Okta MCP Server
Okta Admin Management APIs for AI agents enabling natural language administrative tasks.
Data last scanned today · Reviewed today
Overview
This Python-based MCP server enables LLM agents to perform administrative operations within an Okta organization. By connecting to Okta's Admin Management APIs, it allows users to execute tasks like creating users, managing groups, or auditing failed login attempts through natural language commands.
Our verdict
With a security score of 40/100, this server is classified as high-risk. While the repository is active and possesses a clean zero-dependency footprint, it has not yet undergone independent editorial review and relies on community maintenance rather than direct vendor oversight. Organizations should exercise caution, as critical authentication methods and read-only behaviors have not been verified against modern security standards.
- Zero direct dependencies reduce supply-chain surface area.
- Destructive operations require explicit interactive confirmation via Elicitation API.
- Supports Private Key JWT for automated server-to-server communication.
- High-risk security score due to lack of independent review.
- Community-maintained rather than supported by official vendor.
- Authentication and read-only implementation details remain unverified.
Tools
| Tool | Description | Risk |
|---|---|---|
| list_users | List all users in your Okta organization | low |
| get_user | Get detailed information about a specific user | low |
| create_user | Create a new user in your Okta organization. Pass activate=false to create the user in STAGED status (no activation email sent); omit or pass activate=true (default) to create an active PROVISIONED user. | medium |
| update_user | Update an existing user's profile information | medium |
| deactivate_user | Deactivate a user (prompts for confirmation) | high |
| delete_deactivated_user | Permanently delete a deactivated user (prompts for confirmation) | high |
| get_user_profile_attributes | Retrieve all supported user profile attributes | low |
| list_groups | List all groups in your Okta organization | low |
| get_group | Get detailed information about a specific group | low |
| create_group | Create a new group | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Windsurf | ||||
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| ChatGPT |
Frequently asked questions
›What authentication methods are supported by the server?
The server supports Device Authorization Grant for interactive usage and Private Key JWT for automated server-to-server communication.
›How are destructive operations like deletes or deactivations handled?
Destructive operations prompt the user for confirmation via the MCP Elicitation API, with an automatic fallback mechanism for clients that do not support it.
›How does the server determine which tools to enable?
The server automatically enables or disables tools at startup based on the OAuth 2.0 scopes provided in the OKTA_SCOPES environment variable.
›What are the environment requirements for running the server?
You need Python 3.13 or higher, or Docker. If running locally without Docker, the uv package manager is also required.
›Are there limitations to using Device Authorization Grant with Docker?
Docker containers cannot automatically launch a browser on the host, so you must manually copy the authentication URL from the container logs to complete the login.
Changelog
Badge
Maintain this server? Add the live badge to your README.