TAKO MCP Server for Okta

Overview

A production-ready MCP server for Okta administration with dual-mode operation. Successor to .

This server enables AI assistants to query Okta resources using the Model Context Protocol. It is designed for IAM engineers, security teams, and Okta administrators who want to give their AI tools safe, controlled access to their Okta environment.

Key Features:

• 🔄 Dual-Mode Operation - Standard MCP server mode or autonomous agent mode

• 🌐 Flexible Transports - STDIO for desktop clients, HTTP for remote deployments

• 🔑 Okta Tokens - API Token (simple) or OAuth2 with Private Key JWT (production)

• 📊 CSV Export - Save query results to files for reporting

• 🔒 Secure Execution - AST-based sandbox with whitelisted operations

• ✅ MCP Compliant - Elicitation, Progress notifications, logging, and tool annotations

📋 Table of Contents

• Core Concepts

• Quick Start

• Configuration

  • Okta Authentication

• MCP Client Setup

• Available Tools

• Security

• Rate Limits

• Get Help

• License

🧠 Core Concepts

Before installing, it's helpful to understand the two key configuration choices: Mode and Transport.

1. Operating Modes

Controls how the AI interacts with the server. Set via ENABLE_AGENT_MODE environment variable.

Basic MCP ServerMode (Default)

Tools exposed directly to the LLM. The AI calls read_system_instructions() first, then uses okta_* tools for sample data and execute_code() for full results.

Can be used for:

Agent Mode

AI discovers APIs dynamically via get_available_operations() and get_operation_details(), then generates code for execution. This mode is ideal for complex, multi-step queries where the agent explores the API surface as needed.

2. Transports

Controls how clients connect to the server.

🚀 Quick Start

Choose the installation method that fits your workflow.

Option A: Docker (Recommended)

The fastest way to get started without managing Python dependencies.

Option B: Local Python (uv)

We recommend uv for fast, reliable package management.

⚙️ Configuration

Configuration is managed via environment variables. Set these in a .env file or pass them directly.

Environment Variables

Okta Authentication

Best for development and simple deployments.

1. Go to Okta Admin → Security → API → Tokens

2. Create a new token with read permissions

3. Configure:

More secure, uses client credentials flow with private key JWT (RFC 7523).

Step 1: Create OAuth2 App in Okta

1. Go to Okta Admin → Applications → Create App Integration

2. Select API Services → Next

3. Name your application and click Save

4. Note the Client ID

Step 2: Configure Public Key Authentication

1. In your app, go to General → Client Credentials → Edit

2. Select Public key / Private key

3. Click Add Key → Generate new key

4. Download the private key (PEM format)

5. Click Save

Step 3: Grant API Scopes

1. Go to Okta API Scopes tab

2. Grant required scopes: okta.users.read, okta.groups.read, okta.apps.read, okta.logs.read, okta.policies.read

Step 4: Configure Environment

Tip: The private key can be multi-line (as shown) or single-line with \n escapes.

🔌 MCP Client Setup

STDIO Transport (Desktop Clients)

For Claude Desktop, VS Code, Cursor, and other local MCP clients:

HTTP Transport (Remote/Web)

For web-based deployments, remote access, or programmatic clients.

Start the server first:

Then configure your MCP client:

Docker (STDIO)

See Quick Start - Docker for build instructions.

Docker (HTTP)

For HTTP transport with Docker:

Note: The server binds to 0.0.0.0:8000 inside the container (required for Docker networking), but MCP_BASE_URL controls what URL is reported to MCP clients.

🛠️ Available Tools

When in Basic MCP Mode, the following tools are available:

User Management

• okta_user_list - List users with filtering, search, and pagination

• okta_user_get - Get detailed user profile by ID or login

• okta_user_list_groups - List groups a user belongs to

• okta_user_list_applications - List applications assigned to a user

• okta_user_list_factors - List enrolled authentication factors

Group Operations

• okta_group_list - List groups with filtering and pagination

• okta_group_get - Get detailed group information

• okta_group_list_users - List members of a group

• okta_group_list_applications - List applications assigned to a group

Application Management

• okta_app_list - List applications with filtering

• okta_app_get - Get detailed application information

• okta_app_list_users - List users assigned to an application

• okta_app_list_groups - List groups assigned to an application

System Logs

• okta_log_get_events - Query system log events with advanced filtering

Policies & Network Zones

• okta_policy_list_rules - List rules for a specific policy

• okta_policy_get_rule - Get detailed policy rule configuration

• okta_network_list_zones - List network zones

• okta_network_get_zone - Get detailed network zone information

Utilities

• okta_datetime_now - Get current UTC timestamp for queries

• okta_datetime_parse_relative - Parse natural language time expressions (e.g., "24 hours ago")

In Agent Mode, these tools are hidden. The agent uses get_available_operations to discover them dynamically.

🔒 Security

Code Execution Sandbox

All generated Python code is validated before execution:

Data Privacy

• Okta data is sent to the AI model during queries

• Large result sets export to CSV; only summaries return to AI

• Auto-Cleanup: CSV files generated in HTTP mode are automatically deleted after 1 hour

• Ensure organizational policies permit AI processing of Okta data

🚨 Rate Limits

Step 1: Identify your Okta API rate limit percentage (we recommend setting it to 100% in the Okta Admin Console).

Step 2: Set OKTA_CONCURRENT_LIMIT in your .env file based on your Okta plan:

⚠️ Monitor for Rate Limit Warnings:

If you see this frequently:

• Reduce your OKTA_CONCURRENT_LIMIT by 10-20%

• Cancel the sync and try a lower value

• Contact support@fctr.io if issues persist

🆘 Get Help

Before raising an issue, check:

1. 📝 Server configuration and .env file

2. 🔑 Okta API token permissions

3. 🔌 MCP client compatibility

4. 📊 Server logs in logs/ directory

Support Channels:

• 🐛 GitHub Issues - Bug reports and feature requests

• 📧 Email: support@fctr.io - General support

• 💬 Slack: dan@fctr.io - Quick questions

📄 License

Elastic License 2.0 - See LICENSE.

✅ Use for internal purposes • ✅ Modify and distribute
❌ Hosted/managed service • ❌ Remove license notices