Skip to main content
Watch: I Built an AI App Without Leaving Databricks

Auth and security - official Okta server

Okta Open Source MCP server

Self-hosted MCP server that lets LLM agents manage an Okta org through the Okta Admin Management APIs, covering users, groups, applications, policies, device assurance policies, system logs, brands, themes, custom pages and email templates. It runs locally from okta-mcp-server (pypi) with OAuth auth.

Last verified 15 tools9 sources

Install

VS Code

JSON
{
  "mcp": {
    "inputs": [
      {
        "type": "promptString",
        "description": "Okta Organization URL (e.g., https://dev-123456.okta.com)",
        "id": "OKTA_ORG_URL"
      },
      {
        "type": "promptString",
        "description": "Okta Client ID",
        "id": "OKTA_CLIENT_ID",
        "password": true
      },
      {
        "type": "promptString",
        "description": "Okta Scopes (separated by whitespace)",
        "id": "OKTA_SCOPES"
      }
    ],
    "servers": {
      "okta-mcp-server": {
        "command": "uvx",
        "args": ["okta-mcp-server"],
        "env": {
          "OKTA_ORG_URL": "${input:OKTA_ORG_URL}",
          "OKTA_CLIENT_ID": "${input:OKTA_CLIENT_ID}",
          "OKTA_SCOPES": "${input:OKTA_SCOPES}"
        }
      }
    }
  }
}

Generic

JSON
{
  "mcpServers": {
    "okta-mcp-server": {
      "command": "uvx",
      "args": ["okta-mcp-server"],
      "env": {
        "OKTA_ORG_URL": "<OKTA_ORG_URL>",
        "OKTA_CLIENT_ID": "<OKTA_CLIENT_ID>",
        "OKTA_SCOPES": "<OKTA_SCOPES>"
      }
    }
  }
}

Tools

list_users
List all users in your Okta organization
get_user
Get detailed information about a specific user
create_user
Create a new user in your Okta organization
deactivate_user
Deactivate a user (prompts for confirmation)
list_groups
List all groups in your Okta organization
create_group
Create a new group
add_user_to_group
Add a user to a group
remove_user_from_group
Remove a user from a group
list_applications
List all applications in your Okta organization
install_oin_app
Install an instance of an OIN catalog app
list_policies
List all policies in your Okta organization
create_policy_rule
Create a new rule for a policy
list_device_assurance_policies
List all Device Assurance Policies in your Okta organization
get_logs
Retrieve system logs from your Okta org
list_email_templates
List all email templates for a brand

As documented on October 17, 2026. A running server reports its current list through tools/list.

Notes and caveats

  • The README calls it Generally Available (GA), though the pyproject classifier still says 'Development Status :: 4 - Beta'.
  • Requires Python 3.13+ with uv/uvx, or Docker built locally from the repo (no published image).
  • Authenticates with the OAuth 2.0 Device Authorization Grant (interactive) or Private Key JWT (browserless, OKTA_PRIVATE_KEY and OKTA_KEY_ID).
  • Tools are registered only for the scopes granted in OKTA_SCOPES.
  • Destructive operations ask for confirmation via MCP elicitation.
  • The generic snippet is the README's PyPI Claude Desktop config.

More MCP servers for auth and security

Related reading

FAQ

What does the Okta Open Source MCP server do?

Self-hosted MCP server that lets LLM agents manage an Okta org through the Okta Admin Management APIs, covering users, groups, applications, policies, device assurance policies, system logs, brands, themes, custom pages and email templates. The vendor documents 15 tools, including list_users, get_user, create_user and deactivate_user.

How do I add the Okta Open Source MCP server to VS Code?

Okta documents a VS Code config; copy it from the VS Code section of this page. Snippets for Generic are there too.

Does the Okta Open Source MCP server need authentication?

Yes, OAuth. Transport: stdio. Status: GA, last checked October 17, 2026.

Sources

Last verified against 9 Okta pages, then re-checked independently.

Newsletter

New MCP servers, the week they ship

One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.