Okta MCP Server

The Okta Self-Hosted MCP Server connects large language models and AI agents to Okta's Admin Management APIs. Once it is running, you can ask an MCP client such as Claude Desktop to carry out Okta management tasks in plain language, for example creating a user and adding them to a group, listing failed login attempts from the last day, or finding applications that have not been used for a month.

The server implements the Model Context Protocol, an open protocol that standardises how language models call external tools. It covers create, read, update and delete operations for users, groups, applications, policies, device assurance policies, logs, brands, themes and custom pages. It uses Okta's official Python SDK to communicate with your org.

Tools are loaded at startup based on the OAuth 2.0 scopes set in OKTA_SCOPES. Tools without a matching scope are removed before the first request, so the agent only sees the operations your application is allowed to perform. Destructive operations such as deletes and deactivations ask for confirmation through the MCP Elicitation API before they run, with a fallback for clients that do not yet support the feature.

Authentication uses either the Device Authorization Grant for interactive use or Private Key JWT for server-to-server automation. The server can run in a Docker container, from a clone of the repository with uv, or from PyPI with uvx or pipx. It requires Python 3.13 or later, or Docker, along with an Okta account that has the appropriate permissions.

The server is aimed at Okta administrators and engineers who want to automate routine org work or let an agent answer questions about their tenant. The project is released under the Apache-2.0 licence and is open source. The page does not list any paid plans for the server itself.