Okta MCP Server

A TypeScript Model Context Protocol server that exposes Okta incident-support and administrative workflows to MCP-compatible IDE clients over stdio.

Capabilities

• Read org metadata.
• Investigate user incidents with one summary tool.
• List and inspect users, groups, app assignments, MFA factors, sessions, policies, IdPs, network zones, and System Log events.
• Query focused user System Log events by actor, event type, and outcome.
• Optionally expose write/remediation tools for lifecycle, group membership, session clearing, password expiry, and MFA reset.

Requirements

• Node.js 20 or newer.
• An Okta org URL such as https://example.okta.com.
• An Okta API token with the least privileges needed for the tools you plan to use.

Setup

npm install
cp .env.example .env
npm run build

Set these environment variables before launching the server:

export OKTA_ORG_URL="https://your-org.okta.com"
export OKTA_API_TOKEN="your-okta-api-token"
export OKTA_REQUEST_TIMEOUT_MS="30000"
export OKTA_ENABLE_WRITE_TOOLS="false"

OKTA_ENABLE_WRITE_TOOLS defaults to false. Keep it false for read-only support triage. Set it to true only for trusted remediation sessions where your MCP host has explicit tool-call approval.

Run

For local development:

npm run dev

For the local React support console:

npm run build
export OKTA_ORG_URL="https://your-org.okta.com"
export OKTA_API_TOKEN="your-okta-api-token"
export OKTA_ENABLE_WRITE_TOOLS="false"
npm run ui

Open http://127.0.0.1:5173. The React app talks to a local HTTP bridge on port 4174, and the bridge talks to this MCP server over stdio.

For an MCP client, use the built entrypoint:

{
  "mcpServers": {
    "okta": {
      "command": "node",
      "args": ["/absolute/path/to/Okta MCP Server/dist/index.js"],
      "env": {
        "OKTA_ORG_URL": "https://your-org.okta.com",
        "OKTA_API_TOKEN": "your-okta-api-token"
      }
    }
  }
}

Tools

Tool	Purpose
okta_get_org_info	Read organization metadata.
okta_get_user_incident_summary	Gather profile, groups, factors, sessions, app links, and recent logs for a user.
okta_list_users	List users with q, search, filter, limit, and after.
okta_get_user	Read one user by ID, login, or shortname.
okta_list_user_groups	List groups assigned to a user.
okta_list_user_factors	List enrolled MFA factors for a user.
okta_get_user_factor	Read one enrolled MFA factor.
okta_list_user_sessions	List active sessions for a user.
okta_list_user_app_links	List app links visible to a user.
okta_list_groups	List groups with q, search, filter, limit, and after.
okta_get_group	Read one group.
okta_list_group_users	List users assigned to a group.
okta_list_applications	List applications.
okta_get_application	Read one application.
okta_list_application_users	List users assigned to an application.
okta_get_application_user	Read one app assignment for a user.
okta_list_policies	List Okta policies for access and sign-on troubleshooting.
okta_get_policy	Read one policy.
okta_list_policy_rules	List policy rules.
okta_list_identity_providers	List identity providers.
okta_get_identity_provider	Read one identity provider.
okta_list_network_zones	List network zones.
okta_list_system_logs	Query System Log events.
okta_search_user_system_logs	Search user-related System Log events by login, email, or user ID.

These remediation tools are registered only when OKTA_ENABLE_WRITE_TOOLS=true:

Tool	Purpose
okta_create_user	Create a user with a supplied profile, credentials, and optional groups.
okta_update_user	Update a user's profile or credentials.
okta_deactivate_user	Deactivate a user.
okta_unlock_user	Unlock a locked user.
okta_suspend_user	Suspend a user.
okta_unsuspend_user	Unsuspend a user.
okta_expire_user_password	Expire a password and optionally issue a temporary password.
okta_reset_user_factor	Reset a user's MFA factor.
okta_clear_user_sessions	Clear user sessions and optionally revoke OAuth tokens.
okta_create_group	Create a group.
okta_add_user_to_group	Add a user to a group.
okta_remove_user_from_group	Remove a user from a group.

Incident Workflows

Common support prompts from an MCP client IDE:

• "Use Okta to summarize the incident context for user jane@example.com since 2026-07-06T12:00:00Z."
• "Check whether this user has active sessions, enrolled factors, and recent MFA failures."
• "Find failed sign-in or app access events for jane@example.com in the last two hours."
• "Compare the user's assigned groups with the failing application's assignments."
• "List sign-on and MFA policies that may affect this app or user."

Security Notes

• Use a scoped Okta admin/API token and rotate it regularly.
• Store OKTA_API_TOKEN in your MCP host's secret storage when available.
• Leave OKTA_ENABLE_WRITE_TOOLS=false for normal incident triage.
• Treat lifecycle, MFA reset, session clearing, and membership tools as privileged operations.
• Review MCP host approvals before allowing write operations.

See Architecture for component design, data flow, and extension guidance. See Using Okta MCP from Claude or VS Code for natural-language support workflows.