Supported AI provider via Google Vertex AI, allowing use of Google's Gemini models through the Vertex AI platform.
Mentioned as an example integration that could be used alongside the Okta MCP Server for operations like creating spreadsheets with Okta user data.
Enables AI models to interact directly with Okta environments, providing tools for user management (listing, retrieving user details), group operations (listing groups and members), application management (listing applications and assigned users), policy and network management (listing policy rules and network zones), and system log event retrieval.
Mentioned as a potential OpenAI API-compatible endpoint that can be used with the MCP server through the openai_compatible provider setting.
Supported AI provider for the MCP server, allowing connection to OpenAI API with models like GPT-4o.
The Okta MCP Server is a groundbreaking tool that enables AI models to interact directly with your Okta environment using the Model Context Protocol (MCP). Built specifically for IAM engineers, security teams, and Okta administrators, it implements the MCP specification to transform how AI assistants can help manage and analyze Okta resources.
📋 Table of Contents
🔍 What is the Model Context Protocol?
⚠️ IMPORTANT: Security & Limitations
Please read this section carefully before using Okta MCP Server.
🔄 Data Flow & Privacy
When you make a request, the interaction happens directly between the LLM and the Okta MCP tools - the client application is no longer in the middle. All data returned by these tools (including complete user profiles, group memberships, etc.) is sent to and stored in the LLM's context during the entire transaction for that conversation.
Key Privacy Considerations:
The LLM (Claude, GPT, etc.) receives and processes all Okta data retrieved by the tools
This data remains in the LLM's context for the duration of the conversation
You must be comfortable with your Okta user data being processed by the LLM provider's systems
Before using these tools, ensure you're comfortable with Okta data being sent to the AI model's servers
📊 Context Window Limitations
MCP is designed for lightweight workflows similar to Zapier, not bulk data operations.
Recommendation: Limit requests to fewer than 100 entities per transaction. Avoid operations that require fetching large datasets or multiple API calls.
Examples:
❌ Avoid these types of requests:
"Fetch all 10,000 users from our Okta tenant and analyze their login patterns"
"Find users who do not have Okta Verify enrolled as a factor"
✅ Better approaches:
"Get the most recently created 20 users"
"Find users who haven't logged in for 90+ days, limit to first 50 results"
💡 For larger data sets and complex queries: Consider using the Okta AI Agent for larger queries and data sets, The agent is being enhanced with similar "actionable" features to handle larger datasets and more complex scenarios in the very near future.
🚨 SSE Transport Security Warning
The SSE over HTTP transport mode has significant security risks:
It opens an unauthenticated HTTP server with full access to your Okta tenant
No authentication or authorization is provided
Anyone who can reach the network port can issue commands to your Okta environment
Best Practice: Only use the STDIO transport method (default mode) unless you have specific security controls in place.
🛠️ Available Tools
The Okta MCP Server currently provides the following tools:
User Management
list_okta_users
- Retrieve users with filtering, search, and pagination optionsget_okta_user
- Get detailed information about a specific user by ID or loginlist_okta_user_groups
- List all groups that a specific user belongs tolist_okta_user_applications
- List all application links (assigned applications) for a specific userlist_okta_user_factors
- List all authentication factors enrolled for a specific user
Group Operations
list_okta_groups
- Retrieve groups with filtering, search, and pagination optionsget_okta_group
- Get detailed information about a specific grouplist_okta_group_members
- List all members of a specific grouplist_okta_assigned_applications_for_group
- List all applications assigned to a specific group
Application Management
list_okta_applications
- Retrieve applications with filtering, search, and pagination optionslist_okta_application_users
- List all users assigned to a specific applicationlist_okta_application_group_assignments
- List all groups assigned to a specific application
Policy & Network Management
list_okta_policy_rules
- List all rules for a specific policy with detailed conditions and actionsget_okta_policy_rule
- Get detailed information about a specific policy rulelist_okta_network_zones
- List all network zones with IP ranges and configuration details
System Log Events
get_okta_event_logs
- Retrieve Okta system log events with time-based filtering and search options
Date & Time Utilities
get_current_time
- Get current UTC time in ISO 8601 formatparse_relative_time
- Convert natural language time expressions to ISO 8601 format
Additional tools for applications, factors, policies, and more advanced operations are on the roadmap and will be added in future releases.
🚀 Quick Start
Prerequisites
✅ Python 3.8+ installed on your machine
✅ Okta tenant with appropriate API access
✅ An MCP-compatible AI client (Claude Desktop, Microsoft Copilot Studio, etc.)
⚠️ Important Model Compatibility Note:
Not all AI models work with this MCP server. Testing has only been performed with:
GPT-4.0
Claude 3.7 Sonnet
Google-2.5-pro
You must use latest model versions that explicitly support tool calling/function calling capabilities. Older models or models without tool calling support will not be able to interact with the Okta MCP Server.
🧠 Supported AI Providers
The Okta MCP Server supports multiple AI providers through its flexible configuration system. This allows you to connect to various large language models based on your specific needs and existing access.
Currently Supported Providers:
Provider | Environment Variable | Description |
OpenAI |
| Connect to OpenAI API with models like GPT-4o. Requires an OpenAI API key. |
Azure OpenAI |
| Use Azure-hosted OpenAI models with enhanced security and compliance features. |
Anthropic |
| Connect to Anthropic's Claude models (primarily tested with Claude 3.7 Sonnet). |
Google Vertex AI |
| Use Google's Gemini models via Vertex AI. Requires Google Cloud service account. |
OpenAI Compatible |
| Connect to any OpenAI API-compatible endpoint, such as Fireworks.ai, Ollama, or other providers that implement the OpenAI API specification. |
Installation
⚠️ NOTICE: If you clone this repository anew or pull updates, always make sure to re-run
pip install -r requirements.txt
to ensure all dependencies are up-to-date.
Configuration & Usage
Create a config file with your Okta settings:
To use the command line client (no memory), use the instructions below
To use MCP hosts like Claude Code, vsCode ...etc find the json config below
Supported Transports and Launching
The Okta MCP Server supports two transport protocols:
1. Standard I/O (STDIO) - Recommended
Security: Direct communication through standard input/output streams
Use case: Ideal for desktop AI assistants like Claude Desktop
Configuration: For Claude Desktop, add to
claude_desktop_config.json
:{ "mcpServers": { "okta-mcp-server": { "command": "DIR/okta-mcp-server/venv/Scripts/python", "args": [ "DIR/okta-mcp-server/main.py" ], "env": { "OKTA_CLIENT_ORGURL": "https://dev-1606.okta.com", "OKTA_API_TOKEN": "OKTA_API_TOKEN" } } } }Replace
2. Server-Sent Events (SSE) - Advanced Use Only
⚠️ WARNING: SSE transport exposes your server via a web endpoint accessible to anyone who can reach your network. Use only in secure environments with proper network protections.
For other MCP clients: Configure according to their documentation for either STDIO or SSE transport.
⚠️ Good to Know
Alpha Release 🧪
Early development phase - expect frequent updates
API surface coverage is still expanding
Currently focusing on read-only operations for users and groups
More tools and capabilities being added rapidly
Not yet suitable for production environments
Security First 🛡️
Designed for least-privilege operation
Default read-only access to Okta resources
Future write operations will require explicit approval flows
Current Limitations 🔍
Starting with a limited set of read-only tools for users and groups
Planning to expand API coverage rapidly in upcoming releases
Some complex Okta relationships not yet exposed
Performance with very large Okta instances not yet optimized
Requires direct network access to Okta API endpoints
🗺️ Roadmap
Current progress:
MCP protocol compliance
Basic Okta API integration
Read-only operations support
Future plans include:
Comprehensive documentation
Complete user lifecycle operations
Application assignment management
Group membership operations
Factor enrollment and verification
Policy and rule management
Approval workflows for sensitive operations
Multi-channel approval options (web, email, Slack)
Audit logging and compliance reporting
System log integration
Security insights generation
Multi-tenant support
Role-based access control
🆘 Need Help?
Before raising an issue, check:
📝 Server configuration
🔑 Okta API permissions
🔌 MCP client compatibility
📊 Server logs
Still having problems? Open an issue on GitHub or email support@fctr.io (response times may vary)
💡 Feature Requests & Ideas
Have an idea or suggestion? Open a feature request on GitHub!
👥 Contributors
Interested in contributing? We'd love to have you! Contact info@fctr.io for collaboration opportunities.
⚖️ Legal Stuff
Check out License.md
for the fine print.
🌟 © 2025 Fctr Identity. All rights reserved. Made with ❤️ for the Okta and AI communities.
This server cannot be installed
hybrid server
The server is able to function both locally and remotely, depending on the configuration or use case.
MCP server to work with okta entities
Related MCP Servers
- -securityAlicense-qualityOracle MCP Server by CDataLast updated -MIT License
- -securityAlicense-qualityOData MCP Server by CDataLast updated -MIT License
- -securityAlicense-qualityMicrosoft OneDrive MCP Server by CDataLast updated -MIT License
- -securityAlicense-qualityMicrosoft Exchange MCP Server by CDataLast updated -4MIT License