Manages FreeIPA/Red Hat IdM identities including users, groups, hosts, DNS, sudo rules, and HBAC rules through the FreeIPA JSON-RPC API.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-freeipa list all users"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server for FreeIPA / Red Hat IdM — user, group, host, DNS, HBAC, and sudo management via the Model Context Protocol.
Users — list, get, create, enable, disable, delete, and reset passwords
Groups — list, get, and manage group memberships
Hosts — list and inspect enrolled hosts
DNS — list zones, list and get records (A, AAAA, CNAME, MX, PTR, TXT, SRV, …)
Sudo rules — list and inspect sudo policy rules
HBAC rules — list and inspect host-based access control rules
Related MCP server: IPA MCP Server
FreeIPA 4.6+ or Red Hat IdM 7.6+ (any modern version with the JSON-RPC API)
Node.js 18+
An admin account or a dedicated service account with read access to the relevant objects
The minimum required privileges depend on which tools you use:
Area | Required privilege |
Users |
|
Groups |
|
Hosts |
|
DNS |
|
Sudo |
|
HBAC |
|
For read-only usage, you can create a dedicated service account and grant it only the System: Read * permissions via an RBAC role.
Variable | Required | Default | Description |
| Yes | — | FreeIPA server hostname (e.g. |
| Yes | — | Password for the FreeIPA account |
| No |
| FreeIPA account username |
| No |
| Allow self-signed TLS certificates ( |
npm install
npm run buildAdd to claude_desktop_config.json:
{
"mcpServers": {
"freeipa": {
"command": "node",
"args": ["/absolute/path/to/mcp-freeipa/dist/index.js"],
"env": {
"FREEIPA_HOST": "ipa.example.com",
"FREEIPA_USERNAME": "admin",
"FREEIPA_PASSWORD": "your-password-here",
"FREEIPA_ALLOW_SELF_SIGNED": "true"
}
}
}
}If you have installed the package globally via npm install -g mcp-freeipa:
{
"mcpServers": {
"freeipa": {
"command": "mcp-freeipa",
"env": {
"FREEIPA_HOST": "ipa.example.com",
"FREEIPA_USERNAME": "admin",
"FREEIPA_PASSWORD": "your-password-here"
}
}
}
}Tool | Description |
| List users, with optional uid / cn / mail filters |
| Get full details for a user by UID |
| Enable a disabled user account |
| Disable (lock) a user account |
| Create a new user account |
| Permanently delete a user account |
| Reset a user's password |
Tool | Description |
| List groups with optional name filter |
| Get full details for a group by name |
| Add one or more users to a group |
| Remove one or more users from a group |
Tool | Description |
| List enrolled hosts with optional FQDN filter |
| Get full details for a host by FQDN |
Tool | Description |
| List all DNS zones |
| List all records in a DNS zone |
| Get all record types for a specific name in a zone |
Tool | Description |
| List all sudo rules |
| Get full details of a sudo rule |
Tool | Description |
| List all host-based access control rules |
| Get full details of an HBAC rule |
The server uses the FreeIPA JSON-RPC API (/ipa/session/json). It authenticates with a username and password via form-encoded login (/ipa/session/login_password) and stores the resulting ipa_session cookie for all subsequent requests. The session cookie is refreshed automatically on expiry (HTTP 401).
FreeIPA returns all attribute values as arrays even for scalar fields (e.g., {"uid": ["john"]}). The server normalises these automatically, extracting the first element for scalar fields and preserving full arrays for list fields such as memberof_group.
npm run dev # run with tsx (no build step)
npm run build # compile TypeScript to dist/
npm start # run compiled outputSee LICENSE.
Create a new FreeIPA user account.
Inputs: sn (required), uid (required), givenname (required), cn, +4 more.
Add one or more users to a FreeIPA group.
Inputs: uid (required), group_cn (required).
Permanently delete a FreeIPA user account.
Inputs: uid (required).
Disable a FreeIPA user account (locks it without deleting).
Inputs: uid (required).
Enable a disabled FreeIPA user account.
Inputs: uid (required).
Get detailed DNS information for a specific record name within a zone.
Inputs: name (required), zone (required).
Get detailed information about a specific FreeIPA group by its name (cn).
Inputs: cn (required).
Get detailed information about a specific FreeIPA HBAC rule by its name.
Inputs: cn (required).
Get detailed information about a specific FreeIPA-enrolled host by its FQDN.
Inputs: fqdn (required).
Get detailed information about a specific FreeIPA sudo rule by its name.
Inputs: cn (required).
Get detailed information about a specific FreeIPA user by their UID (login name).
Inputs: uid (required).
List DNS records within a specific zone in FreeIPA. Returns all record types (A, AAAA, CNAME, MX, etc.).
Inputs: zone (required), limit.
List all DNS zones managed by FreeIPA. Returns zone names and active status.
Inputs: name_filter.
List groups in FreeIPA. Returns name, description, GID, and member lists.
Inputs: cn, limit.
List all Host-Based Access Control (HBAC) rules in FreeIPA. HBAC rules control which users can access which hosts and services.
Inputs: cn.
List hosts enrolled in FreeIPA. Returns FQDN, OS, enrollment status, and group memberships.
Inputs: fqdn, limit.
List all sudo rules defined in FreeIPA. Returns who each rule applies to, which hosts, and what commands are allowed or denied.
Inputs: cn.
List users in FreeIPA. Optionally filter by UID, full name (cn), or email address.
Inputs: cn, uid, mail, limit.
Remove one or more users from a FreeIPA group.
Inputs: uid (required), group_cn (required).
Reset a FreeIPA user's password. Requires the current password unless called by an admin with sufficient privileges using the admin API flow.
Inputs: uid (required), new_password (required), current_password.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 20 tools
Each tool targets a distinct resource-action pair, such as user lifecycle, group membership, sudo rules, HBAC rules, hosts, and DNS records. List-versus-get and add-versus-remove patterns are clearly differentiated, so an agent is unlikely to confuse tool purposes.
All tool names follow a consistent verb_noun snake_case pattern, with verbs like list, get, add, delete, enable, disable, reset, and remove used predictably. Even multi-word resources like sudo_rule and dns_record maintain a uniform style.
Twenty tools is slightly above the typical well-scoped range, but FreeIPA is a broad domain covering users, groups, sudo, HBAC, hosts, and DNS. Each tool has a clear purpose, and the count feels reasonable rather than bloated.
User management is well covered with CRUD, password reset, and enable/disable, plus group membership operations. However, groups lack create/delete tools, and sudo rules, HBAC rules, hosts, and DNS are all read-only, leaving notable management gaps that could dead-end workflows.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server for Product Management
