Okta Mcp Server

[](https://opensource.org/licenses/Apache-2.0) [](https://python.org/)

:tada: __It's Official__ :tada:

The Okta Open-Source MCP Server integrates with LLMs and AI agents, allowing you to perform various Okta management operations using natural language and is Generally Available (GA).

MCP (Model Context Protocol) is an open protocol introduced by Anthropic that standardizes how large language models communicate with external tools, resources or remote services.

The Okta MCP Server integrates with LLMs and AI agents, allowing you to perform various Okta management operations using natural language. For instance, you could simply ask Claude Desktop to perform Okta management operations:

• > Create a new user and add them to the Engineering group
• > Show me all failed login attempts from the last 24 hours
• > List all applications that haven't been used in the past month

Empower your LLM Agents to Manage your Okta Organization

This server is an Model Context Protocol server that provides seamless integration with Okta's Admin Management APIs. It allows LLM agents to interact with Okta in a programmatic way, enabling automation and enhanced management capabilities.

Key Features

• LLM-Driven Okta Management: Allows your LLM agents to perform administrative tasks within your Okta environment based on natural language instructions.
• Secure Authentication: Supports both Device Authorization Grant for interactive use and Private Key JWT for secure, automated server-to-server communication.
• Interactive Confirmation via Elicitation: Destructive operations (deletes, deactivations) prompt the user for confirmation through the MCP Elicitation API before proceeding, with automatic fallback for clients that do not yet support the feature.
• Integration with Okta Admin Management APIs: Leverages the official Okta APIs to ensure secure and reliable interaction with your Okta org.
• Extensible Architecture: Designed to be easily extended with new functionalities and support for additional Okta API endpoints.
• Comprehensive Tool Support: Full CRUD operations for users, groups, applications, policies, device assurance policies, brands, themes, custom pages, email templates, custom domains, email domains, and more.
• Scope-Based Tool Loading: Tools are automatically enabled or disabled at server startup based on the OAuth 2.0 scopes configured in OKTA_SCOPES. Only tools for which your application has been granted the required scope are registered and visible to the LLM — tools without a matching scope are silently removed before the first request.

This MCP server utilizes Okta's Python SDK v3.4.1 to communicate with the Okta APIs, ensuring a robust and well-supported integration.

🚀 Getting Started

Prerequisites:

• Python 3.8+ OR Docker
• uv package manager (if not using Docker)
• Claude Desktop or any other MCP Client
• Okta account with appropriate permissions

Install the Okta MCP Server

Install Okta MCP Server and configure it to work with your preferred MCP Client.

Choose one of the following installation methods:

🐳 Option 1: Docker (Recommended)

Docker provides a consistent environment without needing to install Python or uv locally.

1. Clone the repository:

``bash git clone https://github.com/okta/okta-mcp-server.git cd okta-mcp-server ``

1. Create a .env file from the example:

``bash cp .env.example .env # Edit .env and add your Okta credentials ``

1. Build and run with Docker Compose:

``bash docker-compose up -d ``

1. Configure your MCP Client to use the Docker container:

Claude Desktop with Docker (Private Key JWT - Recommended for Docker):

This method requires no browser interaction and is ideal for containerized environments.

{
  "mcpServers": {
    "okta-mcp-server": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "OKTA_ORG_URL",
        "-e", "OKTA_CLIENT_ID",
        "-e", "OKTA_SCOPES",
        "-e", "OKTA_PRIVATE_KEY",
        "-e", "OKTA_KEY_ID",
        "okta-mcp-server"
      ],
      "env": {
        "OKTA_ORG_URL": "https://your-org.okta.com",
        "OKTA_CLIENT_ID": "your-client-id",
        "OKTA_SCOPES": "okta.users.read okta.groups.read",
        "OKTA_PRIVATE_KEY": "-----BEGIN RSA PRIVATE KEY-----\nYour private key content here\n-----END RSA PRIVATE KEY-----",
        "OKTA_KEY_ID": "your-key-id"
      }
    }
  }
}

Claude Desktop with Docker (Device Authorization Grant):

This method requires browser-based authentication. When the server starts, it will display an authentication URL in the logs. Copy and paste this URL into your browser to complete the authentication.

> Note: Docker containers cannot open a browser on the host automatically. You must manually copy the URL from docker logs okta-mcp-server and paste it into your browser.

{
  "mcpServers": {
    "okta-mcp-server": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "okta-keyring:/home/appuser/.local/share/python_keyring",
        "-e", "OKTA_ORG_URL",
        "-e", "OKTA_CLIENT_ID",
        "-e", "OKTA_SCOPES",
        "-e", "PYTHON_KEYRING_BACKEND=keyrings.alt.file.PlaintextKeyring",
        "okta-mcp-server"
      ],
      "env": {
        "OKTA_ORG_URL": "https://your-org.okta.com",
        "OKTA_CLIENT_ID": "your-client-id",
        "OKTA_SCOPES": "okta.users.read okta.groups.read"
      }
    }
  }
}

The -v okta-keyring:/home/appuser/.local/share/python_keyring volume persists tokens between container restarts.

VS Code with Docker (Private Key JWT - Recommended for Docker):

{
  "mcp": {
    "inputs": [
      {
        "type": "promptString",
        "description": "Okta Organization URL (e.g., https://dev-123456.okta.com)",
        "id": "OKTA_ORG_URL"
      },
      {
        "type": "promptString",
        "description": "Okta Client ID",
        "id": "OKTA_CLIENT_ID",
        "password": true
      },
      {
        "type": "promptString",
        "description": "Okta Scopes (separated by whitespace)",
        "id": "OKTA_SCOPES"
      },
      {
        "type": "promptString",
        "description": "Okta Private Key (for browserless auth)",
        "id": "OKTA_PRIVATE_KEY",
        "password": true
      },
      {
        "type": "promptString",
        "description": "Okta Key ID (for browserless auth)",
        "id": "OKTA_KEY_ID",
        "password": true
      }
    ],
    "servers": {
      "okta-mcp-server": {
        "command": "docker",
        "args": [
          "run", "-i", "--rm",
          "-e", "OKTA_ORG_URL=${input:OKTA_ORG_URL}",
          "-e", "OKTA_CLIENT_ID=${input:OKTA_CLIENT_ID}",
          "-e", "OKTA_SCOPES=${input:OKTA_SCOPES}",
          "-e", "OKTA_PRIVATE_KEY=${input:OKTA_PRIVATE_KEY}",
          "-e", "OKTA_KEY_ID=${input:OKTA_KEY_ID}",
          "okta-mcp-server"
        ]
      }
    }
  }
}

VS Code with Docker (Device Authorization Grant):

> Note: Device Authorization requires manual browser interaction. When the server starts, check the MCP output panel for the authentication URL, then copy and paste it into your browser.

{
  "mcp": {
    "inputs": [
      {
        "type": "promptString",
        "description": "Okta Organization URL (e.g., https://dev-123456.okta.com)",
        "id": "OKTA_ORG_URL"
      },
      {
        "type": "promptString",
        "description": "Okta Client ID",
        "id": "OKTA_CLIENT_ID",
        "password": true
      },
      {
        "type": "promptString",
        "description": "Okta Scopes (separated by whitespace)",
        "id": "OKTA_SCOPES"
      }
    ],
    "servers": {
      "okta-mcp-server": {
        "command": "docker",
        "args": [
          "run", "-i", "--rm",
          "-v", "okta-keyring:/home/appuser/.local/share/python_keyring",
          "-e", "OKTA_ORG_URL=${input:OKTA_ORG_URL}",
          "-e", "OKTA_CLIENT_ID=${input:OKTA_CLIENT_ID}",
          "-e", "OKTA_SCOPES=${input:OKTA_SCOPES}",
          "-e", "PYTHON_KEYRING_BACKEND=keyrings.alt.file.PlaintextKeyring",
          "okta-mcp-server"
        ]
      }
    }
  }
}

Alternatively, use docker-compose (requires .env file):

{
  "mcp": {
    "servers": {
      "okta-mcp-server": {
        "command": "docker-compose",
        "args": [
          "-f",
          "/path/to/okta-mcp-server/docker-compose.yml",
          "run",
          "--rm",
          "okta-mcp-server"
        ]
      }
    }
  }
}

Alternatively, build and run directly:

# Build the image
docker build -t okta-mcp-server .

# Run the container
docker run -i --rm \
  -e OKTA_ORG_URL="" \
  -e OKTA_CLIENT_ID="" \
  -e OKTA_SCOPES="" \
  okta-mcp-server

📦 Option 2: uv (Python Package Manager)

1. Clone and install the server:

``bash git clone https://github.com/okta/okta-mcp-server.git cd okta-mcp-server uv sync ``

1. Configure Claude Desktop by adding the following to your claude_desktop_config.json:

``json { "mcpServers": { "okta-mcp-server": { "command": "uv", "args": [ "run", "--directory", "/path/to/okta-mcp-server", "okta-mcp-server" ], "env": { "OKTA_ORG_URL": "", "OKTA_CLIENT_ID": "", "OKTA_SCOPES": "", "OKTA_PRIVATE_KEY": "", "OKTA_KEY_ID": "" } } } } ``

Configure with Different MCP Clients

VS Code

Add the following to your VS Code settings.json:

{
  "mcp": {
    "inputs": [
      {
        "type": "promptString",
        "description": "Okta Organization URL (e.g., https://dev-123456.okta.com)",
        "id": "OKTA_ORG_URL"
      },
      {
        "type": "promptString",
        "description": "Okta Client ID",
        "id": "OKTA_CLIENT_ID",
        "password": true
      },
      {
        "type": "promptString",
        "description": "Okta Scopes (separated by whitespace, e.g., 'okta.users.read okta.groups.manage')",
        "id": "OKTA_SCOPES"
      },
      {
        "type": "promptString",
        "description": "Okta Private Key. Required for 'browserless' auth.",
        "id": "OKTA_PRIVATE_KEY",
        "password": true
      },
      {
        "type": "promptString",
        "description": "Okta Key ID (KID) for the private key. Required for 'browserless' auth.",
        "id": "OKTA_KEY_ID",
        "password": true
      }
    ],
    "servers": {
      "okta-mcp-server": {
        "command": "uv",
        "args": [
          "run",
          "--directory",
          "/path/to/the/okta-mcp-server",
          "okta-mcp-server"
        ],
        "env": {
          "OKTA_ORG_URL": "${input:OKTA_ORG_URL}",
          "OKTA_CLIENT_ID": "${input:OKTA_CLIENT_ID}",
          "OKTA_SCOPES": "${input:OKTA_SCOPES}",
          "OKTA_PRIVATE_KEY": "${input:OKTA_PRIVATE_KEY}",
          "OKTA_KEY_ID": "${input:OKTA_KEY_ID}"
        }
      }
    }
  }
}

Other MCP Clients

To use Okta MCP Server with any other MCP Client, you can manually add this configuration to the client and restart for changes to take effect:

{
  "mcpServers": {
    "okta-mcp-server": {
      "command": "uv",
      "args": [
        "run",
        "--directory",
        "/path/to/okta-mcp-server",
        "okta-mcp-server"
      ],
      "env": {
        "OKTA_ORG_URL": "",
        "OKTA_CLIENT_ID": "",
        "OKTA_SCOPES": "",
        "OKTA_PRIVATE_KEY": "",
        "OKTA_KEY_ID": ""
      }
    }
  }
}

Authenticate with Okta

The server supports two authentication methods. Choose the one that best fits your use case.

Method 1: Device Authorization Grant (Interactive)

1. In your Okta org, create a new App Integration.
2. Select OIDC - OpenID Connect and Native Application.
3. Under Grant type, ensure Device Authorization is checked.
4. Go to the Okta API Scopes tab and Grant permissions for the APIs you need (e.g., okta.users.read, okta.groups.manage).
5. Save the application and copy the Client ID.
6. Documentation: Okta Device Authorization Grant Guide

Method 2: Private Key JWT (Browserless)

1. Create App: In your Okta org, create a new App Integration. Select API Services. Save the app and copy the Client ID.
2. Configure Client Authentication:

• On the app's General tab, find the Client Credentials section and click Edit.
• Disable Require Demonstrating Proof of Possession (DPoP) header in token requests.
• Select Public key / Private key for the authentication method.

1. Add a Public Key: You have two options for adding a key.

• Option A: Generate Key in Okta (Recommended)

1. In the Public keys section, click Add key.
2. In the dialog, choose Generate new key.
3. Okta will instantly generate a key pair. Download or save the private key (private.pem) and store it securely.
4. Copy the Key ID (KID) displayed for the newly generated key.

• Option B: Use Your Own Key

1. Generate a key pair locally using the following openssl commands:

```bash # Generate a 2048-bit RSA private key openssl genpkey -algorithm RSA -out private.pem -pkeyopt rsakeygenbits:2048

# Extract the public key from the private key openssl rsa -in private.pem -pubout -out public.pem ```

1. Click Add key and paste the contents of your public key (public.pem) into the dialog.
2. Copy the Key ID (KID) displayed for the key you added.
3. Grant API Scopes: Go to the Okta API Scopes tab and Grant permissions for the APIs you need.
4. Assign Admin Roles: Go to the Admin roles tab and assign the appropriate admin role to this application.

Verify your integration

Restart your MCP Client (Claude Desktop, VS Code, etc.) and ask it to help you manage your Okta tenant:

> Show me the users in my Okta organization

🛠️ Supported Tools

The Okta MCP Server provides the following tools for LLMs to interact with your Okta tenant:

Users

> Required scope: okta.users.read (read) · okta.users.manage (write)

| Tool | Description | Usage Examples | | ------------------------------- | -------------------------------------------------------- |---------------------------------------------------------------------------------------------------------------------------------------------------------------| | list_users | List all users in your Okta organization | - Show me the users in my Okta org - Find users with 'john' in their name - What users do I have in the Engineering department? | | get_user | Get detailed information about a specific user | - Show me details for user john.doe@company.com - Get information about user ID 00u1234567890 - What groups is Jane Smith a member of? | | create_user | Create a new user in your Okta organization. Pass activate=false to create the user in STAGED status (no acti

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: okta
• Source: okta/okta-mcp-server
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.