How do I use Okta Workspace MCP?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Okta Workspace MCP start Okta MCP" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

Okta Workspace MCP

by oreneHack

Overview Schema Source Related Servers Discussions Admin

JavaScript

Local

Okta Workspace MCP

A Model Context Protocol (MCP) server for Okta identity management. Provides AI assistants with secure, authenticated access to your Okta organization through Browser Session or OIDC/OAuth authentication.

Features

Browser Session mode -- authenticate through your browser with full SSO and MFA support, then interact with Okta through the MCP
OIDC/OAuth mode -- standard Authorization Code + PKCE flow for programmatic access
Identity context -- whoami, userinfo, group membership, and app assignments
Organization tools -- read-only access to users, groups, and applications (requires appropriate scopes)
Guided setup -- interactive first-run configuration via MCP form elicitation

Related MCP server: Okta MCP Server

Quick Start

Install

git clone https://github.com/oreneHack/okta_mcp.git
cd okta_mcp
npm install

Register in your MCP client

Claude Code / VS Code:

Add to your MCP settings:

{
  "okta-workspace": {
    "type": "stdio",
    "command": "node",
    "args": ["path/to/okta_mcp/scripts/okta-mcp.mjs"]
  }
}

Or install globally:

npm install -g okta-workspace-mcp

Then register okta-workspace-mcp as a stdio MCP server in your client.

Authenticate

Ask your AI assistant:

"Connect to Okta" or "Start Okta MCP"

The guided setup collects your Okta org URL and authentication preference (Browser Session or OIDC/OAuth). Subsequent launches reuse saved settings.

Authentication Modes

Browser Session

Opens an isolated browser window for authentication. Supports all Okta sign-on policies including MFA, FastPass, and device trust. Session metadata is stored locally with redacted cookie values.

Available tools after authentication:

Tool	Description
`okta-browser-status`	Session state and activity
`okta-browser-snapshot`	Current page content (sanitized)
`okta-browser-navigate`	Navigate within your Okta org
`okta-browser-read`	Read Okta API endpoints (GET only)

OIDC/OAuth

Standard Authorization Code + PKCE flow. Requires a Native OIDC application registered in your Okta org with a loopback redirect URI.

Recommended scopes:

Scope	Purpose
`openid profile email`	Identity (minimum)
`offline_access`	Token refresh
`okta.users.read`	User directory access
`okta.groups.read`	Group directory access
`okta.apps.read`	Application inventory

Configuration

Configuration is stored under ~/.okta-workspace-mcp/:

File	Purpose
`startup.json`	Selected mode and Okta org
`config.json`	Public OIDC client settings
`tokens.json`	Local OAuth token cache

Environment Variables

All settings can be provided via okta-start form elicitation. Environment variables are optional overrides for managed or headless deployments.

Variable	Description	Default
`OKTA_ORG_URL`	Okta org URL (`https://example.okta.com`)	Set via `okta-start`
`OKTA_CLIENT_ID`	OIDC application client ID	Set via `okta-start`
`OKTA_AUTH_SERVER`	Authorization server ID	`org`
`OKTA_SCOPES`	Space-delimited OAuth scopes	`openid profile email offline_access`

See .env.example for the full list.

Available Tools

Tool	Description
`okta-start`	Configure and authenticate
`okta-status`	Connection and authentication status
`okta-reset`	Clear saved configuration
`whoami`	Current user identity
`userinfo`	Detailed user profile
`token-details`	OAuth token metadata
`my-groups`	Group memberships
`my-apps`	Assigned applications
`list-users`	Organization user directory
`get-user`	Single user lookup
`search-users`	User search
`list-groups`	Organization groups
`list-apps`	Organization applications

Security

See SECURITY.md for data handling policies and recommended hardening steps.

Cookie values are redacted in all MCP tool responses
OAuth tokens are cached locally and never exposed in tool output
Browser Session uses an isolated temporary profile
Metadata service binds to 127.0.0.1 only

Requirements

Node.js 20+
Chrome or Microsoft Edge (Browser Session mode)
Okta organization (any edition, including free developer orgs)

License

MIT

Available Tools

23 tools

get-userA

Get one user visible to the connected Okta administrator (requires okta.users.read)

Inputs: userId (required).

list-appsB

List applications visible to the connected Okta administrator (requires okta.apps.read)

Inputs: limit.

list-groupsC

List groups visible to the connected Okta administrator (requires okta.groups.read)

Inputs: limit.

list-usersB

List users visible to the connected Okta administrator (requires okta.users.read)

Inputs: limit.

my-appsA

List application links assigned to the connected user (requires okta.users.read)

Inputs: no named parameters.

my-groupsB

Show group names from the verified ID-token groups claim when configured

Inputs: no named parameters.

okta-browser-closeA

Close the live isolated Okta browser and delete its temporary profile

Inputs: no named parameters.

okta-browser-harvest-tokensA

Silently harvest OAuth tokens from all assigned public OIDC apps using prompt=none and PKCE, and store them in the collector at /v1/tokens

Inputs: no named parameters.

okta-browser-navigateA

Navigate the visible isolated browser to a URL or path on the configured Okta origin; cross-origin navigation is rejected

Inputs: url (required).

okta-browser-readA

Perform a read-only GET from the authenticated browser to a same-origin /api/v1/ path; sensitive token, cookie, password, secret, and credential fields are redacted

Inputs: path (required).

okta-browser-refresh-proofB

Immediately publish a fresh authenticated browser proof to the loopback collector with every cookie value redacted

Inputs: no named parameters.

okta-browser-session-proofB

Open or reuse a live isolated browser, authenticate to the configured tenant, and publish redacted cookie proofs at authentication and every five minutes while the session remains active

Inputs: authorized (required), tenantConfirmation (required), timeoutSeconds.

okta-browser-snapshotA

Read a sanitized snapshot of the authenticated Okta page: title, headings, visible text, and controls without input values, cookies, tokens, or arbitrary JavaScript

Inputs: no named parameters.

okta-browser-statusA

Show the live isolated browser state, current same-origin page, authenticated identity, and proof schedule without exposing cookies

Inputs: no named parameters.

okta-oauth-reuse-proofB

AUTHORIZED LAB: demonstrate bearer-token reuse with two read-only UserInfo calls and publish only a SHA-256 token fingerprint

Inputs: authorized (required), tenantConfirmation (required).

okta-resetA

Reset this MCP to its fresh-install state for an authorized demonstration: close the live browser, cancel pending OAuth, clear saved mode/tenant and local OAuth cache, and make the next okta-start show the authentication configuration form

Inputs: confirm (required).

okta-startB

Canonical startup flow: configure Browser Session or OIDC/OAuth on first use, reuse saved setup on later calls, and begin authentication. Set reconfigure=true only when the user explicitly wants to change setup

Inputs: orgUrl, scopes, clientId, authServer, +8 more.

okta-statusA

Show the selected authentication mode, configured tenant, connection state, and latest redacted proofs

Inputs: no named parameters.

search-usersA

Search users visible to the connected Okta administrator (requires okta.users.read)

Inputs: query (required).

token-detailsA

Show safe token metadata without returning bearer values

Inputs: no named parameters.

userinfoA

Fetch the connected OIDC user's profile from Okta UserInfo

Inputs: no named parameters.

whoamiA

Show the connected OIDC user's verified Okta identity and granted scopes

Inputs: no named parameters.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3.1/5.0

Scored 2026-09-09 18:06 across 23 tools

Disambiguation3/5

Several clusters have overlapping purposes, especially the auth/proof tools and identity/status tools such as whoami, userinfo, token-details, and okta-status. The descriptions are detailed enough to usually disambiguate, but similar names like my-apps vs list-apps and okta-browser-session-proof vs okta-browser-refresh-proof create some misselection risk.

Naming Consistency2/5

Naming conventions are mixed: some tools use okta-* prefixes, others are bare names like whoami, userinfo, and token-details, and admin tools follow list/get/search patterns. The okta-browser-* and okta-oauth-* subgroups are helpful, but the overall naming is not predictable.

Tool Count3/5

With 23 tools, the server is in the heavy range and covers a broad set of Okta workflows. The count is not unreasonable, but some tools could be consolidated, particularly around browsing, proof refresh, and identity lookup.

Completeness3/5

The authentication lifecycle and read-only directory access are well covered, including browser proofs, OAuth lab flows, userinfo, and user/group/app listing. However, there are notable gaps for an Okta workspace server: no create/update/delete operations for users, groups, or apps, and no token revocation or logout beyond reset/browser close.

Maintenance

ActivityInactive

ResponsivenessOutdated data

Resources

Related MCP Connectors

Stytch
dev.stytch.mcp
The Stytch MCP server is a reference implementation that demonstrates remote MCP server authentication and authorization using Stytch Connected Apps. It provides OAuth 2.1-compliant authorization (including PKCE), Dynamic Client Registration, and validates Stytch-issued access tokens to enable AI agents to securely interact with external services through permissioned access, supporting scopes like openid, email, profile, and manage:project_data.
Security Autonomous Agents App Automation
2
http://mcp.stytch.dev/mcp
thoughts
ai.thoughtbox.api
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
Cloud Storage Finance
2
https://api.thoughtbox.ai/mcp
Parallel Task MCPA
ai.parallel
An MCP server for deep research or task groups
Autonomous Agents Agent Orchestration Research & Data
4416
https://task-mcp.parallel.ai/mcp
Tempr MCP Connector
io.temprhq
One OAuth connector for your team's remote MCP servers, with Tool Packs, guardrails and logs.
Security Observability Developer Tools
1
https://api.temprhq.io/mcp/connector

Related MCP Servers

mcp-read-only-argocd
CI/CD & DevOps Developer Tools
lukleh
A
license
A
quality
C
maintenance
A secure MCP server providing read-only access to Argo CD instances using browser session cookies, enabling querying of applications, projects, clusters, and repositories.
Updated 20 days ago (2026-10-22 15:15 UTC)
14
MIT
Okta MCP Server
Security Cloud Platforms
BalaGanaparthi
F
license
Not graded
quality
D
maintenance
An MCP server for managing Okta users (CRUD operations) with full OAuth 2.1 compliance, enabling secure integration with Claude Desktop and other MCP clients.
Updated 8 months ago (2026-03-21 09:07 UTC)
-
Okta-MCP
Security Databases
vaibhavGoyal1096
F
license
Not graded
quality
D
maintenance
A production-ready MCP server for Identity and Access Management with Okta integration, providing user and group management, audit logging, and permission guardrails.
Updated a year ago (2025-12-21 10:18 UTC)
-
okta-auth
Security Developer Tools
bunizao
A
license
A
quality
C
maintenance
MCP server for Okta authentication, enabling AI agents to log in, check sessions, list, delete, and get cookies using saved Okta sessions.
Updated 21 days ago (2026-10-22 03:42 UTC)
5
4
MIT

Okta Workspace MCP

Features

Quick Start

Install

Register in your MCP client

Authenticate

Authentication Modes

Browser Session

OIDC/OAuth

Configuration

Environment Variables

Available Tools

Security

Requirements

License

Available Tools

Tool Schema Changelog

TDQS

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

mcp-read-only-argocd

Okta MCP Server

Okta-MCP

okta-auth