# Okta MCP Server [Official] [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/okta/okta-mcp-server  
**GitHub Stars:** 79  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/okta-mcp-server

## Description
Okta's official self-hosted MCP server. Lets AI assistants manage an Okta org through the Okta Admin Management APIs (users, groups, applications, policies and logs), with tools enabled by the OAuth scopes you grant.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `uvx` (confidence: high):

```json
"mcpServers": {
  "okta-mcp-server": {
    "command": "uvx",
    "args": ["okta-mcp-server"],
    "env": {
      "OKTA_ORG_URL": "",
      "OKTA_CLIENT_ID": "",
      "OKTA_SCOPES": "",
      "OKTA_PRIVATE_KEY": "",
      "OKTA_KEY_ID": ""
    }
  }
}
```

**Requires environment variables:** `OKTA_ORG_URL`, `OKTA_CLIENT_ID`, `OKTA_SCOPES`, `OKTA_PRIVATE_KEY`, `OKTA_KEY_ID` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What Okta MCP Server does

Okta MCP Server gives MCP-compatible AI clients access to administrative operations in an Okta organization. It uses Okta’s Admin Management APIs and supports work across identity and configuration resources, including users, groups, applications, policies, device assurance policies, brands, themes, custom pages, email templates, custom domains, and email domains.

The server is intended for tasks such as creating a user and assigning group membership, reviewing failed sign-in activity, or finding applications that have not been used recently. It supports create, read, update, and delete operations where the corresponding Okta API and authorization scope are available.

## How it works

At startup, the server evaluates the OAuth 2.0 scopes in `OKTA_SCOPES`. Only tools with matching permissions are registered and exposed to the connected language model. This keeps the client’s available operation set aligned with the scopes granted to the Okta application.

Authentication can use the Device Authorization Grant or Private Key JWT. Device authorization is suited to interactive sign-in, while Private Key JWT supports server-to-server use without a browser. Destructive actions, including deletion and deactivation, request user confirmation through MCP elicitation. Clients without elicitation support use the server’s fallback confirmation behavior.

The implementation communicates with Okta through Okta’s Python SDK and runs as an MCP server for a compatible client.

## Setup and configuration

Run the server with Python 3.13 or newer, or use Docker. A non-Docker installation also requires the `uv` package manager. You need an Okta account with suitable permissions and an MCP client such as Claude Desktop or VS Code.

The essential configuration identifies the Okta organization, client, and requested scopes:

- `OKTA_ORG_URL`: Okta organization URL.
- `OKTA_CLIENT_ID`: OAuth client identifier.
- `OKTA_SCOPES`: whitespace-separated scopes that determine which tools load.

For Private Key JWT authentication, also provide `OKTA_PRIVATE_KEY` and `OKTA_KEY_ID`. For Device Authorization Grant, the server presents an authentication URL that the user opens in a browser. In a Docker container, copy that URL from the container logs manually; the container cannot open the host browser automatically.

Docker Compose is supported after cloning the repository and creating a `.env` file from the example. A keyring volume can preserve device-authorization tokens across container restarts.

## Tools and capabilities

Available operations cover:

- User, group, and application administration.
- Policy and device assurance policy management.
- Brand, theme, custom page, and email template configuration.
- Custom domain and email domain management.
- Okta log and sign-in activity queries.
- Scope-filtered tool registration at startup.
- Confirmation prompts for destructive operations.

The exact set of visible tools depends on the OAuth scopes granted to the configured Okta application.

## Limitations and notes

This server can change Okta organization data, so its OAuth scopes and client permissions should be selected deliberately. Tools without a matching scope are removed before the first request rather than shown as unavailable operations. Device authorization in Docker requires manual browser interaction, while Private Key JWT requires securely supplying the private key and key identifier.

_Full upstream README: https://allmcps.com/mcp/okta-mcp-server/readme_