Okta Workspace MCP

A Model Context Protocol (MCP) server for Okta identity management. Provides AI assistants with secure, authenticated access to your Okta organization through Browser Session or OIDC/OAuth authentication.

Features

• Browser Session mode -- authenticate through your browser with full SSO and MFA support, then interact with Okta through the MCP

• OIDC/OAuth mode -- standard Authorization Code + PKCE flow for programmatic access

• Identity context -- whoami, userinfo, group membership, and app assignments

• Organization tools -- read-only access to users, groups, and applications (requires appropriate scopes)

• Guided setup -- interactive first-run configuration via MCP form elicitation

Related MCP server: Okta MCP Server

Quick Start

Install

git clone https://github.com/oreneHack/okta_mcp.git
cd okta_mcp
npm install

Register in your MCP client

Claude Code / VS Code:

Add to your MCP settings:

{
  "okta-workspace": {
    "type": "stdio",
    "command": "node",
    "args": ["path/to/okta_mcp/scripts/okta-mcp.mjs"]
  }
}

Or install globally:

npm install -g okta-workspace-mcp

Then register okta-workspace-mcp as a stdio MCP server in your client.

Authenticate

Ask your AI assistant:

"Connect to Okta" or "Start Okta MCP"

The guided setup collects your Okta org URL and authentication preference (Browser Session or OIDC/OAuth). Subsequent launches reuse saved settings.

Authentication Modes

Browser Session

Opens an isolated browser window for authentication. Supports all Okta sign-on policies including MFA, FastPass, and device trust. Session metadata is stored locally with redacted cookie values.

Available tools after authentication:

OIDC/OAuth

Standard Authorization Code + PKCE flow. Requires a Native OIDC application registered in your Okta org with a loopback redirect URI.

Recommended scopes:

Configuration

Configuration is stored under ~/.okta-workspace-mcp/:

Environment Variables

All settings can be provided via okta-start form elicitation. Environment variables are optional overrides for managed or headless deployments.

See .env.example for the full list.

Available Tools

Security

See SECURITY.md for data handling policies and recommended hardening steps.

• Cookie values are redacted in all MCP tool responses

• OAuth tokens are cached locally and never exposed in tool output

• Browser Session uses an isolated temporary profile

• Metadata service binds to 127.0.0.1 only

Requirements

• Node.js 20+

• Chrome or Microsoft Edge (Browser Session mode)

• Okta organization (any edition, including free developer orgs)

License

MIT