Skip to main content
Glama
takleb3rry

Zitadel MCP

by takleb3rry
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

zitadel_update_app

Idempotent

Update an OIDC application's redirect URIs, grant types, response types, and token settings in Zitadel to align authentication with your integration.

Instructions

Update an OIDC application's configuration (redirect URIs, auth method, grant types, etc.).

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
appIdYesThe application ID to update
devModeNoEnable/disable dev mode
projectIdYesThe project ID
grantTypesNoReplace OAuth grant types (omit to keep current). Include OIDC_GRANT_TYPE_REFRESH_TOKEN to enable refresh tokens.
redirectUrisNoUpdated redirect URIs
responseTypesNoReplace OIDC response types (omit to keep current).
accessTokenTypeNoChange access token format. OIDC_TOKEN_TYPE_JWT issues self-contained JWTs (validatable via JWKS); OIDC_TOKEN_TYPE_BEARER issues opaque reference tokens. Omit to keep current.
idTokenRoleAssertionNoInclude user roles in ID tokens
postLogoutRedirectUrisNoUpdated post-logout URIs
accessTokenRoleAssertionNoInclude user roles in access tokens
idTokenUserinfoAssertionNoInclude user info (name, email) in ID tokens

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv2.0.0
    • addedInput schema / properties / accessTokenType
      Added value: +{
+  "description": "Change access token format. OIDC_TOKEN_TYPE_JWT issues self-contained JWTs (validatable via JWKS); OIDC_TOKEN_TYPE_BEARER issues opaque reference tokens. Omit to keep current.",
+  "enum": [
+    "OIDC_TOKEN_TYPE_BEARER",
+    "OIDC_TOKEN_TYPE_JWT"
+  ],
+  "type": "string"
+}
    • addedInput schema / properties / grantTypes
      Added value: +{
+  "description": "Replace OAuth grant types (omit to keep current). Include OIDC_GRANT_TYPE_REFRESH_TOKEN to enable refresh tokens.",
+  "items": {
+    "enum": [
+      "OIDC_GRANT_TYPE_AUTHORIZATION_CODE",
+      "OIDC_GRANT_TYPE_IMPLICIT",
+      "OIDC_GRANT_TYPE_REFRESH_TOKEN",
+      "OIDC_GRANT_TYPE_DEVICE_CODE",
+      "OIDC_GRANT_TYPE_TOKEN_EXCHANGE"
+    ],
+    "type": "string"
+  },
+  "type": "array"
+}
    • addedInput schema / properties / responseTypes
      Added value: +{
+  "description": "Replace OIDC response types (omit to keep current).",
+  "items": {
+    "enum": [
+      "OIDC_RESPONSE_TYPE_CODE",
+      "OIDC_RESPONSE_TYPE_ID_TOKEN",
+      "OIDC_RESPONSE_TYPE_ID_TOKEN_TOKEN"
+    ],
+    "type": "string"
+  },
+  "type": "array"
+}
  2. First observedv1.0.2

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=true, and destructiveHint=false, so the safety and repeatability profile is covered. The description adds no behavioral context beyond that—it does not state that this is a partial update, what permissions are required, or what happens to omitted fields (that detail lives in the schema, not the description).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the verb and resource lead immediately. It is appropriately sized, though the parenthetical list is partly redundant with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Annotations plus a fully documented schema mean an agent can invoke this correctly. However, the description omits the partial-update nature of the operation and required permissions, which are meaningful for a mutation tool even with rich structured fields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all 11 parameters including the enum and the 'omit to keep current' semantics are already documented in the schema. The description only echoes a few field names (redirect URIs, grant types) without adding meaning, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Update) and resource (OIDC application's configuration) and names representative fields (redirect URIs, auth method, grant types). It clearly distinguishes the mutation intent from siblings like zitadel_create_oidc_app or zitadel_get_app, though it never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, no prerequisites (e.g., the app must already exist), and no routing to alternatives such as create_oidc_app for new apps or get_app for reads. Usage is only implied by the word 'Update'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools