Skip to main content
Glama
major

ldap-mcp

by major
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Remote

ldap-mcp

CI PyPI Python License

MCP server for read-only LDAP directory operations.

Installation

uv add ldap-mcp
# or
pip install ldap-mcp

Related MCP server: readonly-mcp-akamai

Configuration

Set environment variables before running:

export LDAP_URI="ldaps://ldap.example.com:636"
export LDAP_BASE_DN="dc=example,dc=com"
export LDAP_BIND_DN="cn=readonly,dc=example,dc=com"
export LDAP_BIND_PASSWORD="secret"

# Optional: only return employee accounts in all searches
export LDAP_DEFAULT_FILTER="(employeeType=employee)"

All Environment Variables

Variable

Required

Default

Description

LDAP_URI

Yes

-

Server URI (ldap:// or ldaps://)

LDAP_BASE_DN

Yes

-

Default search base DN

LDAP_BIND_DN

No

-

Bind DN (empty = anonymous)

LDAP_BIND_PASSWORD

No

-

Bind password

LDAP_DEFAULT_FILTER

No

-

Filter ANDed to all searches

LDAP_AUTH_METHOD

No

simple

simple or anonymous

LDAP_USE_STARTTLS

No

false

Upgrade to TLS on port 389

LDAP_TLS_VERIFY

No

true

Verify TLS certificates

LDAP_CA_CERT

No

-

Path to CA certificate

LDAP_TIMEOUT

No

30

Connection timeout (seconds)

Usage

Run the server:

uvx ldap-mcp                    # stdio transport (default)
uvx ldap-mcp --transport sse    # SSE transport

Or if installed in a project:

uv run ldap-mcp

Add to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/, Windows: %APPDATA%\Claude\):

{
  "mcpServers": {
    "ldap": {
      "command": "uvx",
      "args": ["ldap-mcp"],
      "env": {
        "LDAP_URI": "ldaps://ldap.example.com:636",
        "LDAP_BASE_DN": "dc=example,dc=com",
        "LDAP_BIND_DN": "cn=readonly,dc=example,dc=com",
        "LDAP_BIND_PASSWORD": "secret"
      }
    }
  }
}

Add via CLI:

claude mcp add --transport stdio \
  --env LDAP_URI=ldaps://ldap.example.com:636 \
  --env LDAP_BASE_DN=dc=example,dc=com \
  --env LDAP_BIND_DN=cn=readonly,dc=example,dc=com \
  --env LDAP_BIND_PASSWORD=secret \
  ldap -- uvx ldap-mcp

Or add to .mcp.json in your project root:

{
  "mcpServers": {
    "ldap": {
      "type": "stdio",
      "command": "uvx",
      "args": ["ldap-mcp"],
      "env": {
        "LDAP_URI": "ldaps://ldap.example.com:636",
        "LDAP_BASE_DN": "dc=example,dc=com",
        "LDAP_BIND_DN": "${LDAP_BIND_DN}",
        "LDAP_BIND_PASSWORD": "${LDAP_BIND_PASSWORD}"
      }
    }
  }
}

Add to ~/.config/opencode/config.json (or opencode.json in project root):

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ldap": {
      "type": "local",
      "command": ["uvx", "ldap-mcp"],
      "environment": {
        "LDAP_URI": "ldaps://ldap.example.com:636",
        "LDAP_BASE_DN": "dc=example,dc=com",
        "LDAP_BIND_DN": "{env:LDAP_BIND_DN}",
        "LDAP_BIND_PASSWORD": "{env:LDAP_BIND_PASSWORD}"
      }
    }
  }
}

Tools

ldap_search

Search LDAP directory with filters.

filter: "(objectClass=person)"
base_dn: "ou=users,dc=example,dc=com"  # optional
scope: "subtree"  # base, one, or subtree
attributes: ["cn", "mail", "uid"]  # optional
size_limit: 100

ldap_get_entry

Get a single entry by DN with all attributes.

dn: "cn=jdoe,ou=users,dc=example,dc=com"
attributes: ["*"]  # optional, defaults to all
include_operational: true  # include createTimestamp, etc.

ldap_get_schema

Browse LDAP schema definitions.

schema_type: "all"  # object_classes, attribute_types, or all
name_filter: "person"  # optional substring filter

ldap_compare

Compare an attribute value without retrieving the entry.

dn: "cn=jdoe,ou=users,dc=example,dc=com"
attribute: "memberOf"
value: "cn=admins,ou=groups,dc=example,dc=com"

Prompts

user_lookup

Guided workflow for finding users by name, email, or uid.

group_members

List members of an LDAP group with optional name resolution.

group_membership

Find all groups a user belongs to.

search_guide

LDAP filter syntax reference with examples.

Development

# Install dev dependencies
uv sync --group dev

# Run checks
make check    # lint + format + typecheck + test

# Run tests only
make test

# Auto-fix issues
make fix

License

MIT

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityActive
ResponsivenessUnresponsive

Resources

Related MCP Connectors

Related MCP Servers

  • ActiveDirectoryMCP

    alpadalar
    A
    license
    Not graded
    quality
    D
    maintenance
    A comprehensive MCP server for managing Active Directory environments through LDAP, enabling user, group, computer, and OU management, as well as security auditing and policy compliance checks.
    46
    MIT

  • ldap-mcp-server

    markizano
    F
    license
    Not graded
    quality
    C
    maintenance
    An MCP server that exposes LDAP directory operations to AI agents, supporting full CRUD, dual transport modes (stdio and SSE), and LDIF/JSON output with authentication.
    -

  • LDAP4Claude

    ct9915
    F
    license
    Not graded
    quality
    D
    maintenance
    MCP server that connects Claude Code to LDAP/Active Directory for user lookup, group management, authentication, and role mapping.
    -