Pingone Mcp Server

PingOne MCP Server

[](LICENSE) [](https://github.com/pingidentity/pingone-mcp-server/releases) [](https://github.com/pingidentity/pingone-mcp-server/actions/workflows/gosec-scan.yml) [](https://goreportcard.com/report/github.com/pingidentity/pingone-mcp-server)

The PingOne MCP (Model Context Protocol) server enables AI assistants to review and manage PingOne tenants by integrating the PingOne management API to AI assistant conversations.

> [!CAUTION] > Preview Software Notice > > This is preview software provided AS IS with no warranties of any kind. > > - Functionality, features, and APIs are subject to change at any time without prior notice > - Use against production environments or mission-critical workloads is not advised > - Limited support is available during the public preview phase — please report bugs and provide feedback via the GitHub issue tracker > > Your use of this software constitutes acceptance of these terms.

> [!CAUTION] > Security Notice > > Depending on the requests made to the MCP server, tenant configuration or data may be returned. Do not use the MCP server with untrusted MCP clients, agent code or LLM inference and ensure least privilege principles are followed when granting role permissions to MCP server users.

> [!WARNING] > Review Generated Configuration > > Configuration can be generated dynamically using LLM and user feedback represented dynamically back to agents/conversations. Be sure to review generated configuration before promoting to production environments, or those serving live identity/access requests.

Features

• Administer your PingOne environment using natural language - Interact with PingOne from whichever AI IDE or MCP client tool you use daily.

• Secure authentication - Supports OAuth 2.0 PKCE flow for local deployment and Device Code Flow for containerized deployment. All actions are user-based and auditable. Tokens stored securely in OS keychain (local) or ephemerally (Docker).

• Environment, application and population operations - Provides tool integrations to create, update and analyze configurations for tenant activities.

Use Cases

This MCP server is designed to help developers integrate PingOne capabilities into their applications, while also helping tenant administrators monitor and troubleshoot issues. Common use cases include:

• Accelerate application development
• Generate sample applications
• Monitor tenants and environment configuration

Have you got an interesting use case or project you'd like to share with the community? We'd love to hear about it on the PingOne Community pages!

Getting Started

The PingOne MCP server may be run as a Docker container or as a binary distribution executable.

> [!IMPORTANT] > Docker requires MCP client URL mode elicitation support > > The Docker method can only be used with MCP clients that support URL mode elicitation (introduced in the 2025-11-25 MCP specification). This capability is essential for securely providing the authorization URL to the user during device mode authentication, ensuring the URL is only presented to the human user and not presented to be processed by the AI agent.

To use the Docker container method, see the [Docker Usage Instructions](./docs/docker-usage-instructions.md).

The following instructions in this readme describe how to get started with the binary distribution executable, which suits the majority of MCP clients.

Prerequisites

• A licensed or trial PingOne cloud subscription. - Don't have a tenant? Sign up for a free trial here.
• MCP-compatible client (E.g. Claude Desktop, VS Code Copilot Chat, Cursor, Zed, etc.)
• Homebrew (for macOS and Linux package install)

Prepare PingOne for MCP Server Use

The MCP server requires a worker application in your PingOne tenant to access the management APIs. You'll need to capture two values during setup:

• Environment ID - The PingOne environment containing your worker application (referred to later as {{admin environment id}})
• Client ID - The worker application's client identifier (referred to later as {{mcp application client id}})

Default: Authorization Code with PKCE

The server uses the Authorization Code grant with PKCE by default. Configure your worker application with:

• Grant Type: Authorization Code with PKCE required
• Response Type: Code
• Token Endpoint Authentication: None
• Redirect URI: http://127.0.0.1:7464/callback
• Application Roles: None required (the MCP server inherits roles from the authenticated user)

> Note: For detailed instructions on creating the application and setting up admin users, see [Setting Up PingOne Worker Applications](docs/setup-pingone-worker-application.md).

Alternative: Device Authorization Grant (for headless/containerized environments)

Using the Device Authorization Grant

For headless or containerized environments, use the Device Authorization grant. Configure your worker application with:

• Grant Type: Device Authorization
• Token Endpoint Authentication: None
• Redirect URI: http://127.0.0.1:7464/callback
• Application Roles: None required (the MCP server inherits roles from the authenticated user)

This grant type is ideal for environments without a browser, such as CI/CD pipelines or remote servers.

Install the MCP Server

macOS and Linux

Use Ping Identity's Homebrew tap to install the PingOne MCP server

brew tap pingidentity/tap
brew install pingone-mcp-server

Alternatively, expand the instructions below to install manually from GitHub release artifacts.

macOS - GitHub Release Manual Installation Instructions

macOS Manual Installation Instructions

See the latest GitHub release for artifact downloads, artifact signatures, and the checksum file. To verify package downloads, see the [Verify Section](#verify).

OR

Use the following single-line command to install the server into '/usr/local/bin' directly.

RELEASE_VERSION=$(basename $(curl -Ls -o /dev/null -w %{url_effective} https://github.com/pingidentity/pingone-mcp-server/releases/latest)); \
OS_NAME=$(uname -s); \
HARDWARE_PLATFORM=$(uname -m | sed s/aarch64/arm64/ | sed s/x86_64/amd64/); \
URL="https://github.com/pingidentity/pingone-mcp-server/releases/download/${RELEASE_VERSION}/pingone-mcp-server_${RELEASE_VERSION#v}_${OS_NAME}_${HARDWARE_PLATFORM}"; \
curl -Ls -o pingone-mcp-server "${URL}"; \
chmod +x pingone-mcp-server; \
sudo mv pingone-mcp-server /usr/local/bin/pingone-mcp-server;

Verify with Checksums

See the latest GitHub release for the checksums.txt file. The checksums are in the format of SHA256.

Linux - GitHub Release Manual Installation Instructions

Linux Manual Installation Instructions

See the latest GitHub release for artifact downloads, artifact signatures, and the checksum file. To verify package downloads, see the [Verify Section](#verify).

OR

Use the following single-line command to install the server into '/usr/local/bin' directly.

RELEASE_VERSION=$(basename $(curl -Ls -o /dev/null -w %{url_effective} https://github.com/pingidentity/pingone-mcp-server/releases/latest)); \
OS_NAME=$(uname -s); \
HARDWARE_PLATFORM=$(uname -m | sed s/aarch64/arm64/ | sed s/x86_64/amd64/); \
URL="https://github.com/pingidentity/pingone-mcp-server/releases/download/${RELEASE_VERSION}/pingone-mcp-server_${RELEASE_VERSION#v}_${OS_NAME}_${HARDWARE_PLATFORM}"; \
curl -Ls -o pingone-mcp-server "${URL}"; \
chmod +x pingone-mcp-server; \
sudo mv pingone-mcp-server /usr/local/bin/pingone-mcp-server;

Verify with Checksums

See the latest GitHub release for the checksums.txt file. The checksums are in the format of SHA256.

Windows - GitHub Release Manual Installation Instructions

Windows Manual Installation Instructions

See the latest GitHub release for artifact downloads, artifact signatures, and the checksum file. To verify package downloads, see the [Verify Section](#verify).

OR

Use the following single-line PowerShell 7.4 command to install the server into '%LOCALAPPDATA%\Programs' directly. >NOTE: After installation, ensure that %LOCALAPPDATA%\Programs is included in your PATH environment variable. If it is not already present, add it so you can call pingone-mcp-server directly in your terminal, and so that it can be called directly in your chosen AI client.

$latestReleaseUrl = Invoke-WebRequest -Uri "https://github.com/pingidentity/pingone-mcp-server/releases/latest" -MaximumRedirection 0 -ErrorAction Ignore -UseBasicParsing -SkipHttpErrorCheck; `
$RELEASE_VERSION = [System.IO.Path]::GetFileName($latestReleaseUrl.Headers.Location); `
$RELEASE_VERSION_NO_PREFIX = $RELEASE_VERSION -replace "^v", ""; `
$HARDWARE_PLATFORM = $env:PROCESSOR_ARCHITECTURE -replace "ARM64", "arm64" -replace "x86", "386" -replace "AMD64", "amd64" -replace "EM64T", "amd64"; `
$URL = "https://github.com/pingidentity/pingone-mcp-server/releases/download/${RELEASE_VERSION}/pingone-mcp-server_${RELEASE_VERSION_NO_PREFIX}_windows_${HARDWARE_PLATFORM}.exe"
Invoke-WebRequest -Uri $URL -OutFile "pingone-mcp-server.exe"; `
Move-Item -Path pingone-mcp-server.exe -Destination "${env:LOCALAPPDATA}\Programs"

Verify with Checksums

See the latest GitHub release for the checksums.txt file. The checksums are in the format of SHA256.

Test the installation:

pingone-mcp-server --version

Use with VS Code

[](https://insiders.vscode.dev/redirect/mcp/install?name=pingOne&inputs=%5B%7B%22type%22%3A%22promptString%22%2C%22id%22%3A%22pingoneenvironmentid%22%2C%22description%22%3A%22The%20environment%20ID%20containing%20the%20MCP%20server%20worker%20application%22%2C%22password%22%3Afalse%7D%2C%7B%22type%22%3A%22promptString%22%2C%22id%22%3A%22pingonemcpclientid%22%2C%22description%22%3A%22The%20client%20ID%20of%20the%20MCP%20server%20worker%20application%22%2C%22password%22%3Afalse%7D%2C%7B%22type%22%3A%22promptString%22%2C%22id%22%3A%22pingoneapirootdomain%22%2C%22description%22%3A%22The%20root%20domain%20of%20your%20PingOne%20tenant%20%28e.g.%2C%20%60pingone.com%60%20%2C%20%60pingone.eu%60%20%2C%20%60pingone.ca%60%29%22%2C%22password%22%3Afalse%7D%5D&config=%7B%22type%22%3A%22stdio%22%2C%22command%22%3A%22pingone-mcp-server%22%2C%22args%22%3A%5B%22run%22%5D%2C%22env%22%3A%7B%22PINGONEMCPENVIRONMENTID%22%3A%22%24%7Binput%3Apingoneenvironmentid%7D%22%2C%22PINGONEAUTHORIZATIONCODECLIENTID%22%3A%22%24%7Binput%3Apingonemcpclientid%7D%22%2C%22PINGONEROOTDOMAIN%22%3A%22%24%7Binput%3Apingoneapirootdomain%7D%22%7D%7D) [](https://insiders.vscode.dev/redirect/mcp/install?name=pingOne&inputs=%5B%7B%22type%22%3A%22promptString%22%2C%22id%22%3A%22pingoneenvironmentid%22%2C%22description%22%3A%22The%20environment%20ID%20containing%20the%20MCP%20server%20worker%20application%22%2C%22password%22%3Afalse%7D%2C%7B%22type%22%3A%22promptString%22%2C%22id%22%3A%22pingonemcpclientid%22%2C%22description%22%3A%22The%20client%20ID%20of%20the%20MCP%20server%20worker%20application%22%2C%22password%22%3Afalse%7D%2C%7B%22type%22%3A%22promptString%22%2C%22id%22%3A%22pingoneapirootdomain%22%2C%22description%22%3A%22The%20root%20domain%20of%20your%20PingOne%20tenant%20%28e.g.%2C%20%60pingone.com%60%20%2C%20%60pingone.eu%60%20%2C%20%60pingone.ca%60%29%22%2C%22password%22%3Afalse%7D%5D&config=%7B%22type%22%3A%22stdio%22%2C%22command%22%3A%22pingone-mcp-server%22%2C%22args%22%3A%5B%22run%22%5D%2C%22env%22%3A%7B%22PINGONEMCPENVIRONMENTID%22%3A%22%24%7Binput%3Apingoneenvironmentid%7D%22%2C%22PINGONEAUTHORIZATIONCODECLIENTID%22%3A%22%24%7Binput%3Apingonemcpclientid%7D%22%2C%22PINGONEROOTDOMAIN%22%3A%22%24%7Binput%3Apingoneapirootdomain%7D%22%7D%7D&quality=insiders)

For quick installation, use one of the install buttons above.

To add the MCP server configuration manually, add the following configuration to your MCP configuration file:

{
  "servers": {
    "pingOne": {
      "type": "stdio",
      "command": "pingone-mcp-server",
      "args": [
        "run",
      ],
      "env": {
        "PINGONE_MCP_ENVIRONMENT_ID": "${input:pingone_environment_id}",
        "PINGONE_AUTHORIZATION_CODE_CLIENT_ID": "${input:pingone_mcp_client_id}",
        "PINGONE_ROOT_DOMAIN": "${input:pingone_api_root_domain}",
      },
    },
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "pingone_environment_id",
      "description": "The environment ID containing the MCP server worker application",
      "password": false
    },
    {
      "type": "promptString",
      "id": "pingone_mcp_client_id",
      "description": "The client ID of the MCP server worker application",
      "password": false
    },
    {
      "type": "promptString",
      "id": "pingone_api_root_domain",
      "description": "The root domain of your PingOne tenant (e.g., `pingone.com` , `pingone.eu` , `pingone.ca`)",
      "password": false
    }
  ]
}

Once installed, ensure agent mode is turned on and the MCP server has started, then make the first request!

Alternative: Using the Device Authorization Grant

To configure the MCP server to use the Device Authorization grant type, add the --grant-type command argument with a value of device_code and add the environment variables PINGONE_DEVICE_CODE_CLIENT_ID and PINGONE_DEVICE_CODE_SCOPES as shown in the example:

{
  "servers": {
    "pingOne": {
      "type": "stdio",
      "command": "pingone-mcp-server",
      "args": [
        "run",
        "--grant-type",
        "device_code"
      ],
      "env": {
        "PINGONE_MCP_ENVIRONMENT_ID": "${input:pingone_environment_id}",
        "PINGONE_DEVICE_CODE_CLIENT_ID": "${input:pingone_mcp_client_id}",
        "PINGONE_DEVICE_CODE_SCOPES": "openid",
        "PINGONE_ROOT_DOMAIN": "${input:pingone_api_root_domain}",
      },
    },
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "pingone_environment_id",
      "description": "The environment ID containing the MCP server worker application",
      "password": false
    },
    {
      "type": "promptString",
      "id": "pingone_mcp_client_id",
      "description": "The client ID of the MCP server worker application",
      "password": false
    },
    {
      "type": "promptString",
      "id": "pingone_api_root_domain",
      "description": "The root domain of your PingOne tenant (e.g., `pingone.com` , `pingone.eu` , `pingone.ca`)",
      "password": false
    }
  ]
}

Use with Claude Desktop

To add the MCP server configuration manually, add the following configuration to your Claude Desktop config (claude_desktop_config.json) or via Settings -> Developer -> Local MCP Servers:

{
  "mcpServers": {
    "pingone": {
      "type": "stdio",
      "command": "pingone-mcp-server",
      "args": [
        "run"
      ],
      "env": {
        "PINGONE_MCP_ENVIRONMENT_ID": ">",
        "PINGONE_AUTHORIZATION_CODE_CLIENT_ID": ">",
        "PINGONE_ROOT_DOMAIN": ">"
      }
    }
  }
}

If you've downloaded the binary manually to a location not on the PATH, change the command to refer to the full path to the binary file.

Alternative: Using the Device Authorization Grant

To c

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: pingidentity
• Source: pingidentity/pingone-mcp-server
• License: Apache-2.0
• Homepage: https://developer.pingidentity.com

Install and usage instructions live in the source repository linked above.