# GET /v1/mcp-servers/{server_id}/tools

> The tools we found, each with its setting in the server's tool policy floor.

In [MCP servers and secrets API](https://vestra.ai/developers/reference/api/mcp-servers-and-secrets.md): Your MCP servers and the tools they offer, and the secrets Bash uses but never shows.

Send `Authorization: Bearer vk_test_...` on every call.

The tools we found, each with its setting in the server's tool policy floor. A deployment version's own policy can add to it.

Your API key, scope `setup` or `all`. On the card: [`deploy`](https://vestra.ai/developers/deploy.md). Over HTTP it is made from the contract: fill in each {…} and every value.

## Request

Path:

- `server_id` (`string`, required): The MCP server's id (`mcp_...`).

Query:

- `user_id` (`string`): Your id for a user, to fill in their `${user_secret:NAME}` headers. Absent: the company's own secrets only.

## Answers 200

- `data` (`object[]`): The items on this page.
  - `object` (`"mcp_tool"`): Always `mcp_tool`.
  - `name` (`string`): The tool's name, as the server gives it.
  - `denied` (`boolean`): true when the floor says Bash never calls it.
  - `requires_approval` (`boolean`): true when the floor says it waits for the person's yes.
- `next_cursor` (`string | null`): Send it as `cursor` for the next page; null on the last page.

## Code

**HTTP**

```bash
curl "$VESTRA_BASE_URL/v1/mcp-servers/{server_id}/tools" \
  -H "Authorization: Bearer $VESTRA_API_KEY"
```

**TypeScript, Python, CLI, MCP**: No sample in your language for this route, so here it is over HTTP.