Scalekit MCP Server is an OAuth-authenticated MCP server for administering Scalekit environments, organizations, users, identity connections, connectors, and registered MCP servers.
List and inspect environments; read environment credentials and API client details.
Manage environment roles and permission scopes.
Manage login redirect URIs, initiate-login URI, and post-logout redirect URIs.
Create, list, and inspect organizations; generate one-time admin portal links.
Create and list organization users and update organization features/settings.
List workspace members and invite new workspace members.
List environment and organization SSO connections and enable environment connections.
List connected OAuth connector accounts and create connector account magic links.
Search the connector catalog and search connector tools/actions.
Register, list, update, and switch authentication for MCP servers.
Search public Scalekit documentation without requiring an OAuth token.
Supports Auth0 as an OIDC connection provider for identity and access management within Scalekit environments
Supports GitHub as an OIDC connection provider for identity and access management within Scalekit environments
Supports GitLab as an OIDC connection provider for identity and access management within Scalekit environments
Supports Google as an OIDC connection provider for identity and access management within Scalekit environments
Supports Okta as an OIDC connection provider for identity and access management within Scalekit environments
Supports Salesforce as an OIDC connection provider for identity and access management within Scalekit environments
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Scalekit MCP Server list all environments in my organization"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
The official MCP server for Scalekit. Point Cursor, Claude, or another MCP client at it, sign in once, and the agent can set up environments, organizations, and the connectors your users' agents call. The agent acts as that signed-in user. It does not reuse one shared password.
Hosted. https://mcp.scalekit.com. No local install for the hosted server.
Connectors. Set up 600+ connectors and 35,000+ tools for agent integrations.
Admin tools. Environments, organizations, users, OIDC connections, roles, and scopes.
Clients. Claude, Cursor, VS Code, Windsurf, Gemini CLI, Codex, and any MCP client.
License. Apache-2.0.
{
"mcpServers": {
"scalekit": {
"url": "https://mcp.scalekit.com/"
}
}
}Related MCP server: Okta MCP Server
Find your client below. On first use it asks you to sign in with OAuth.
Use this for MCP inspectors and Glama. Docs tools work with no login. Admin tools need an OAuth token from the user.
npm install
npm run build
npm run start:stdioclaude mcp add --transport http scalekit https://mcp.scalekit.com/Open Claude Desktop
Go to Settings → Connectors
Click Add custom connector
Enter Scalekit as the name and https://mcp.scalekit.com as the URL
Click Connect to authenticate
Edit .vscode/mcp.json in your project (requires VS Code 1.101 or later):
{
"servers": {
"scalekit": {
"type": "http",
"url": "https://mcp.scalekit.com/"
}
}
}Edit ~/.cursor/mcp.json, or open Cursor Settings → MCP → Add New Global MCP Server and paste the config:
{
"mcpServers": {
"scalekit": {
"url": "https://mcp.scalekit.com/"
}
}
}Edit ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"scalekit": {
"serverUrl": "https://mcp.scalekit.com/"
}
}
}Edit ~/.gemini/settings.json:
{
"mcpServers": {
"scalekit": {
"httpUrl": "https://mcp.scalekit.com/"
}
}
}codex mcp add scalekit --url https://mcp.scalekit.com/Edit opencode.json in your project root:
{
"mcp": {
"scalekit": {
"type": "remote",
"url": "https://mcp.scalekit.com/",
"enabled": true
}
}
}{
"mcpServers": {
"scalekit": {
"type": "streamable-http",
"url": "https://mcp.scalekit.com/"
}
}
}Add to your Zed settings.json:
{
"context_servers": {
"scalekit": {
"url": "https://mcp.scalekit.com/"
}
}
}Edit ~/.kiro/settings/mcp.json:
{
"mcpServers": {
"scalekit": {
"url": "https://mcp.scalekit.com/"
}
}
}Go to Settings → MCP Servers → Add MCP Server and enter https://mcp.scalekit.com/, or add to your Warp MCP config:
{
"scalekit": {
"serverUrl": "https://mcp.scalekit.com/"
}
}Go to Prompt Tools → Add MCP and enter https://mcp.scalekit.com/.
list_environmentsDescription: List all available environments
Scopes: Environment Read
get_environment_detailsDescription: Get environment details by ID (e.g., env_123)
Parameters: environmentId
Scopes: Environment Read
list_environment_rolesDescription: List all roles in the specified environment
Parameters: environmentId (format: env_)
Scopes: Environment Read
create_environment_roleDescription: Create a new role in the specified environment
Parameters:
environmentId (format: env_)
roleName
displayName
description
isDefault (boolean)
Scopes: Environment Write
list_environment_scopesDescription: List all scopes in the specified environment
Parameters: environmentId (format: env_)
Scopes: Environment Read
create_environment_scopeDescription: Create a new scope in the specified environment
Parameters:
environmentId (format: env_)
scopeName
description
Scopes: Environment Write
list_workspace_membersDescription: List all members in the current workspace
Parameters: pageToken (1-based index)
Scopes: Workspace Read
invite_workspace_memberDescription: Invite a new member to the current workspace
Parameters: email
Scopes: Workspace Write
list_organizationsDescription: List all organizations under the specified environment
Parameters:
environmentId (format: env_)
pageToken
Scopes: Organization Read
get_organization_detailsDescription: Get details of an organization by ID (e.g., org_123)
Parameters:
environmentId (format: env_)
organizationId
Scopes: Organization Read
create_organizationDescription: Create a new organization under the specified environment
Parameters: environmentId (format: env_)
Scopes: Organization Write
generate_admin_portal_linkDescription: Generate a magic link to the admin portal for the selected organization
Parameters:
environmentId (format: env_)
organizationId (e.g., org_123)
Scopes: Organization Write
create_organization_userDescription: Create a new user in the selected organization
Parameters:
environmentId (format: env_)
organizationId
externalId
firstName
lastName
metadata (JSON key-value pairs)
Scopes: Organization Write
list_organization_usersDescription: List all users in the selected organization
Parameters:
environmentId (format: env_)
organizationId
pageToken
Scopes: Organization Read
update_organization_settingsDescription: Update the settings of an organization
Parameters:
environmentId (format: env_)
organizationId
feature (JSON array of feature objects)
Scopes: Organization Write
list_environment_connectionsDescription: List all connections for the specified environment
Parameters: environmentId (format: env_)
Scopes: Environment Read
list_organization_connectionsDescription: List all connections for the selected organization
Parameters:
environmentId (format: env_)
organizationId (e.g., org_123)
Scopes: Organization Read
create_environment_oidc_connectionDescription: Create a new OIDC connection for the specified environment
Parameters:
environmentId (format: env_)
provider (OKTA, GOOGLE, MICROSOFT_AD, AUTH0, ONELOGIN, PING_IDENTITY, JUMPCLOUD, CUSTOM, GITHUB, GITLAB, LINKEDIN, SALESFORCE, MICROSOFT, IDP_SIMULATOR, SCALEKIT, ADFS)
Scopes: Environment Write
update_environment_oidc_connectionDescription: Update an existing OIDC connection for the specified environment
Parameters:
environmentId (format: env_)
connectionId (e.g., conn_123)
key_id
provider
oidc_config (comprehensive OIDC configuration object)
Scopes: Environment Write
enable_environment_connectionDescription: Enable an existing connection for the specified environment
Parameters:
environmentId (format: env_)
connectionId (e.g., conn_123)
Scopes: Environment Write
list_mcp_serversDescription: List all MCP servers in the specified environment
Parameters:
environmentId (format: env_)
pageToken
Scopes: Environment Read
register_mcp_serverDescription: Register a new MCP server in the specified environment
Parameters:
environmentId (format: env_)
name
description
url
access_token_expiry (in seconds)
provider (optional, required when use_scalekit_authentication is false)
use_scalekit_authentication (boolean)
Scopes: Environment Write
update_mcp_serverDescription: Update an existing MCP server in the specified environment
Parameters:
environmentId (format: env_)
id (MCP server ID)
name (optional)
description (optional)
url (optional)
access_token_expiry (optional, in seconds)
provider (optional)
use_scalekit_authentication (optional boolean)
Scopes: Environment Write
switch_mcp_auth_to_scalekitDescription: Switch the authentication of an existing MCP server to Scalekit authentication
Parameters:
environmentId (format: env_)
id (MCP server ID)
Scopes: Environment Write
Environment Management: Create and configure Scalekit environments
Organization Operations: Manage enterprise organizations and their settings
User Administration: Handle user lifecycle and permissions
Connection Management: Configure SAML/OIDC identity provider connections
Workspace Administration: Manage team members and roles
Portal Integration: Generate admin portal links and manage access
MCP Server Registry: Register and configure additional MCP servers
Scalekit MCP server uses OAuth 2.1 for secure authentication. When you register the MCP server with your client, an OAuth authorization workflow ensures secure, token-based communication between your AI agent and Scalekit's platform.
Building your own OAuth-protected MCP server? Check out ourAuth for MCP Servers guide for implementation patterns.
Add one URL that a user may be sent to after logout. Use add_redirect_uri for a login callback URL. Use list_redirect_uris to read the current list. Requires the caller OAuth token. Adding a URL that is already on the list leaves the list unchanged.
Inputs: uri (required), environmentId (required).
Add one login callback URL to an environment. Use add_post_logout_redirect_uri for a URL used after logout. Use list_redirect_uris to read the current list. Requires the caller OAuth token. Adding a URL that is already on the list leaves the list unchanged.
Inputs: uri (required), environmentId (required).
Create a link that lets someone connect an OAuth connector account, such as Notion or Gmail, in one environment. Use list_connected_accounts to see accounts that are already connected. This tool does not search the catalog. Use search_connectors for that. Requires the caller OAuth token. Each call returns a new link and an expiry.
Inputs: connector (required), identifier (required), environmentId (required).
Create one role in an environment. Use list_environment_roles to see roles that already exist. This tool does not create a permission scope. Use create_environment_scope for that. Requires the caller OAuth token. A duplicate role name is rejected.
Inputs: roleName (required), environmentId (required), roleDisplayName (required), isDefault, +1 more.
Create one permission scope in an environment. Use list_environment_scopes to see scopes that already exist. This tool does not create a role. Use create_environment_role for that. Requires the caller OAuth token. A duplicate scope name is rejected.
Inputs: scopeName (required), environmentId (required), description.
Create one organization in an environment. Use list_organizations to see organizations that already exist. This tool does not create users inside the organization. Use create_organization_user after the organization exists. Requires the caller OAuth token.
Inputs: environmentId (required), organizationName (required).
Create one user in an organization and assign a role. Use list_organization_users to see users that already exist. This tool does not invite someone to the workspace. Use invite_workspace_member for that. Requires the caller OAuth token.
Inputs: role (required), email (required), environmentId (required), organizationId (required).
Enable one existing environment connection. Use list_environment_connections to find the connection id. This tool does not create a connection, and it does not enable an organization connection. Requires the caller OAuth token. Enabling an already enabled connection leaves it enabled.
Inputs: connection_id (required), environmentId (required).
Create a one-time admin portal link for one organization. Use get_organization_details to read the organization. This tool does not change organization settings. Use update_organization_settings for that. Requires the caller OAuth token. Each call returns a new link.
Inputs: environmentId (required), organizationId (required).
Read the API client id, environment URL, and secret suffix for one environment, as a .env block. Use get_environment_details for the environment name and domain, not the client id. Requires the caller OAuth token. The client secret value is not returned. The dashboard shows that secret.
Inputs: environmentId (required).
Read one environment by id, including its type and domain. Use list_environments when you need to discover an id. This tool does not list organizations. Use list_organizations for that. Requires the caller OAuth token.
Inputs: environmentId (required).
Read one organization by id. Use list_organizations when you need to discover an id. This tool does not list the organization users. Use list_organization_users for those. Requires the caller OAuth token.
Inputs: environmentId (required), organizationId (required).
Invite one person to the current workspace by email. Use list_workspace_members to see who is already a member. This tool does not add a user to an organization. Use create_organization_user for that. Requires the caller OAuth token. Each call can send a new invite.
Inputs: email (required).
List connected accounts in one environment, one page at a time. These are the users who authorized a connector. Use search_connectors to find a connector in the catalog. Use list_environment_connections for SSO connections, not connector accounts. Requires the caller OAuth token.
Inputs: environmentId (required), summary, pageSize, connector, +2 more.
List SSO connections configured on one environment. Use list_organization_connections for connections on one organization. Use list_connected_accounts for OAuth connector accounts. Those are a different record. Requires the caller OAuth token.
Inputs: environmentId (required).
List roles defined in one environment. Use create_environment_role to add a role. This tool does not list permission scopes. Use list_environment_scopes for those. Requires the caller OAuth token.
Inputs: environmentId (required).
List environments in the current workspace, one page at a time. Use this to discover environment ids. Use get_environment_details when you already have an id. Requires the caller OAuth token.
Inputs: pageSize, pageToken.
List permission scopes defined in one environment. Use create_environment_scope to add a scope. This tool does not list roles. Use list_environment_roles for those. Requires the caller OAuth token.
Inputs: environmentId (required).
List MCP servers registered in one environment, one page at a time. Use register_mcp_server to add a server. Use update_mcp_server to change one. Requires the caller OAuth token.
Inputs: environmentId (required), pageToken.
List SSO connections for one organization. Use list_environment_connections for connections on the environment as a whole. Use enable_environment_connection to enable an environment connection, not an organization connection. Requires the caller OAuth token.
Inputs: environmentId (required), organizationId (required).
List organizations in one environment, one page at a time. Use get_organization_details when you already have an organization id. Use create_organization to add one. Requires the caller OAuth token.
Inputs: environmentId (required), pageToken.
List users in one organization, one page at a time. Use get_organization_details to read the organization record. Use create_organization_user to add a user. Requires the caller OAuth token.
Inputs: environmentId (required), organizationId (required), pageToken.
Read the login redirect URIs, the initiate-login URI, and the post-logout redirect URIs for one environment. Use add_redirect_uri, set_initiate_login_uri, or add_post_logout_redirect_uri to change one of those values. Requires the caller OAuth token.
Inputs: environmentId (required).
List members of the current workspace, one page at a time. Use invite_workspace_member to add a member. This tool does not list users inside an organization. Use list_organization_users for those. Requires the caller OAuth token.
Inputs: pageToken.
Register one MCP server in an environment and return its protected-resource metadata. Use list_mcp_servers to see servers that already exist. Use update_mcp_server to change a server after it exists. Requires the caller OAuth token. Publish that metadata at /.well-known/oauth-protected-resource on the server. The URL you pass becomes the token audience.
Inputs: name (required), mcpServerUrl (required), environmentId (required), accessTokenExpiry (required), +3 more.
Clear the initiate-login URI for an environment. Use set_initiate_login_uri to set a new one. Use list_redirect_uris to read the current value. Requires the caller OAuth token. This deletes the URI.
Inputs: environmentId (required).
Remove one post-logout redirect URL from an environment. Use remove_redirect_uri to remove a login callback URL. Use list_redirect_uris to read the current list. Requires the caller OAuth token. This deletes that URL from the allowed list.
Inputs: uri (required), environmentId (required).
Remove one login callback URL from an environment. Use remove_post_logout_redirect_uri to remove a post-logout URL. Use list_redirect_uris to read the current list. Requires the caller OAuth token. This deletes that URL from the allowed list.
Inputs: uri (required), environmentId (required).
Search the connector catalog in one environment, one page at a time. Examples are Google, Notion, and Slack. Use search_tools to search actions on a connector. This tool does not list connected accounts. Use list_connected_accounts for those. Requires the caller OAuth token.
Inputs: environmentId (required), query, pageSize, pageToken, +2 more.
Search public Scalekit documentation by keyword. The result is capped at 50,000 characters. Read a docs:// resource when one resource already covers the topic. Use this tool only when no docs:// resource matches. This tool does not require a Scalekit OAuth token. It does not change any Scalekit record.
Inputs: query (required).
Search actions exposed by connectors in one environment, one page at a time. Use search_connectors to find the connector itself. This tool does not call the action. Output schemas are not returned. Read the connector API docs for the response shape. Requires the caller OAuth token.
Inputs: environmentId (required), query, summary, pageSize, +3 more.
Set the initiate-login URI for an environment. That URI is the app endpoint that redirects to the Scalekit authorize endpoint for logins that did not start in the app, including IdP-initiated SSO. Use remove_initiate_login_uri to clear it. Use list_redirect_uris to read it. Requires the caller OAuth token. Setting the same URI again leaves it unchanged.
Inputs: uri (required), environmentId (required).
Clear the external provider on one registered MCP server and move that server onto Scalekit authentication. Use update_mcp_server to change the name, URL, or other fields. This tool does not edit those fields. Requires the caller OAuth token. The call always sends the switch request.
Inputs: id (required), environmentId (required).
Update fields on one registered MCP server, such as its name or URL. Use switch_mcp_auth_to_scalekit when the only change is to clear an external provider and use Scalekit authentication. Use list_mcp_servers to find the id. Requires the caller OAuth token.
Inputs: id (required), environmentId (required), useScalekitAuthentication (required), name, +4 more.
Turn features on or off for one organization, such as directory sync. Use get_organization_details to read the organization. This tool does not rename the organization and does not add users. Requires the caller OAuth token.
Inputs: features (required), environmentId (required), organizationId (required).
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 35 tools
Descriptions are highly cross-referential and explicitly state boundaries (e.g., list_environment_connections vs list_organization_connections vs list_connected_accounts; create_organization_user vs invite_workspace_member). A few near-duplicate read tools (redirect URI variants, connection types) could still trip an agent, but the boundaries are generally clear.
All 35 tools follow a consistent snake_case verb_noun pattern (list_, get_, create_, update_, remove_, add_, set_, enable_, search_, register_, etc.). No mixed conventions or vague names appear.
With 35 tools, this is a heavy, granular surface for the domain. Many operations are split into very specific tools (separate add/remove for each redirect URI type), which suggests overexposure rather than a lean, well-scoped set.
Coverage spans environments, organizations, users, SSO connections, OAuth connectors, MCP servers, and docs, but lifecycle operations are uneven. Several resources lack update/delete tools (e.g., organizations, users, roles, scopes, connected accounts, MCP servers), creating notable gaps for full CRUD workflows.
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
Identity, authorization, audit trails, and revocable permissions for AI agents accessing MCP tools.
Spacebring MCP server. Look up members, bookings, invoices, subscriptions, events and more, and take everyday actions such as creating events or replying to support tickets, from MCP-compatible AI assistants that support remote servers with OAuth.
