version
    User->>API Manager: Create Instance
    API Manager-->>User: instanceId
    User->>Omni Gateway: Deploy Instance
    Omni Gateway-->>User: Deployment active
    User->>Policy Catalog: Browse compatible policies
    Policy Catalog-->>User: Policy template + config schema
    User->>API Manager: Apply policy with config
    API Manager-->>Omni Gateway: Policy enforced

Prerequisites

前置条件

Before starting, ensure you have:

Authentication ready
- Valid Bearer token for Anypoint Platform. If you only have username/password, call
```
createLogin
```
  (
```
POST /accounts/login
```
  ) from the
```
urn:api:access-management
```
  API with body
```
{"username":"...","password":"..."}
```
  to obtain a Bearer token first.
- API Manager permissions: View APIs Configuration and Manage Policies scopes
Organization Id
- Call
```
listMe
```
  (
```
GET /accounts/api/me
```
  ) from
```
urn:api:access-management
```
  to get your organization ID
- Extract
```
organizationId
```
  from
```
$.user.organization.id
```
  in the response
- This is used to list environments, browse the policy catalog, check Exchange, etc.
One of the following
- An API instance already in API Manager for the MCP server (skip to Step 3, then Step 7)
- An MCP server asset already in Exchange (skip to Step 2)
- An MCP server specification that needs to be published first (start at Step 1)

开始前，请确保你具备：

身份验证已就绪
- Anypoint Platform 的有效 Bearer token。如果你只有用户名/密码，请先调用
```
urn:api:access-management
```
  API 的
```
createLogin
```
  （
```
POST /accounts/login
```
  ），请求体为
```
{"username":"...","password":"..."}
```
  ，以获取 Bearer token。
- API Manager 权限：View APIs Configuration 和 Manage Policies 权限范围
组织 ID
- 调用
```
urn:api:access-management
```
  的
```
listMe
```
  （
```
GET /accounts/api/me
```
  ）获取组织 ID
- 从响应中的
```
$.user.organization.id
```
  提取
```
organizationId
```
- 该 ID 用于列出 Environment、浏览 Policy Catalog、检查 Exchange 等操作
以下任一项
- API Manager 中已经存在该 MCP Server 的 API 实例（跳至步骤 3，然后步骤 7）
- Exchange 中已存在 MCP Server 资产（跳至步骤 2）
- 需要先发布的 MCP Server 规范（从步骤 1 开始）

Choose Your Path

选择你的路径

mermaid

flowchart TD
    Start{What do you have?} -->|MCP server spec only| Full[Full Setup]
    Start -->|Asset in Exchange| FromExchange[From Exchange]
    Start -->|API Manager instance| PolicyOnly[Apply Policy Only]

    Full --> S1[Step 1: Publish to Exchange]
    S1 --> S2[Step 2: Find in Exchange]
    FromExchange --> S2
    S2 --> S3[Step 3: Select Environment]
    S3 --> S4[Step 4: Select Gateway Target]
    S4 --> S5[Step 5: Create API Instance]
    S5 --> S6[Step 6: Deploy to Gateway]

    PolicyOnly --> S3b[Step 3: Select Environment]
    S3b --> S7[Step 7: List MCP Instances]

    S6 --> S8[Step 8: Browse Policies]
    S7 --> S8

    S8 --> S9[Step 9: Apply Policy]
    S9 --> Done[✓ MCP Server Protected]

mermaid

flowchart TD
    Start{What do you have?} -->|MCP server spec only| Full[Full Setup]
    Start -->|Asset in Exchange| FromExchange[From Exchange]
    Start -->|API Manager instance| PolicyOnly[Apply Policy Only]

    Full --> S1[Step 1: Publish to Exchange]
    S1 --> S2[Step 2: Find in Exchange]
    FromExchange --> S2
    S2 --> S3[Step 3: Select Environment]
    S3 --> S4[Step 4: Select Gateway Target]
    S4 --> S5[Step 5: Create API Instance]
    S5 --> S6[Step 6: Deploy to Gateway]

    PolicyOnly --> S3b[Step 3: Select Environment]
    S3b --> S7[Step 7: List MCP Instances]

    S6 --> S8[Step 8: Browse Policies]
    S7 --> S8

    S8 --> S9[Step 9: Apply Policy]
    S9 --> Done[✓ MCP Server Protected]

Execution Paths

执行路径

This skill has multiple execution paths depending on what you already have:

Full setup: Steps 1, 2, 3, 4, 5, 6, 8, 9
- When: You have an MCP server specification and need to publish it to Exchange first
- You'll need:
```
organizationId
```
  , MCP server specification file
From Exchange asset: Steps 2, 3, 4, 5, 6, 8, 9
- When: The MCP server is already published in Exchange and you need to find it and create an API Manager instance
- You'll need:
```
organizationId
```
Apply policy only: Steps 3, 7, 8, 9
- When: You already have an API Manager instance for the MCP server and want to apply a policy
- You'll need:
```
organizationId
```

此 skill 根据你已有的配置提供多种执行路径：

完整设置：步骤 1、2、3、4、5、6、8、9
- 适用情形：你拥有 MCP Server 规范，需要先将其发布到 Exchange
- 你需要：
```
organizationId
```
  、MCP Server 规范文件
从 Exchange 资产开始：步骤 2、3、4、5、6、8、9
- 适用情形：MCP Server 已发布到 Exchange，你需要查找它并创建 API Manager 实例
- 你需要：
```
organizationId
```
仅应用 Policy：步骤 3、7、8、9
- 适用情形：你已经拥有 MCP Server 的 API Manager 实例，并希望应用 Policy
- 你需要：
```
organizationId
```

Step 1: Publish MCP Server to Exchange

步骤 1：将 MCP Server 发布到 Exchange

Publishes your MCP server specification to Exchange as a reusable asset. This makes it available for API Manager to create managed instances from it.

What you'll need:

Organization ID
MCP server specification file
Asset name, groupId, assetId, and version

Action: Create a new asset in Exchange with your MCP server specification.

yaml

api: urn:api:exchange-experience
operationId: uploadAsset
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Your organization's Business Group GUID
  groupId:
    userProvided: true
    description: The group ID for the asset (typically matches your organization ID)
    example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
  assetId:
    userProvided: true
    description: A unique identifier for the asset in kebab-case
    example: "my-mcp-server"
  version:
    userProvided: true
    description: Semantic version for the asset
    example: "1.0.0"
outputs:
  - name: groupId
    path: $.groupId
    description: The group ID of the published asset
  - name: assetId
    path: $.assetId
    description: The asset ID of the published asset
  - name: assetVersion
    path: $.version
    description: The version of the published asset

What happens next: Your MCP server specification is now available in Exchange. Next, you can search for it to confirm and extract the coordinates needed for API Manager.

将你的 MCP Server 规范发布到 Exchange，作为可复用资产。这样 API Manager 便可基于它创建托管实例。

你需要：

组织 ID
MCP Server 规范文件
资产名称、groupId、assetId 和 version

操作： 使用 MCP Server 规范在 Exchange 中创建新资产。

yaml

api: urn:api:exchange-experience
operationId: uploadAsset
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Your organization's Business Group GUID
  groupId:
    userProvided: true
    description: The group ID for the asset (typically matches your organization ID)
    example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
  assetId:
    userProvided: true
    description: A unique identifier for the asset in kebab-case
    example: "my-mcp-server"
  version:
    userProvided: true
    description: Semantic version for the asset
    example: "1.0.0"
outputs:
  - name: groupId
    path: $.groupId
    description: The group ID of the published asset
  - name: assetId
    path: $.assetId
    description: The asset ID of the published asset
  - name: assetVersion
    path: $.version
    description: The version of the published asset

接下来： 你的 MCP Server 规范现在已可在 Exchange 中使用。接下来，可以搜索它进行确认，并提取 API Manager 所需的坐标信息。

Step 2: Find MCP Server in Exchange

步骤 2：在 Exchange 中查找 MCP Server

Search Exchange for MCP server assets. This search is not scoped to a specific organization — it returns all MCP server assets visible to the authenticated user across all organizations.

What you'll need:

Valid Bearer token (from Prerequisites)

Action: Search Exchange filtering by MCP asset type and select the target MCP server.

yaml

api: urn:api:exchange-experience
operationId: searchAssets
inputs:
  types:
    value: "mcp"
    description: Filter for MCP server assets only
outputs:
  - name: groupId
    path: $[*].groupId
    labels: $[*].name
    description: Group ID of the selected MCP server asset
  - name: assetId
    path: $[*].assetId
    description: Asset ID of the selected MCP server asset
  - name: assetVersion
    path: $[*].version
    description: Version of the selected MCP server asset

What happens next: You have the Exchange coordinates (groupId, assetId, version) for the MCP server. Next, select an environment where the API instance will be created.

在 Exchange 中搜索 MCP Server 资产。此搜索不限定于特定组织——它会返回当前认证用户在所有组织中可见的全部 MCP Server 资产。

你需要：

有效 Bearer token（见前置条件）

操作： 搜索 Exchange，按 MCP 资产类型筛选，然后选择目标 MCP Server。

yaml

api: urn:api:exchange-experience
operationId: searchAssets
inputs:
  types:
    value: "mcp"
    description: Filter for MCP server assets only
outputs:
  - name: groupId
    path: $[*].groupId
    labels: $[*].name
    description: Group ID of the selected MCP server asset
  - name: assetId
    path: $[*].assetId
    description: Asset ID of the selected MCP server asset
  - name: assetVersion
    path: $[*].version
    description: Version of the selected MCP server asset

接下来： 你已获得 MCP Server 的 Exchange 坐标（groupId、assetId、version）。接下来，选择用于创建 API 实例的 Environment。

Step 3: List Environments

步骤 3：列出 Environment

List all environments in the organization so you can confirm or select the one where your MCP server instance will live.

What you'll need:

Organization ID

Action: List available environments and select the target.

yaml

api: urn:api:access-management
operationId: listEnvironments
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID from Prerequisites
outputs:
  - name: environmentId
    path: $.data[*].id
    labels: $.data[*].name
    description: Selected environment ID (e.g., Production, Sandbox)

What happens next: With the environment selected, you can create an API instance or browse policies.

列出组织中的所有 Environment，以便确认或选择 MCP Server 实例所在的位置。

你需要：

组织 ID

操作： 列出可用 Environment 并选择目标。

yaml

api: urn:api:access-management
operationId: listEnvironments
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID from Prerequisites
outputs:
  - name: environmentId
    path: $.data[*].id
    labels: $.data[*].name
    description: Selected environment ID (e.g., Production, Sandbox)

接下来： 选择 Environment 后，即可创建 API 实例或浏览 Policy。

Step 4: Select Deployment Target

步骤 4：选择部署目标

List available gateway targets registered in the environment. You need the target ID and gateway version before creating the API instance, because the deployment configuration is set via a PATCH after creation.

What you'll need:

Organization ID and Environment ID

Action: List gateway targets and select the Omni Gateway where the MCP server will run. Prefer a target with

status: "RUNNING"

yaml

api: urn:api:api-portal-xapi
operationId: getGatewayTargets
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3
outputs:
  - name: targetId
    path: $.rows[*].id
    labels: $.rows[*].name
    description: Selected gateway target ID
  - name: targetName
    path: $.rows[*].name
    description: Name of the selected gateway target
  - name: gatewayVersion
    value: "1.0.0"
    description: Gateway version to use for deployment. The targets response may return "-" instead of a real version; use "1.0.0" as the default.

What happens next: You have a deployment target and its gateway version. Next, create the API instance and then configure its deployment target.

列出在 Environment 中注册的 Gateway 目标。创建 API 实例前，需要目标 ID 和 Gateway 版本，因为部署配置会在创建后通过 PATCH 设置。

你需要：

组织 ID 和 Environment ID

操作： 列出 Gateway 目标并选择运行 MCP Server 的 Omni Gateway。优先选择

status: "RUNNING"

的目标。

yaml

api: urn:api:api-portal-xapi
operationId: getGatewayTargets
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3
outputs:
  - name: targetId
    path: $.rows[*].id
    labels: $.rows[*].name
    description: Selected gateway target ID
  - name: targetName
    path: $.rows[*].name
    description: Name of the selected gateway target
  - name: gatewayVersion
    value: "1.0.0"
    description: Gateway version to use for deployment. The targets response may return "-" instead of a real version; use "1.0.0" as the default.

接下来： 你已获得部署目标及其 Gateway 版本。接下来，创建 API 实例并配置其部署目标。

Step 5: Create API Manager Instance

步骤 5：创建 API Manager 实例

Creates a managed API instance in API Manager from your MCP server Exchange asset. This creates the API configuration; deployment to the Omni Gateway happens in Step 6.

Important: For Omni Gateway instances,

isCloudHub

must be

null

(not

false

). Setting it to

false

causes a validation error.

What you'll need:

Organization ID and Environment ID
Exchange asset coordinates (groupId, assetId, version)

Action: Create an API instance in the target environment.

yaml

api: urn:api:api-manager
operationId: createApiInstance
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Your organization's Business Group GUID
  environmentId:
    from:
      variable: environmentId
    description: Target environment ID from Step 3
  groupId:
    from:
      variable: groupId
    description: Exchange asset group ID from Step 2
  assetId:
    from:
      variable: assetId
    description: Exchange asset ID from Step 2
  assetVersion:
    from:
      variable: assetVersion
    description: Exchange asset version from Step 2
  instanceLabel:
    userProvided: true
    description: A human-readable label for this API instance (e.g., "my-mcp-server-v1")
    example: "my-mcp-server-v1"
  technology:
    value: "flexGateway"
    description: Gateway technology — this skill targets Omni Gateway deployments
  endpoint.isCloudHub:
    value: null
    description: "Must be null for flexGateway technology (not false — false causes a validation error)"
  endpoint.proxyUri:
    userProvided: true
    description: "The proxy listener URI. Ask the user which port the Omni Gateway should listen on, then use http://0.0.0.0:<port>/"
    example: "http://0.0.0.0:8081/"
  endpoint.uri:
    userProvided: true
    optional: true
    description: The upstream backend URL for the MCP server. Ask the user if they want to provide it now or configure it later.
    example: "https://backend.example.com/mcp/v1"
outputs:
  - name: environmentApiId
    path: $.id
    description: The API instance ID in API Manager

What happens next: The API instance exists but is not yet deployed. Next, deploy it to the Omni Gateway target selected in Step 4.

基于 Exchange 中的 MCP Server 资产，在 API Manager 中创建托管 API 实例。该操作会创建 API 配置；部署到 Omni Gateway 将在步骤 6 中完成。

重要： 对于 Omni Gateway 实例，

isCloudHub

必须为

null

（不能为

false

）。设为

false

会导致验证错误。

你需要：

组织 ID 和 Environment ID
Exchange 资产坐标（groupId、assetId、version）

操作： 在目标 Environment 中创建 API 实例。

yaml

api: urn:api:api-manager
operationId: createApiInstance
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Your organization's Business Group GUID
  environmentId:
    from:
      variable: environmentId
    description: Target environment ID from Step 3
  groupId:
    from:
      variable: groupId
    description: Exchange asset group ID from Step 2
  assetId:
    from:
      variable: assetId
    description: Exchange asset ID from Step 2
  assetVersion:
    from:
      variable: assetVersion
    description: Exchange asset version from Step 2
  instanceLabel:
    userProvided: true
    description: A human-readable label for this API instance (e.g., "my-mcp-server-v1")
    example: "my-mcp-server-v1"
  technology:
    value: "flexGateway"
    description: Gateway technology — this skill targets Omni Gateway deployments
  endpoint.isCloudHub:
    value: null
    description: "Must be null for flexGateway technology (not false — false causes a validation error)"
  endpoint.proxyUri:
    userProvided: true
    description: "The proxy listener URI. Ask the user which port the Omni Gateway should listen on, then use http://0.0.0.0:<port>/"
    example: "http://0.0.0.0:8081/"
  endpoint.uri:
    userProvided: true
    optional: true
    description: The upstream backend URL for the MCP server. Ask the user if they want to provide it now or configure it later.
    example: "https://backend.example.com/mcp/v1"
outputs:
  - name: environmentApiId
    path: $.id
    description: The API instance ID in API Manager

接下来： API 实例已经创建，但尚未部署。接下来，将其部署到步骤 4 中选择的 Omni Gateway 目标。

Step 6: Deploy to Omni Gateway

步骤 6：部署到 Omni Gateway

Deploys the API instance to the selected Omni Gateway target. This uses the Proxies API deployment endpoint with flat top-level fields — do not use the nested

target

object, which requires additional fields that are not needed for self-managed Omni Gateway deployments.

What you'll need:

Organization ID, Environment ID, and API instance ID from Step 5
Deployment target ID and gateway version from Step 4

Action: Create a deployment for the API instance on the selected Omni Gateway.

yaml

api: urn:api:proxies-xapi
operationId: createProxyDeployment
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3 (used in both the URL path and the request body for HY deployment type)
  environmentApiId:
    from:
      variable: environmentApiId
    description: API instance ID from Step 5
  type:
    value: "HY"
    description: "Deployment type for self-managed Omni Gateway (HY = Hybrid)"
  targetId:
    from:
      variable: targetId
    description: Omni Gateway target ID from Step 4
  targetName:
    from:
      variable: targetName
    description: Omni Gateway target name from Step 4
  gatewayVersion:
    value: "1.0.0"
    description: "Gateway version for deployment. Use \"1.0.0\" as the default."
  overwrite:
    value: false
    description: "Whether to overwrite an existing deployment"
outputs:
  - name: deploymentId
    path: $.id
    description: The ID of the proxy deployment

Request body structure: Use flat top-level fields, not the nested

target

object:

json

{
  "type": "HY",
  "targetId": "<from Step 4>",
  "targetName": "<from Step 4>",
  "gatewayVersion": "1.0.0",
  "environmentId": "<from Step 3>",
  "overwrite": false
}

What happens next: The MCP server instance is now deployed to the Omni Gateway. Next, browse the policy catalog to select which policy to apply.

Common issues:

"Field environmentId is required for deployment type HY"
: The

environmentId

must be in the request body, not just the URL path parameter.

"Field gatewayVersion is required for deployment type HY"
: Use the version from the
```
getGatewayTargets
```
response (Step 4). Using an incorrect version causes policy implementation errors.
"Policy implementations cannot be set because runtime version is unknown"
: The
```
gatewayVersion
```
value doesn't match a known Omni Gateway version. Verify the version from the target's actual runtime version in Step 4.
409 Conflict: The MCP server may already be deployed to this target. List existing deployments with
```
GET .../deployments
```
first to check.

将 API 实例部署到所选 Omni Gateway 目标。此操作使用 Proxies API 部署端点，并采用扁平化的顶层字段——不要使用嵌套的

target

对象，因为后者需要此处不需要的额外字段。

你需要：

步骤 5 中的组织 ID、Environment ID 和 API 实例 ID
步骤 4 中的部署目标 ID 和 Gateway 版本

操作： 在所选 Omni Gateway 上为 API 实例创建部署。

yaml

api: urn:api:proxies-xapi
operationId: createProxyDeployment
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3 (used in both the URL path and the request body for HY deployment type)
  environmentApiId:
    from:
      variable: environmentApiId
    description: API instance ID from Step 5
  type:
    value: "HY"
    description: "Deployment type for self-managed Omni Gateway (HY = Hybrid)"
  targetId:
    from:
      variable: targetId
    description: Omni Gateway target ID from Step 4
  targetName:
    from:
      variable: targetName
    description: Omni Gateway target name from Step 4
  gatewayVersion:
    value: "1.0.0"
    description: "Gateway version for deployment. Use \"1.0.0\" as the default."
  overwrite:
    value: false
    description: "Whether to overwrite an existing deployment"
outputs:
  - name: deploymentId
    path: $.id
    description: The ID of the proxy deployment

请求体结构： 使用扁平化的顶层字段，而不是嵌套的

target

对象：

json

{
  "type": "HY",
  "targetId": "<from Step 4>",
  "targetName": "<from Step 4>",
  "gatewayVersion": "1.0.0",
  "environmentId": "<from Step 3>",
  "overwrite": false
}

接下来： MCP Server 实例现已部署到 Omni Gateway。接下来，浏览 Policy Catalog 以选择要应用的 Policy。

常见问题：

"Field environmentId is required for deployment type HY"
：
```
environmentId
```
必须位于请求体中，而不能只放在 URL 路径参数里。
"Field gatewayVersion is required for deployment type HY"
：使用步骤 4 中
```
getGatewayTargets
```
响应里的版本。使用错误的版本会导致 Policy 实施错误。
"Policy implementations cannot be set because runtime version is unknown"
：
```
gatewayVersion
```
的值与已知 Omni Gateway 版本不匹配。请根据步骤 4 中目标的实际运行时版本进行验证。
409 Conflict：MCP Server 可能已经部署到此目标。请先使用
```
GET .../deployments
```
列出已有部署并进行检查。

Step 7: List MCP Server Instances

步骤 7：列出 MCP Server 实例

Lists MCP server instances in the selected environment by filtering with

family=agentic

. Use this step when you already have an API Manager instance for the MCP server and need to find its ID to apply a policy.

What you'll need:

Organization ID and Environment ID

Action: List MCP server instances and select the target.

yaml

api: urn:api:api-manager
operationId: listApiInstances
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3
  family:
    value: "agentic"
    description: Filter for MCP server (agentic) instances only
outputs:
  - name: environmentApiId
    path: $.assets[*].apis[*].id
    labels: $.assets[*].apis[*].autodiscoveryInstanceName
    description: The MCP server instance ID in API Manager

What happens next: You have the MCP server instance ID. Next, browse the policy catalog to select which policy to apply.

在选定 Environment 中列出 MCP Server 实例，筛选条件为

family=agentic

。当 MCP Server 已有 API Manager 实例、需要找到其 ID 以应用 Policy 时，使用此步骤。

你需要：

组织 ID 和 Environment ID

操作： 列出 MCP Server 实例并选择目标。

yaml

api: urn:api:api-manager
operationId: listApiInstances
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3
  family:
    value: "agentic"
    description: Filter for MCP server (agentic) instances only
outputs:
  - name: environmentApiId
    path: $.assets[*].apis[*].id
    labels: $.assets[*].apis[*].autodiscoveryInstanceName
    description: The MCP server instance ID in API Manager

接下来： 你已获得 MCP Server 实例 ID。接下来，浏览 Policy Catalog 以选择要应用的 Policy。

Step 8: Browse Exchange Policy Catalog

步骤 8：浏览 Exchange Policy Catalog

List all available policy templates from Exchange for your organization. This endpoint returns the full Exchange coordinates (

groupId

assetId

assetVersion

) and gateway-compatible configuration for each template — these are required when applying a policy.

Important: Use the

api-portal-xapi

endpoint (

getExchangePolicyTemplates

) instead of the generic

listPolicyTemplates

endpoint. The generic endpoint does not return Exchange coordinates or gateway-specific configuration property names, which are required for the apply step.

What you'll need:

Organization ID
Environment ID and API instance ID (to filter for compatible templates)

Action: List Exchange policy templates and select the one to apply. Pass

apiInstanceId

and

environmentId

to filter for templates compatible with your MCP server's gateway type (e.g., Omni Gateway, Mule Gateway).

yaml

api: urn:api:api-portal-xapi
operationId: getExchangePolicyTemplates
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  apiInstanceId:
    from:
      variable: environmentApiId
    description: API instance ID from Step 5 or Step 7 (filters for compatible templates)
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3
  latest:
    value: "true"
    description: Return only the latest version of each template
  includeConfiguration:
    value: "true"
    description: Include the configuration schema for each template
outputs:
  - name: policyGroupId
    path: $[*].groupId
    labels: $[*].assetId
    description: Exchange group ID of the selected policy template
  - name: policyAssetId
    path: $[*].assetId
    description: Exchange asset ID of the selected policy template
  - name: policyAssetVersion
    path: $[*].version
    description: Exchange version of the selected policy template (gateway-compatible)
  - name: policyConfiguration
    path: $[*].configuration
    description: Configuration schema with gateway-compatible property names and defaults

What happens next: You have the policy template's Exchange coordinates and its configuration schema with the correct property names for your gateway type. Review the

policyConfiguration

output to understand what settings the policy accepts before applying it.

Common issues:

Empty list: Pass
```
apiInstanceId
```
and
```
environmentId
```
to get templates compatible with your gateway type. Without these filters, some templates may not appear.
Wrong config property names: Always use the configuration from this endpoint — the generic
```
listPolicyTemplates
```
endpoint may return different (non-gateway-compatible) property names and defaults.

为你的组织列出 Exchange 中所有可用的 Policy 模板。此端点会返回每个模板的完整 Exchange 坐标（

groupId

、

assetId

、

assetVersion

）以及 Gateway 兼容配置——应用 Policy 时必须使用这些信息。

重要： 使用

api-portal-xapi

端点（

getExchangePolicyTemplates

），而不是通用

listPolicyTemplates

端点。通用端点不返回 Exchange 坐标或特定于 Gateway 的配置属性名称，而应用步骤需要这些信息。

你需要：

组织 ID
Environment ID 和 API 实例 ID（用于筛选兼容模板）

操作： 列出 Exchange Policy 模板并选择要应用的模板。传入

apiInstanceId

和

environmentId

，筛选与 MCP Server 的 Gateway 类型（例如 Omni Gateway、Mule Gateway）兼容的模板。

yaml

api: urn:api:api-portal-xapi
operationId: getExchangePolicyTemplates
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  apiInstanceId:
    from:
      variable: environmentApiId
    description: API instance ID from Step 5 or Step 7 (filters for compatible templates)
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3
  latest:
    value: "true"
    description: Return only the latest version of each template
  includeConfiguration:
    value: "true"
    description: Include the configuration schema for each template
outputs:
  - name: policyGroupId
    path: $[*].groupId
    labels: $[*].assetId
    description: Exchange group ID of the selected policy template
  - name: policyAssetId
    path: $[*].assetId
    description: Exchange asset ID of the selected policy template
  - name: policyAssetVersion
    path: $[*].version
    description: Exchange version of the selected policy template (gateway-compatible)
  - name: policyConfiguration
    path: $[*].configuration
    description: Configuration schema with gateway-compatible property names and defaults

接下来： 你已获得 Policy 模板的 Exchange 坐标，以及包含正确属性名称的配置 Schema。请检查

policyConfiguration

输出，了解该 Policy 支持的设置项，然后再应用它。

常见问题：

列表为空：传入
```
apiInstanceId
```
和
```
environmentId
```
，以获取与 Gateway 类型兼容的模板。未使用这些筛选条件时，部分模板可能不会显示。
配置属性名称错误：始终使用此端点返回的配置。通用
```
listPolicyTemplates
```
端点可能返回不同的、非 Gateway 兼容的属性名称和默认值。

Step 9: Apply Policy to API Instance

步骤 9：将 Policy 应用到 API 实例

Apply the selected policy to your MCP server instance with the appropriate configuration. Use the Exchange coordinates and configuration property names from Step 8.

What you'll need:

Organization ID, Environment ID, and API instance ID
Policy Exchange coordinates (groupId, assetId, assetVersion) from Step 8
Policy configuration based on the schema from Step 8's
```
policyConfiguration
```
output

Action: Apply the policy to your API instance. Build the

configurationData

object using the property names from Step 8's configuration schema. For each configuration property, present the user with the property name, its description, and the default value, then ask if they want to keep the default or provide a custom value. If a property has no default, always ask the user for a value.

yaml

api: urn:api:api-manager
operationId: applyApiInstancePolicy
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3
  environmentApiId:
    from:
      variable: environmentApiId
    description: API instance ID from Step 5 or Step 7 (or provided manually)
  groupId:
    from:
      variable: policyGroupId
    description: Policy Exchange group ID from Step 8
  assetId:
    from:
      variable: policyAssetId
    description: Policy Exchange asset ID from Step 8
  assetVersion:
    from:
      variable: policyAssetVersion
    description: Policy Exchange version from Step 8
outputs:
  - name: policyId
    path: $.id
    description: The ID of the applied policy instance

What happens next: Your MCP server is now protected with the selected policy. Since the API instance was configured with deployment information in Step 6, the policy is active and enforcing on the Omni Gateway.

Common issues:

400 Bad Request — missing groupId/assetId/assetVersion: The apply endpoint requires full Exchange coordinates, not just a template ID. Make sure you used
```
getExchangePolicyTemplates
```
(Step 8) to get these values.
400 Bad Request — invalid configurationData: The configuration property names differ between gateway types. Use the property names from Step 8's
```
policyConfiguration
```
output, not from the generic template endpoint. For example, Omni Gateway uses
```
credentialsOriginHasHttpBasicAuthenticationHeader
```
while the generic template uses
```
credentialsOrigin
```
.
409 Conflict: A policy of this type may already be applied to the API instance. List existing policies first to check, or add
```
?allowDuplicated=true
```
to the request URL to apply a second instance of the same policy type.
403 Forbidden: You need Manage Policies permission in the target environment.

使用适当的配置，将选定 Policy 应用到 MCP Server 实例。使用步骤 8 中的 Exchange 坐标和配置属性名称。

你需要：

组织 ID、Environment ID 和 API 实例 ID
步骤 8 中的 Policy Exchange 坐标（groupId、assetId、assetVersion）
根据步骤 8 的
```
policyConfiguration
```
输出生成的 Policy 配置

操作： 将 Policy 应用到 API 实例。使用步骤 8 配置 Schema 中的属性名称构建

configurationData

对象。对于每个配置属性，向用户展示属性名称、说明和默认值，然后询问用户是保留默认值还是提供自定义值。如果属性没有默认值，始终要求用户提供值。

yaml

api: urn:api:api-manager
operationId: applyApiInstancePolicy
inputs:
  organizationId:
    from:
      api: urn:api:access-management
      operation: listMe
      field: $.user.organization.id
    description: Organization ID
  environmentId:
    from:
      variable: environmentId
    description: Environment ID from Step 3
  environmentApiId:
    from:
      variable: environmentApiId
    description: API instance ID from Step 5 or Step 7 (or provided manually)
  groupId:
    from:
      variable: policyGroupId
    description: Policy Exchange group ID from Step 8
  assetId:
    from:
      variable: policyAssetId
    description: Policy Exchange asset ID from Step 8
  assetVersion:
    from:
      variable: policyAssetVersion
    description: Policy Exchange version from Step 8
outputs:
  - name: policyId
    path: $.id
    description: The ID of the applied policy instance

接下来： 你的 MCP Server 现在已受到选定 Policy 的保护。由于 API 实例已在步骤 6 中配置了部署信息，因此该 Policy 已在 Omni Gateway 上激活并开始强制执行。

常见问题：

400 Bad Request — 缺少 groupId/assetId/assetVersion：应用端点需要完整的 Exchange 坐标，而不只是模板 ID。请确保使用步骤 8 中的
```
getExchangePolicyTemplates
```
获取这些值。
400 Bad Request — configurationData 无效：不同 Gateway 类型的配置属性名称有所不同。请使用步骤 8 中
```
policyConfiguration
```
输出提供的属性名称，而不是通用模板端点中的名称。例如，Omni Gateway 使用
```
credentialsOriginHasHttpBasicAuthenticationHeader
```
，而通用模板使用
```
credentialsOrigin
```
。
409 Conflict：API 实例上可能已经应用了此类型的 Policy。请先列出已有 Policy 进行检查，或者在请求 URL 中添加
```
?allowDuplicated=true
```
，以应用同类型 Policy 的第二个实例。
403 Forbidden：你需要在目标 Environment 中拥有 Manage Policies 权限。

Completion Checklist

完成检查清单

What You've Built

你已经构建的内容

Your MCP server is now protected with:

Policy enforcement — Selected policy is active on your MCP server instance. All incoming traffic is evaluated against policy rules.
Bound to Omni Gateway — API instance is created with deployment configuration targeting a self-managed Omni Gateway. The Omni Gateway picks up the configuration automatically.
Managed configuration — Policy settings are version-controlled in API Manager. Configuration can be updated without redeploying the MCP server.

你的 MCP Server 现在受到以下保护：

Policy 强制执行 — 所选 Policy 已在 MCP Server 实例上激活。所有传入流量都会依据 Policy 规则接受评估。
绑定至 Omni Gateway — API 实例已创建，并带有指向自管理 Omni Gateway 的部署配置。Omni Gateway 会自动获取该配置。
托管配置 — Policy 设置在 API Manager 中进行版本控制。无需重新部署 MCP Server 即可更新配置。

Next Steps

后续步骤

Test the policy
- Send test requests to verify the policy is enforcing correctly
- Check that authorized requests pass and unauthorized ones are blocked
Add more policies
- Run this skill again to layer additional policies (e.g., rate limiting + OAuth2)
- Policy ordering matters — adjust priority in API Manager if needed
Monitor policy activity
- Check API Manager analytics for policy enforcement metrics
- Set up alerts for unusual rejection patterns

测试 Policy
- 发送测试请求，验证 Policy 是否正确执行
- 检查授权请求是否通过，以及未授权请求是否被阻止
添加更多 Policy
- 再次运行此 skill，以叠加其他 Policy（例如 Rate Limiting + OAuth2）
- Policy 顺序很重要——如有需要，在 API Manager 中调整优先级
监控 Policy 活动
- 查看 API Manager 分析数据中的 Policy 强制执行指标
- 针对异常拒绝模式设置告警

Tips and Best Practices

提示与最佳实践

Policy Selection

Policy 选择

Rate Limiting: Use when you need to control traffic volume per client
OAuth 2.0: Use for token-based authentication and authorization
IP Allowlist/Blocklist: Use to restrict access by network origin
Client ID Enforcement: Use to require registered client applications

Rate Limiting：用于控制每个客户端的流量规模
OAuth 2.0：用于基于 Token 的身份验证和授权
IP Allowlist/Blocklist：用于按网络来源限制访问
Client ID Enforcement：用于要求客户端应用必须完成注册

Policy Ordering

Policy 顺序

Authentication policies should be applied first (lowest order number)
Rate limiting should come after authentication
Transformation policies should be last

身份验证 Policy 应最先应用（顺序号最低）
Rate Limiting 应在身份验证之后
转换 Policy 应最后应用

Gateway Compatibility

Gateway 兼容性

Always use
```
getExchangePolicyTemplates
```
with
```
apiInstanceId
```
to get gateway-compatible templates
Configuration property names and defaults vary by gateway type (Omni Gateway vs. Mule Gateway)
The Exchange template version may differ from the generic template version

始终将
```
getExchangePolicyTemplates
```
与
```
apiInstanceId
```
配合使用，以获取 Gateway 兼容模板
配置属性名称和默认值因 Gateway 类型而异（Omni Gateway 与 Mule Gateway）
Exchange 模板版本可能不同于通用模板版本

MCP Server Discovery

MCP Server 发现

The Exchange search in Step 2 is not org-scoped — it returns all MCP servers visible to the authenticated user
Use the asset
```
name
```
field to identify the correct MCP server when multiple results are returned
If you published the MCP server in Step 1, its coordinates are already available — Step 2 can be used to confirm

步骤 2 中的 Exchange 搜索不限定组织范围——它会返回当前认证用户可见的所有 MCP Server
当返回多个结果时，使用资产的
```
name
```
字段识别正确的 MCP Server
如果你已在步骤 1 中发布 MCP Server，则其坐标已经可用——可以使用步骤 2 进行确认

Troubleshooting

故障排除

Policy Not Enforcing

Policy 未执行

Symptoms: Requests pass through without policy evaluation

Possible causes:

API instance is not deployed or is in an error state
Policy configuration has a permissive default that allows all traffic
Policy is applied but not yet propagated (wait 1-2 minutes)

Solutions:

Check API instance status in API Manager
Review policy configuration for overly permissive settings
Wait for propagation and retry

症状： 请求未经 Policy 评估便通过

可能原因：

API 实例尚未部署或处于错误状态
Policy 配置包含允许所有流量的宽松默认值
Policy 已应用，但尚未传播（请等待 1–2 分钟）

解决方案：

检查 API Manager 中的 API 实例状态
检查 Policy 配置中是否存在过于宽松的设置
等待传播完成后重试

Policy Blocks All Requests

Policy 阻止所有请求

Symptoms: All requests return 401 or 403, even legitimate ones

Possible causes:

Policy configuration is too restrictive
Required credentials are not being sent correctly
Policy expects headers or parameters in a specific format

Solutions:

Review the policy configuration schema for required fields
Check that client applications are sending credentials in the expected format
Temporarily disable the policy to isolate the issue

症状： 即使是合法请求，所有请求也会返回 401 或 403

可能原因：

Policy 配置过于严格
所需凭据未正确发送
Policy 要求以特定格式提供 Header 或参数

解决方案：

检查 Policy 配置 Schema 中的必填字段
检查客户端应用是否按预期格式发送凭据
临时禁用 Policy 以隔离问题

400 Error When Applying Policy

应用 Policy 时出现 400 错误

Symptoms:

"The policy to be created is missing at least one of the following properties related to the policy template: 'groupId', 'assetId', 'assetVersion'."

Possible causes:

Used the generic
```
listPolicyTemplates
```
endpoint which does not return Exchange coordinates

Solutions:

Use
```
getExchangePolicyTemplates
```
from
```
api-portal-xapi
```
instead — this returns the full Exchange coordinates needed by the apply endpoint

症状：

"The policy to be created is missing at least one of the following properties related to the policy template: 'groupId', 'assetId', 'assetVersion'."

可能原因：

使用了通用
```
listPolicyTemplates
```
端点，而该端点不返回 Exchange 坐标

解决方案：

改用
```
api-portal-xapi
```
中的
```
getExchangePolicyTemplates
```
——它会返回应用端点所需的完整 Exchange 坐标

MCP Server Not Found in Exchange

在 Exchange 中找不到 MCP Server

Symptoms: Step 2 returns an empty list

Possible causes:

The MCP server has not been published to Exchange yet
The asset type is not
```
mcp
```

Solutions:

Start from Step 1 to publish the MCP server to Exchange first
Verify the asset was published with the correct type

症状： 步骤 2 返回空列表

可能原因：

MCP Server 尚未发布到 Exchange
资产类型不是
```
mcp
```

解决方案：

从步骤 1 开始，先将 MCP Server 发布到 Exchange
验证资产是否以正确类型发布

secure-mcp-server

Original

Translation

Secure MCP Server

保护 MCP Server

Overview

概述

Architecture

架构

Prerequisites

前置条件

Choose Your Path

选择你的路径

Execution Paths

执行路径

Step 1: Publish MCP Server to Exchange

步骤 1：将 MCP Server 发布到 Exchange

Step 2: Find MCP Server in Exchange

步骤 2：在 Exchange 中查找 MCP Server

Step 3: List Environments

步骤 3：列出 Environment

Step 4: Select Deployment Target

步骤 4：选择部署目标

Step 5: Create API Manager Instance

步骤 5：创建 API Manager 实例

Step 6: Deploy to Omni Gateway

步骤 6：部署到 Omni Gateway

Step 7: List MCP Server Instances

步骤 7：列出 MCP Server 实例

Step 8: Browse Exchange Policy Catalog

步骤 8：浏览 Exchange Policy Catalog

Step 9: Apply Policy to API Instance

步骤 9：将 Policy 应用到 API 实例

Completion Checklist

完成检查清单

What You've Built

你已经构建的内容

Next Steps

后续步骤

Tips and Best Practices

提示与最佳实践

Policy Selection

Policy 选择

Policy Ordering

Policy 顺序

Gateway Compatibility

Gateway 兼容性

MCP Server Discovery

MCP Server 发现

Troubleshooting

故障排除

Policy Not Enforcing

Policy 未执行

Policy Blocks All Requests

Policy 阻止所有请求

400 Error When Applying Policy

应用 Policy 时出现 400 错误

MCP Server Not Found in Exchange

在 Exchange 中找不到 MCP Server

Related Jobs

相关 Job