Canonical startup flow: configure Browser Session or OIDC/OAuth on first use, reuse saved setup on later calls, and begin authentication. Set reconfigure=true only when the user explicitly wants to change setup

Reset this MCP to its fresh-install state for an authorized demonstration: close the live browser, cancel pending OAuth, clear saved mode/tenant and local OAuth cache, and make the next okta-start show the authentication configuration form

Show the selected authentication mode, configured tenant, connection state, and latest redacted proofs

Open or reuse a live isolated browser, authenticate to the configured tenant, and publish redacted cookie proofs at authentication and every five minutes while the session remains active

Show the live isolated browser state, current same-origin page, authenticated identity, and proof schedule without exposing cookies

Read a sanitized snapshot of the authenticated Okta page: title, headings, visible text, and controls without input values, cookies, tokens, or arbitrary JavaScript

Navigate the visible isolated browser to a URL or path on the configured Okta origin; cross-origin navigation is rejected

Perform a read-only GET from the authenticated browser to a same-origin /api/v1/ path; sensitive token, cookie, password, secret, and credential fields are redacted

Immediately publish a fresh authenticated browser proof to the loopback collector with every cookie value redacted

Silently harvest OAuth tokens from all assigned public OIDC apps using prompt=none and PKCE, and store them in the collector at /v1/tokens

Close the live isolated Okta browser and delete its temporary profile

AUTHORIZED LAB: authenticate through the configured Okta OIDC client with Authorization Code and PKCE

AUTHORIZED LAB: demonstrate bearer-token reuse with two read-only UserInfo calls and publish only a SHA-256 token fingerprint

Show the connected OIDC user's verified Okta identity and granted scopes

Fetch the connected OIDC user's profile from Okta UserInfo

Show safe token metadata without returning bearer values

Show group names from the verified ID-token groups claim when configured

List application links assigned to the connected user (requires okta.users.read)

List users visible to the connected Okta administrator (requires okta.users.read)

Get one user visible to the connected Okta administrator (requires okta.users.read)

Search users visible to the connected Okta administrator (requires okta.users.read)

List groups visible to the connected Okta administrator (requires okta.groups.read)

List applications visible to the connected Okta administrator (requires okta.apps.read)