Managing MCP Server Profiles

Liferay DXP 2026.Q4+ Release Feature

An MCP Server Profile is what an MCP client (e.g., AI application) connects to when it reaches Liferay DXP over the Model Context Protocol (MCP). The profile decides which tools the client can call, which fields those tools return, and which data masks apply to the responses. Create a profile for each set of tools and masks you want a group of MCP clients to use.

Profiles are in the MCP Server application, which appears when you enable LPD-63311, the release feature flag named Liferay Model Context Protocol (MCP) Server. To enable the MCP server for a virtual instance, see Enabling the MCP Server.

Creating a Profile

Navigate to Control Panel → MCP Server → Profiles.
Click New Profile.
Enter a Title and a Description.

MCP clients use the Title in the profile’s endpoint path, so use a short title without spaces or slashes, such as marketing.
Click Save.

A new profile starts Inactive, with every system data mask attached. Before it can serve clients, add at least one tool and activate it.

To change a profile’s Title or Description later, open the profile, make your changes, and click Save. Changing the Title changes the profile’s endpoint path, so update every MCP client that uses it. Renaming the default profile also breaks every client that uses /o/mcp.

Adding and Removing Tools

A tool is one operation of a Liferay DXP REST API that an MCP client can call. Tools are grouped into tool sets, one for each REST API, such as mcp-server-v1.0.

Open the profile and click the Tools tab.
Click Add Tools.
Select the tools to add. To select every tool in a tool set, check the tool set.
Click Add.

To remove a tool, click Actions () for the tool and select Remove.

Important

Removing the last tool from an Active profile deactivates the profile.

To limit the fields a tool returns, see Restricting Fields in MCP Server Tools.

Managing a Profile’s Data Masks

A profile’s masks run in the order its Data Masks tab lists them, from top to bottom. To create a custom mask, see Masking Sensitive Data in MCP Server Responses.

To attach masks, open the profile, click the Data Masks tab, and click Add Masks (). Select the masks and click Add. New masks run after the existing ones.

To change the order, drag a mask by its handle. You can’t reorder the masks while a search filters the list.

To remove a mask, click Actions () for the mask and select Remove. You must enter a reason for removing it.

Activating and Deactivating a Profile

A profile serves MCP clients only while it’s Active, and it must have at least one tool before you can activate it. To activate or deactivate a profile, open it, turn the Profile Status toggle on or off, and click Save.

Deleting a Profile

Warning

Deleting a profile is permanent, and its clients lose access immediately. Deleting the default profile breaks every client that uses /o/mcp.

To delete a profile, click Actions () for it in the Profiles list and select Delete.

How MCP Clients Reach a Profile

The endpoint path decides which profile serves a request:

A request to /o/mcp uses the profile titled default.
A request to /o/mcp/[profile title] uses the profile whose Title matches [profile title] exactly, including case.

For example, a client reaches a profile titled marketing at http://localhost:8080/o/mcp/marketing. URL-encode any spaces or reserved characters in the Title, such as /o/mcp/Sales%20Team. A Title that contains / can’t be reached. The Profiles list’s Path column isn’t the endpoint path, because the MCP server finds profiles by Title.

The default profile ships Active with tools that let clients browse tool sets and their tools, read any tool’s definition, and invoke tools the user has permission to call.

A request to an inactive profile returns 404 with a message that the profile is inactive. A request for a Title that no profile has returns 404 with an empty body.

Every profile shares the OAuth 2.0 resource URI http://localhost:8080/o/mcp. Request a bearer token for that URI rather than for the profile’s path, and the token works on every profile endpoint. See Connecting with OAuth 2.0.

To confirm that a client reaches a profile, connect the MCP Inspector to the profile’s endpoint and list its tools.

Upgrading Existing Profiles

If you created MCP Server Profiles before Liferay DXP 2026.Q4, upgrading moves each profile’s tools to its Tools tab and activates the profile. A profile with no tools is set to Inactive, so add a tool and activate it again.

Through the REST API, a profile’s tools are now separate entries at /o/mcp/server-profile-tools. See Restricting Fields Through the REST API for how to find a profile’s tool entries.