mcp-freeipa

MCP server for FreeIPA / Red Hat IdM — user, group, host, DNS, HBAC, and sudo management via the Model Context Protocol.

Features

• Users — list, get, create, enable, disable, delete, and reset passwords

• Groups — list, get, and manage group memberships

• Hosts — list and inspect enrolled hosts

• DNS — list zones, list and get records (A, AAAA, CNAME, MX, PTR, TXT, SRV, …)

• Sudo rules — list and inspect sudo policy rules

• HBAC rules — list and inspect host-based access control rules

Related MCP server: IPA MCP Server

Requirements

• FreeIPA 4.6+ or Red Hat IdM 7.6+ (any modern version with the JSON-RPC API)

• Node.js 18+

• An admin account or a dedicated service account with read access to the relevant objects

FreeIPA permissions

The minimum required privileges depend on which tools you use:

For read-only usage, you can create a dedicated service account and grant it only the System: Read * permissions via an RBAC role.

Environment variables

Installation

npm install
npm run build

Claude Desktop configuration

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "freeipa": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-freeipa/dist/index.js"],
      "env": {
        "FREEIPA_HOST": "ipa.example.com",
        "FREEIPA_USERNAME": "admin",
        "FREEIPA_PASSWORD": "your-password-here",
        "FREEIPA_ALLOW_SELF_SIGNED": "true"
      }
    }
  }
}

If you have installed the package globally via npm install -g mcp-freeipa:

{
  "mcpServers": {
    "freeipa": {
      "command": "mcp-freeipa",
      "env": {
        "FREEIPA_HOST": "ipa.example.com",
        "FREEIPA_USERNAME": "admin",
        "FREEIPA_PASSWORD": "your-password-here"
      }
    }
  }
}

Available tools

Users

Groups

Hosts

DNS

Sudo

HBAC

FreeIPA API notes

The server uses the FreeIPA JSON-RPC API (/ipa/session/json). It authenticates with a username and password via form-encoded login (/ipa/session/login_password) and stores the resulting ipa_session cookie for all subsequent requests. The session cookie is refreshed automatically on expiry (HTTP 401).

FreeIPA returns all attribute values as arrays even for scalar fields (e.g., {"uid": ["john"]}). The server normalises these automatically, extracting the first element for scalar fields and preserving full arrays for list fields such as memberof_group.

Development

npm run dev      # run with tsx (no build step)
npm run build    # compile TypeScript to dist/
npm start        # run compiled output

License

See LICENSE.