Keep connector tools current

Use this page when a release changes a connector, for example to add a tool, and your environment already has a resource connected from it. The new tool does not appear by itself. You update the resource, and then each MCP client reconnects.

Why an existing resource keeps its old tools

A connector is a manifest that ships inside the product. It defines the routes, scopes, policy and resource type for one upstream product. When you connect a resource from it, the resource gets a copy of the connector's routes. Each route with an mcp block is one tool.

Installing a connector refreshes the connector's own record, its policy and its scopes. It never changes the routes of a resource that already exists. We checked this on an instance. We cut a weather resource down to one route, installed the connector again, and the resource still had one route.

Install a connector and connect a resource

If your environment has no resource from the connector yet, start here. These steps use the Open-Meteo weather connector, which needs no upstream credential, and set the same POLICYARC_URL and POLICYARC_ADMIN_KEY as Register a managed resource.

Install the connector. The call returns HTTP 201 the first time and HTTP 200 after that.

curl -fsS -X POST "$POLICYARC_URL/admin/api/connectors/identos.weather-openmeteo/install" \
  -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY"

Render the resource the connector describes, and create it. The resource is named weather-openmeteo.

curl -fsS -X POST "$POLICYARC_URL/admin/api/connectors/identos.weather-openmeteo/render" \
  -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY" -H 'Content-Type: application/json' -d '{}' |
  curl -fsS -X POST "$POLICYARC_URL/admin/api/managed-resources" \
    -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY" -H 'Content-Type: application/json' -d @-

A resource created this way does not record connectorId or connectorVersion. Sync skips a resource without connectorId, and the Admin Portal shows tool version unknown for it. Render its routes once with update-routes, which records both.

curl -fsS -o /dev/null -X POST "$POLICYARC_URL/admin/api/managed-resources/weather-openmeteo/update-routes" \
  -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY"

Update with one call

POST /admin/api/connectors/sync brings every installed connector and its resources up to date. Per connector it installs the bundled manifest, renders again the routes of each resource that records the connector's id in connectorId, and adds any new upstream scopes to the identity provider the connector uses. It never removes a scope and never touches upstream URLs, upstream auth or stored user credentials.

curl -fsS -X POST "$POLICYARC_URL/admin/api/connectors/sync" \
  -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY"

To sync one connector, name it.

resp=$(curl -fsS -X POST "$POLICYARC_URL/admin/api/connectors/identos.weather-openmeteo/sync" \
  -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY")
echo "$resp"
jq -e '.connectors[0].resources[0].resource == "weather-openmeteo"' <<<"$resp" >/dev/null ||
  { echo 'Expected the weather-openmeteo resource in the report' >&2; false; }

The response reports what changed. On our instance it was this.

{"connectors":[{"connectorId":"identos.weather-openmeteo","version":"1.0.0","resources":[{"resource":"weather-openmeteo","routeCount":3,"scopesAdded":[]}]}]}

A connector that is not installed returns HTTP 404 from the single-connector call. Sync never installs a new connector.

Update in steps

The two steps that sync combines are also available on their own.

1. Install the connector. It is installed already, so the call returns HTTP 200.

   curl -fsS -X POST "$POLICYARC_URL/admin/api/connectors/identos.weather-openmeteo/install" \
     -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY"

2. Render each resource's routes from the connector again.

   curl -fsS -o /dev/null -X POST "$POLICYARC_URL/admin/api/managed-resources/weather-openmeteo/update-routes" \
     -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY"
   resource=$(curl -fsS "$POLICYARC_URL/admin/api/managed-resources/weather-openmeteo" -H "X-Admin-API-Key: $POLICYARC_ADMIN_KEY")
   jq -c '{connectorId, connectorVersion}' <<<"$resource"
   jq -e '.connectorId == "identos.weather-openmeteo" and .connectorVersion != null' <<<"$resource" >/dev/null ||
     { echo 'Expected connectorId and connectorVersion on the resource' >&2; false; }

   The resource now carries connectorId and connectorVersion, the version its routes came from.

update-routes installs the connector first when the environment holds an older version than the product bundles. It does not add new upstream scopes to the identity provider. Sync does.

In the Admin Portal, open APIs & Connectors and select the resource. The Connector row shows tools from v<version>, or tool version unknown. When the version differs from the bundled connector, the row also shows v<version> available and an Update tools button. The button does the same as update-routes.

Reconnect each MCP client

The gateway tells MCP clients that its tool list does not change during a session. A client that is connected keeps the list it fetched. Disconnect and reconnect the server in each client to see the new tools.

What an update replaces

• The resource's whole routes array is replaced. A route you edited by hand is lost.
• The upstream URL, upstream auth, default scope, the gateway's introspection client and every stored user credential stay as they were. Users do not reconnect their accounts.

If something goes wrong

What you see	Cause
update-routes returns HTTP 409	No bundled connector has the resource's resource type. A resource you registered yourself has no connector to render from.
tool version unknown	The resource was created before the product recorded the version, or through the admin API without connectorId and connectorVersion. Sync skips it. Run update-routes to stamp it.
A new tool returns Access denied	The client's token was issued before the connector added the tool's scope. Reconnect the client so it signs in again and gets a token with the new scope.