Hosting

local

Transport

stdio

Endpoint

Local process; no hosted endpoint documented

Authentication

Self-hosted; OAuth device authorization or Private Key JWT. Runtime tool list is filtered by configured OAuth scopes.

Requirements

• Okta organization/admin permissions
• Python 3.13+ and uv, or Docker
• Configured Okta OIDC app

Setup steps

1. Choose Docker or uv method from official README.
2. Create/configure an Okta app and grant only required scopes.
3. Set OKTA_ORG_URL, OKTA_CLIENT_ID, OKTA_SCOPES and auth settings securely.
4. Complete browser device flow if selected; for JWT store private key and KID securely.
5. Restart client and verify with harmless read call.

Current official README confirms all 108 exact names in the stored inventory. The server filters tools according to OKTA_SCOPES and checks required OAuth scopes again at call time, so a connected tenant may expose fewer. Mutations include account and identity changes; deactivation/deletion operations can be destructive.

• list_users
  01
• get_user
  02
• create_user
  03
• update_user
  04
• deactivate_user
  05
• delete_deactivated_user
  06
• get_user_profile_attributes
  07
• list_user_groups
  08
• list_groups
  09
• get_group
  10
• create_group
  11
• update_group
  12
• delete_group
  13
• list_group_users
  14
• list_group_apps
  15
• add_user_to_group
  16
• remove_user_from_group
  17
• list_applications
  18
• get_application
  19
• create_application
  20
• update_application
  21
• delete_application
  22
• activate_application
  23
• deactivate_application
  24
• list_catalog_apps
  25
• get_catalog_app
  26
• install_oin_app
  27
• list_policies
  28
• get_policy
  29
• create_policy
  30
• update_policy
  31
• delete_policy
  32
• activate_policy
  33
• deactivate_policy
  34
• list_policy_rules
  35
• get_policy_rule
  36
• create_policy_rule
  37
• update_policy_rule
  38
• delete_policy_rule
  39
• activate_policy_rule
  40
• deactivate_policy_rule
  41
• list_device_assurance_policies
  42
• get_device_assurance_policy
  43
• create_device_assurance_policy
  44
• replace_device_assurance_policy
  45
• delete_device_assurance_policy
  46
• get_logs
  47
• list_brands
  48
• get_brand
  49
• list_brand_domains
  50
• create_brand
  51
• replace_brand
  52
• delete_brand
  53
• list_brand_themes
  54
• get_brand_theme
  55
• replace_brand_theme
  56
• upload_brand_theme_logo
  57
• delete_brand_theme_logo
  58
• upload_brand_theme_favicon
  59
• delete_brand_theme_favicon
  60
• upload_brand_theme_background_image
  61
• delete_brand_theme_background_image
  62
• get_sign_in_page_resources
  63
• get_customized_sign_in_page
  64
• get_default_sign_in_page
  65
• get_preview_sign_in_page
  66
• replace_customized_sign_in_page
  67
• delete_customized_sign_in_page
  68
• replace_preview_sign_in_page
  69
• delete_preview_sign_in_page
  70
• list_sign_in_widget_versions
  71
• get_error_page_resources
  72
• get_customized_error_page
  73
• get_default_error_page
  74
• get_preview_error_page
  75
• replace_customized_error_page
  76
• delete_customized_error_page
  77
• replace_preview_error_page
  78
• delete_preview_error_page
  79
• get_sign_out_page_settings
  80
• replace_sign_out_page_settings
  81
• list_email_templates
  82
• get_email_template
  83
• list_email_customizations
  84
• get_email_customization
  85
• create_email_customization
  86
• replace_email_customization
  87
• delete_email_customization
  88
• delete_all_email_customizations
  89
• get_email_customization_preview
  90
• get_email_default_content
  91
• get_email_default_content_preview
  92
• get_email_settings
  93
• replace_email_settings
  94
• send_test_email
  95
• list_custom_domains
  96
• get_custom_domain
  97
• create_custom_domain
  98
• replace_custom_domain
  99
• delete_custom_domain
  100
• upsert_custom_domain_certificate
  101
• verify_custom_domain
  102
• list_email_domains
  103
• get_email_domain
  104
• create_email_domain
  105
• replace_email_domain
  106
• delete_email_domain
  107
• verify_email_domain
  108

• official tool reference

  Current official README lists 108 exact MCP tools, scope requirements, runtime filtering behavior, and authentication methods; the stored names exactly match the documented tool set.

Documentation checked 2026-10-28. Connection has not been runtime tested.