# SailPoint MCP Server

MCP server for SailPoint IdentityNow/Identity Security Cloud API. Provides comprehensive tools for identity governance, access management, and compliance operations.

## Features

- **Identity Management**: List, search, and get identity details
- **Account Operations**: List accounts, enable/disable, unlock, view entitlements
- **Access Profiles**: Create, list, and manage access profile bundles
- **Roles**: Create, list, and manage role definitions
- **Certifications**: View certification campaigns and access reviews
- **Workflows**: List, test, and monitor automation workflows
- **Search**: Full-text search across identities, accounts, roles, and more
- **SOD Policies**: View Separation of Duties policies and violations
- **Sources**: List and inspect connected identity sources

## Configuration

Set the following environment variables:

```bash
SAILPOINT_BASE_URL=https://your-tenant.api.identitynow.com
SAILPOINT_CLIENT_ID=your-client-id
SAILPOINT_CLIENT_SECRET=your-client-secret
SAILPOINT_API_VERSION=v3  # Optional: v3 (default) or v2025
```

### API Version Support

The server supports both SailPoint API versions:
- **v3** (default): Stable, widely-supported API version
- **v2025**: Latest API version with new features like Configuration Hub, enhanced identity management, and experimental endpoints

To use v2025 APIs, set `SAILPOINT_API_VERSION=v2025`. The v2025 API includes:
- Configuration Hub for automated configuration deployment
- Enhanced identity deletion capabilities
- Machine account management
- Data segmentation and access security
- Advanced IAI features (outliers, role mining, common access)
- Non-employee lifecycle management

For more information, see [SailPoint API v2025 Documentation](https://developer.sailpoint.com/docs/api/v2025/)

### Getting Credentials

1. Log into your SailPoint Identity Security Cloud tenant
2. Go to **Preferences** (under your username dropdown)
3. Select **Personal Access Tokens** on the left
4. Click **New Token** to generate a new PAT
5. Copy the **Client ID** and **Client Secret**

Your base URL follows the format: `https://{tenant}.api.identitynow.com`

## Available Tools

### Identities
- `list_identities` - List identities with filtering
- `get_identity` - Get detailed identity information

### Accounts
- `list_accounts` - List accounts across sources
- `get_account` - Get account details
- `get_account_entitlements` - List account entitlements
- `enable_account` - Enable a disabled account
- `disable_account` - Disable an account
- `unlock_account` - Unlock a locked account

### Access Profiles
- `list_access_profiles` - List access profiles
- `get_access_profile` - Get access profile details
- `create_access_profile` - Create a new access profile

### Roles
- `list_roles` - List roles
- `get_role` - Get role details
- `get_role_assigned_identities` - List identities assigned to a role
- `create_role` - Create a new role

### Certifications
- `list_certifications` - List active certifications
- `get_certification` - Get certification details
- `list_certification_campaigns` - List certification campaigns
- `get_certification_campaign` - Get campaign details

### Workflows
- `list_workflows` - List automation workflows
- `get_workflow` - Get workflow details
- `get_workflow_executions` - View workflow execution history
- `test_workflow` - Test a workflow

### Sources
- `list_sources` - List connected sources
- `get_source` - Get source details

### Search
- `search` - Search across indices (identities, accounts, roles, etc.)
- `search_aggregate` - Aggregate analytics queries

### Entitlements
- `list_entitlements` - List entitlements
- `get_entitlement` - Get entitlement details

### Access Requests
- `list_access_requests` - List access requests
- `create_access_request` - Create a new access request

### Identity Profiles
- `list_identity_profiles` - List identity profiles
- `get_identity_profile` - Get identity profile details

### SOD Policies
- `list_sod_policies` - List SOD policies
- `get_sod_policy` - Get SOD policy details
- `list_sod_violations` - List SOD violations

## Usage Examples

### Search for identities
```json
{
  "indices": ["identities"],
  "query": "name:John AND department:Engineering"
}
```

### List active access requests
```json
{
  "filters": "status eq \"PENDING\""
}
```

### Create an access request
```json
{
  "requestedFor": ["identity-id-1"],
  "requestedItems": [
    {
      "type": "ROLE",
      "id": "role-id",
      "comment": "Need access for project X"
    }
  ]
}
```

## Building

```bash
npm install
npm run build
```

## Performance Features

### HTTP Connection Pooling
The server uses a singleton axios instance with HTTP Keep-Alive for optimal performance:
- Reuses TCP connections across multiple requests
- Connection pool: 50 max sockets, 10 max free sockets
- 30-second keep-alive timeout
- Automatic token refresh without creating new connections

This provides significant performance improvements for sequential API calls, especially when making multiple requests in a short time period.

### Token Caching
OAuth2 tokens are cached with a 60-second buffer before expiry, minimizing unnecessary token refresh requests.

## License

MIT