Skip to content

MCP Package Tools

A configuration package is the file QIE exports and imports to move configuration between engines. Through the MCP, a model can export a package, look inside a package before anyone imports it, and import one once the person at the AI client confirms.

Exporting a package

export_configuration exports a package of the zones and objects the model names, as the Management API's export does, and returns it as exportFile, base64-encoded. For each zone it sends zoneName, then either exportAllObjects or lists of objects by name: channels, dbConnections, dicomConnections, mappings, packages, publishedFunctions, variables, wsConnections, sslCertificates and forms.

The export needs an access token approved for full access, and edit rights in every zone it names; an administrator can export any zone. A zone the user cannot edit is reported as not found.

  • Private keys are never exported. A whole-zone export leaves the zone's private keys out, a key cannot be named, and a package whose publications carry private keys is refused. Export those in the console.
  • Passwords and other secured values travel as in any export from the console or the Management API: encrypted with a key built into QIE, so treat the package as sensitive.
  • Sample messages are exported only when exportSampleMessages is set and Return message content is on, and the export is recorded as a content read.
  • Channel cache values travel with every channel that has cache entries, including a channel inside an exported package. While Return message content is off, an export that includes such a channel is refused and names the channels; leave them out, or export them in the console. While it is on, the export is recorded as a content read.
  • Size. The package comes back whole. One larger than the Package Ceiling (bytes) on the Model Context Protocol (MCP) page is refused; export fewer objects, or export it in the console.

Warning

The package passes through the AI client and its provider. Every secured value in it is protected only as an export file is.

Describing a package

describe_package lists what a package holds without importing it. The model sends the package as configFile, base64-encoded, as the Management API takes it. The result names:

  • The system that exported it: its version, when and by whom, and its system name and type.
  • For each zone, its channels, published mappings and functions, system variables, web service, database and DICOM connections, HTML forms, certificates, private keys and packages, by name.
  • Whether it carries the system configuration, and how many users and roles.
  • How many sample messages it carries, and how many of them the package records as added through the MCP server. An import drops that origin, so they arrive as samples added in the console (see Sample Message Origin).

The description comes from the file alone and never says what the engine already has, so it needs only an access token approved to read.

A package can hold other packages. describe_package names each one but does not unpack it.

The package can be up to the Package Ceiling (bytes) setting on the Model Context Protocol (MCP) page, and may expand to at most 50 times that when unzipped. Only these package tools may send a request that large, and only with an accepted access token; every other request is limited to 1 MiB. A file with an XML document type declaration is refused, since a QIE package never has one.

Importing a package

import_configuration imports a package as the Management API's import does. The model sends the package as configFile, base64-encoded, with the Management API's options: overwriteEndpoints, importSampleMessages, overwriteEditablePackageComponents, overwriteConnAndVarNames, updateChannelCacheOnly, overrideExistingChannelCacheValues and skipKeysWithInvalidPasswords. Each is off when left out, except overwriteConnAndVarNames, which is on unless the model sets it to false, as on the console's Import Configuration dialog. keyPass is the password of the private keys in the package. zoneOverride imports a zone of the package into another zone, which the import creates when createZone is set and no zone has that name.

Nothing is imported until the person at the AI client confirms. The question names the system the package was exported from and when, the zone each zone of the package goes into, and the options set.

The import needs an access token approved for full access, and edit rights in every zone it writes to. Each zone of the package is matched to a zone on this engine by name, or, when no zone has that name, by the identity the zone keeps through exports and imports. Creating a zone needs an administrator.

  • Packages inside the package are imported as the console's Import Configuration dialog imports them.
  • One import at a time. An import is refused while another runs, whether that one came from the console, the Management API or the MCP.
  • Size. The package can be as large as for describe_package.

A running channel the import changes keeps running its old version until it is restarted.

Following an import

An import can take longer than one request. The call waits while it can, then reports the import as running.

get_import_status reports the import after that: still running, completed with its message and the channels it changed, or failed with the reason the console would show. Each changed channel carries restartRequired, which is true while the channel runs, or is paused, on an older version.

Only the sign-in that started an import can read it, and only its latest import.

Importing certificates and keys

import_certificates imports certificates and private keys from a file into a zone, as the Import Certificates dialog does. The model sends the file as file, base64-encoded, with fileName and, when the file has one, filePassword. The extension of fileName says how to read the file, as the name of an uploaded file does in the console: .jks, .p12, .pfx, .p7b, .p7c, .cer, .crt, .pub, .pem, .key and .der, or no extension for a private key. QIE never fetches a certificate from an address through the MCP.

The first call sends the file alone. Nothing is imported: the result lists each private key by modulusMd5 and each certificate by md5Fingerprint, with the name it would be imported under and whether it would replace an existing entry.

The second call names the items to import. Each private key needs password, the password QIE stores it with, and may have passwordHint and name. Each certificate may have name. A private key already in the zone keeps the name it has there, as in the dialog.

  • Replacing an entry is confirmed. When an item would replace a certificate or key already in the zone, the person at the AI client is asked first. An import that only adds entries is not asked about.
  • Global Settings entries stay as they are. An item whose name matches a certificate or key in Global Settings is refused when the import is into another zone. Choose another name.
  • Nothing secret comes back. The result names each item and says whether it replaced an entry. It never carries key material or a key password.
  • Running channels. The result lists the running channels that use a replaced entry. They keep the old certificate or key until they are restarted.

The import needs an access token approved for full access, and edit rights in the zone.