midPoint MCP Server

Overview Schema Source Related Servers Discussions Admin

Who am I

whoami

Reports the identity midPoint runs as, how it was established, and linked organizations; use it to tell whether empty self-scoped results mean no data or a different acting identity.

Instructions

Report the identity midPoint executes as, how it was established (personal = the server's configured credentials; resource-server = a validated per-request end user), and the orgs that identity is linked to. Call this first when a self-scoped tool (list_my_team, list_work_items, list_my_requests) returns an unexpectedly empty result — it distinguishes 'you genuinely have none' from 'this server is not acting as you'. When you write to a person, name people, roles and requests by their display names rather than OIDs.

Input Schema

Name	Required	Description	Default
No arguments

Output Schema

Name	Required	Description
`oid`	Yes
`mode`	Yes	how this identity was established: personal (the configured credentials) or resource-server (a validated per-request end user)
`name`	Yes
`orgs`	Yes	the orgs this identity is linked to, with the relation that links them
`tool`	Yes	the tool that produced this result
`acting`	Yes	who midPoint executed this call as
`server`	Yes	write gate, features and versions of this server
`fullName`	No
`emailAddress`	No
`impersonated`	Yes	true when this request runs as an end user via Switch-To-Principal

Schema Changelog

Changes observed during successful MCP inspections.

First observedNov 6, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does disclose meaningful behavior: the two identity modes (personal = configured server credentials; resource-server = validated per-request end user) explain why results can differ per call. It omits any auth or rate-limit notes, but for a zero-parameter read of caller identity that is a small residual gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and the empty-result diagnostic are front-loaded and well structured. However, the closing sentence about naming people, roles and requests by display names is unconnected to a read-only identity call and reads as stray cross-tool advice, diluting focus.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters, an output schema that documents the return values, and no annotations, the description covers purpose, identity semantics, and the diagnostic use case adequately. The only shortfall is that the off-topic display-name sentence occupies space that could have described the org linkage more precisely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline applies and there is no schema semantics to compensate for. The description correctly spends no words on parameters and instead explains what the returned identity means.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: reports the executing identity, how it was established (personal vs resource-server), and linked orgs. It is clearly distinguishable from siblings like get_user or get_my_access, which fetch other objects or access data rather than the caller's own execution identity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives an explicit trigger condition: call first when a self-scoped tool (list_my_team, list_work_items, list_my_requests) returns an unexpectedly empty result, and explains the diagnostic distinction it resolves ('you genuinely have none' vs 'this server is not acting as you'). It names the concrete alternatives, which is exactly the routing guidance an agent needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.