Log inSubmit server
Okta MCP Server logo

Okta MCP Server

Manage Okta users, groups, apps, policies, and logs through an MCP-compatible AI client.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Okta MCP Server

Pick your client, then add it in one click or paste the config.

STDIOPython
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "okta-mcp-server": {
      "command": "uvx",
      "args": [
        "okta-mcp-server"
      ],
      "env": {
        "OKTA_ORG_URL": "YOUR_VALUE_HERE",
        "OKTA_CLIENT_ID": "YOUR_VALUE_HERE",
        "OKTA_SCOPES": "YOUR_VALUE_HERE",
        "OKTA_PRIVATE_KEY": "YOUR_VALUE_HERE",
        "OKTA_KEY_ID": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

uvx okta-mcp-server

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked .

Overview

Okta MCP Server connects AI assistants to an Okta organization through the Okta Admin Management APIs. It exposes administrative tools for users, groups, applications, policies, logs, and other configuration resources, with tool availability controlled by granted OAuth scopes. Authentication supports Device Authorization Grant for interactive use and Private Key JWT for automated deployments. Reach for it when an MCP client needs to inspect or change Okta configuration using natural-language requests.

Use cases

  • Create and manage Okta users
  • Assign users to groups
  • Review failed login activity
  • Administer Okta applications and policies
  • Configure Okta branding and domains

Key features

  • Okta Admin Management API access
  • Scope-based tool loading
  • Device Authorization Grant authentication
  • Private Key JWT authentication
  • Confirmation for destructive operations
  • CRUD support across Okta resources

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked

Recent health check succeeded.

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 3d ago via OSV.dev · okta-mcp-server (PyPI)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars79Stargazers on the source repository.
Last commit11d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.

How Okta MCP Server works

What Okta MCP Server does

Okta MCP Server gives MCP-compatible AI clients access to administrative operations in an Okta organization. It uses Okta’s Admin Management APIs and supports work across identity and configuration resources, including users, groups, applications, policies, device assurance policies, brands, themes, custom pages, email templates, custom domains, and email domains.

The server is intended for tasks such as creating a user and assigning group membership, reviewing failed sign-in activity, or finding applications that have not been used recently. It supports create, read, update, and delete operations where the corresponding Okta API and authorization scope are available.

How it works

At startup, the server evaluates the OAuth 2.0 scopes in OKTA_SCOPES. Only tools with matching permissions are registered and exposed to the connected language model. This keeps the client’s available operation set aligned with the scopes granted to the Okta application.

Authentication can use the Device Authorization Grant or Private Key JWT. Device authorization is suited to interactive sign-in, while Private Key JWT supports server-to-server use without a browser. Destructive actions, including deletion and deactivation, request user confirmation through MCP elicitation. Clients without elicitation support use the server’s fallback confirmation behavior.

The implementation communicates with Okta through Okta’s Python SDK and runs as an MCP server for a compatible client.

Setup and configuration

Run the server with Python 3.13 or newer, or use Docker. A non-Docker installation also requires the uv package manager. You need an Okta account with suitable permissions and an MCP client such as Claude Desktop or VS Code.

The essential configuration identifies the Okta organization, client, and requested scopes:

  • OKTA_ORG_URL: Okta organization URL.
  • OKTA_CLIENT_ID: OAuth client identifier.
  • OKTA_SCOPES: whitespace-separated scopes that determine which tools load.

For Private Key JWT authentication, also provide OKTA_PRIVATE_KEY and OKTA_KEY_ID. For Device Authorization Grant, the server presents an authentication URL that the user opens in a browser. In a Docker container, copy that URL from the container logs manually; the container cannot open the host browser automatically.

Docker Compose is supported after cloning the repository and creating a .env file from the example. A keyring volume can preserve device-authorization tokens across container restarts.

Tools and capabilities

Available operations cover:

  • User, group, and application administration.
  • Policy and device assurance policy management.
  • Brand, theme, custom page, and email template configuration.
  • Custom domain and email domain management.
  • Okta log and sign-in activity queries.
  • Scope-filtered tool registration at startup.
  • Confirmation prompts for destructive operations.

The exact set of visible tools depends on the OAuth scopes granted to the configured Okta application.

Limitations and notes

This server can change Okta organization data, so its OAuth scopes and client permissions should be selected deliberately. Tools without a matching scope are removed before the first request rather than shown as unavailable operations. Device authorization in Docker requires manual browser interaction, while Private Key JWT requires securely supplying the private key and key identifier.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Okta MCP Server

Okta MCP Server is an MCP server that connects AI assistants to an Okta organization through the Okta Admin Management APIs. Its main tools manage users, groups, applications, policies, configuration resources, and logs, with available tools determined by the OAuth scopes granted to the Okta application.

Install it with Python 3.13+ and uv, or run it with Docker. For Docker, clone the repository, create a .env file from the example, start the service with Docker Compose, and configure an MCP client such as Claude Desktop or VS Code.

Okta MCP Server supports Device Authorization Grant and Private Key JWT authentication. Device authorization requires browser interaction, while Private Key JWT uses an Okta private key and key identifier for automated server-to-server operation.

Set the OAuth 2.0 permissions in OKTA_SCOPES. At startup, the server registers only tools whose required scopes are granted to the Okta application, so operations without matching permissions are not exposed to the AI client.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewOkta MCP Server AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/okta-mcp-server?style=directory)](https://allmcps.com/mcp/okta-mcp-server)
HTML Embed
<a href="https://allmcps.com/mcp/okta-mcp-server"><img src="https://allmcps.com/api/badge/okta-mcp-server?style=directory" alt="Okta MCP Server on AllMCPs" /></a>