Sytadel MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SYTADEL_TIMEOUT_MS | No | Timeout for HTTP requests in milliseconds. | 60000 |
| SYTADEL_USER_EMAIL | No | The email address of the user (user mode). | |
| SYTADEL_ZT_API_URL | No | The base URL for the Sytadel zero-trust API. | http://localhost:3010 |
| SYTADEL_TENANT_SLUG | No | The tenant slug for your Sytadel tenant. | |
| SYTADEL_AUTH_API_URL | No | The base URL for the Sytadel auth API. | http://localhost:3002/api |
| SYTADEL_CLIENT_APP_ID | No | The client app ID for service account mode. | |
| SYTADEL_USER_PASSWORD | No | The password of the user (user mode). | |
| SYTADEL_SERVICE_ACCOUNT_ID | No | The service account ID for service account mode. | |
| SYTADEL_SERVICE_ACCOUNT_SECRET | No | The service account secret for service account mode. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_tenant_usersA | List all users of the current Sytadel tenant with their role, active flag, passkey count, and last login. Useful for access reviews and off-boarding checks. |
| list_service_accountsA | List service accounts (machine credentials) under every client app of the current tenant, with last-used timestamps and auto-rotation state. Useful for spotting dormant integrations. |
| query_session_anomaliesA | Return recent session anomaly events (login from new IP / new country / new device / high score) for the calling user, up to |
| generate_policyA | Compile a natural-language RBAC intent (e.g. "OWNER can do anything, MEMBER can only GET /vaults, default deny") into a Sytadel PolicySet JSON. Returns policy, warnings, cost, tokens, latency. Read-only: the compiled policy is NOT applied — call PUT /policies/:tenantId separately to enforce it. |
| run_access_reviewA | Trigger an on-demand AI-driven access review for the current tenant. Claude reviews users, service accounts and recent anomalies, and returns a markdown report plus a machine-readable list of recommendations (revoke, downgrade, disable_service_account, rotate_service_account_secret, delete_passkey, require_password_reset, review_manually). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool targets a distinct resource and action: session anomalies, policy compilation, access reviews, user listing, and service account listing. There is no overlap or ambiguity between these functions.
All tool names use snake_case and a verb-object structure, but the verbs vary (list, query, generate, run). Two tools share the list prefix, but the inconsistent verbs prevent a perfect score.
Five tools is well-scoped for a server focused on access review and policy generation. Each tool addresses a key workflow without unnecessary bloat.
The set covers data retrieval (users, service accounts, anomalies) and generates policies/reviews. However, there is no tool to apply policies or act on review recommendations, creating a notable gap in the full lifecycle.