No user-submitted related servers found.
Scored across 29 tools
Tools are mostly cleanly separated by resource and action: user_* (list/detail/count/sessions/credentials), client_* (list/detail/sessions/session_stats), group_*, and event tools. The main friction is between aggregate analyses (mfa_coverage_analysis, login_failure_rca) and the raw listings that feed them (user_credentials, login_events), and between client_sessions (per-client) and user_sessions (per-user) — but descriptions consistently clarify each. No two tools genuinely do the same thing.
Consistently snake_case throughout with no camelCase or arbitrary mixing. It alternates between verb_noun (list_users, revoke_user_sessions, disable_user) and noun_qualifier (user_detail, user_count, client_sessions), but stays internally predictable within each resource family. Minor deviation from a single verb_noun pattern only.
29 tools is on the heavy side and nudges past the well-scoped range, but the domain genuinely spans users, clients, groups, sessions, events, five distinct audits, write/remediation actions, and an undo subsystem. Each tool maps to a real operation, so it is borderline-heavy rather than bloat.
Read coverage is strong (users, clients, groups, sessions, events, IdP/realm config) and the write/undo surface covers containment and remediation with reversibility tracking. Gaps are lifecycle writes — no create/delete user or client, no group membership or attribute mutation — though those may be intentionally out of scope for an audit-and-containment server.