Skip to main content
Glama
gobeyondidentity

@beyondidentity/mcp

Official

scim_create_user

Create a SCIM user with required fields. If duplicate externalId or userName exists, the user is reactivated instead of failing.

Instructions

Create a user via SCIM. Requires externalId, userName, displayName, active, name (givenName, familyName), and emails (at least one primary). On conflict (duplicate externalId/userName), the existing user is reactivated instead of failing.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
nameNoDefinition of the user's name.
activeYesIndicator for the user's administrative status. If true, the user has administrative capabilities.
emailsYesThe list containing the user's emails. Important notes about email handling: - Only one email address is supported per user - The email must be marked as primary (primary: true) - If multiple email ad
schemasYesThe list of schemas used to define the user. This must contain only the core User schema ("urn:ietf:params:scim:schemas:core:2.0:User").
userNameYesThe unique username of the user. The value of this field will be returned as the subject of an OIDC ID Token.
externalIdYesThe provisioning client's unique identifier for the resource. This value must be unique across all users.
displayNameYesDisplay name of the User. This name is used for display purposes.
urn_ietf_params_scim_schemas_extension_enterprise_2.0_UserNoA string identifier, typically numeric or alphanumeric, assigned to a person, typically based on order of hire or association as defined in [RFC 7643](https://datatracker.ietf.org/doc/html/rfc7643#sec

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.2.0

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does disclose a genuinely non-obvious trait: on duplicate externalId/userName the existing user is reactivated instead of erroring (upsert semantics). It omits auth/permission requirements and the response shape, which keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with purpose and then the two most decision-relevant facts (required fields, conflict behavior). The required-field enumeration partially duplicates the schema's required array, a minor redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter mutation tool with nested objects, no output schema, and no annotations, the definition covers inputs and the conflict path but leaves out auth requirements, what happens to unmentioned fields on reactivation, and the response format. Adequate but with meaningful gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 8 parameters including the nested name and emails objects. The description's required-field recap (including "at least one primary" email) mostly restates what the schema already says, adding little beyond the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Create a user") plus the API surface ("via SCIM"), which implicitly separates it from the sibling create_user. It stops short of explicitly naming which sibling to use under what conditions, so it's clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use / when-not-to-use guidance and no routing among the many siblings (scim_replace_user, scim_update_user, create_user). The required-field list and conflict note describe mechanics rather than selection criteria, leaving usage entirely implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.