Back to Blog

How to Rotate an MCP Endpoint URL

Leaked mcp.json, Slack paste, or someone left the company? Rotate the Synra MCP endpoint, update Cursor/Claude/ChatGPT, and check Usage — without changing your database password.

MCP URL in Slack “for five minutes.” Or mcp.json in a PR. Or a contractor finished Friday.

Treat it like a published password: rotate, update every client. Don’t wait for Usage to look weird.

More context: endpoint as password, share access safely.

What rotation does (Synra)

  • Issues a new endpoint URL (new token)
  • Invalidates the old URL
  • Leaves your database connection and password alone

Clients still holding the old link stop working until you paste the new one.

Step 1 — Regenerate in Synra

  1. Sign in at mcpserver.design
  2. Open Endpoints (or the connection’s endpoint panel)
  3. Rotate / regenerate the URL
  4. Copy the new URL somewhere private (password manager) — not back into #eng

Confirm the old URL fails if you still have it (browser GET or a quick client call). Expect an auth/connection error — good.

Step 2 — Update every client

Cursor — edit ~/.cursor/mcp.json or project .cursor/mcp.json:

{
  "mcpServers": {
    "synra-staging": {
      "url": "https://app.mcpserver.design/api/mcp/NEW_TOKEN_HERE"
    }
  }
}

Quit Cursor fully and reopen. Settings → MCP → green.

Claude — Customize → Connectors → your Synra connector → replace the server URL → save / refresh tools.

ChatGPT — Settings → Apps & Connectors → your custom connector → update MCP URL → Refresh.

Miss one laptop and that person is still on a dead token — or worse, you forgot a second endpoint they had.

Step 3 — Smoke test

  • “List tables.”
  • One known count
  • Deliberate write → should still fail (read-only unchanged)

Verify if the numbers matter.

Step 4 — Check Usage

Open Usage. Look for:

  • Calls after the leak and before rotate
  • Tools you didn’t run
  • Odd hours

Details: what the audit log is for.

Step 5 — Clean up the leak source

  • Remove token from the PR / gist; rotate is urgent, history scrub is next for public git
  • Delete or edit the Slack message if you can; assume it was copied
  • Update shared password-manager items
  • If a person left: rotate every endpoint they might have had

When to also change the DB password

| What leaked | Rotate endpoint? | Rotate DB password? | |-------------|------------------|---------------------| | MCP URL only | Yes | No (unless policy says so) | | DATABASE_URL / service role in git | Yes | Yes | | Screenshot of Synra with both visible | Yes | Yes |

Don’t

  • “We’ll rotate Monday” while the URL is still in Slack
  • Reuse the same token after “asking people to delete the message”
  • Put the new URL in the same public thread

Leak → rotate → update clients → check Usage. Faster than leaving a read open.

Dashboard: mcpserver.design.

Related reading:

← Back to Blog