authentik-mcp
Provides tools for managing Authentik identity provider resources including users, groups, applications, tokens, providers, flows, stages, policies, and admin settings.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@authentik-mcplist all users"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
authentik-mcp
MCP server for Authentik identity provider.
Install
{
"mcpServers": {
"authentik": {
"command": "uvx",
"args": ["--refresh", "--extra-index-url", "https://nikitatsym.github.io/authentik-mcp/simple", "authentik-mcp"],
"env": {
"AUTHENTIK_URL": "https://auth.example.com",
"AUTHENTIK_TOKEN": "your-api-token"
}
}
}
}Where to paste:
Claude Desktop —
~/Library/Application Support/Claude/claude_desktop_config.jsonCursor —
.cursor/mcp.jsonin your projectClaude Code —
~/.claude.jsontop-levelmcpServers
Or use the setup wizard to generate the config.
Related MCP server: MCP Authentik
Getting an API token
Authentik admin panel → Directory → Tokens and App passwords → Create with API scope.
Groups
Tool | Description |
| Users, groups, apps, tokens, providers, outposts, crypto, RBAC (read-only) |
| Create/update core resources (non-destructive) |
| Delete operations across all domains (destructive) |
| Flows, stages, policies, sources, events (read-only) |
| Create/update auth pipeline config (non-destructive) |
| Admin settings, system info, lifecycle |
Call any group with operation="help" to list available operations.
Application access control
Apps are open to all authenticated users until gated. Restrict an app to a group/user by binding it: CreatePolicyBinding(target=<app pk>, group=<group pk>) (or user=) in authentik_flows_write; inspect gates with ListPolicyBindings / ShowPolicyBinding in authentik_flows_read. Policy bindings live under the authentik_flows_* groups, not the core ones.
Available Tools
7 toolsauthentik_adminB
Admin-only Authentik operations: settings, system, version, files, admin authenticator devices.
Call with operation="help" to list all available admin operations. Otherwise pass the operation name and a JSON object with parameters.
Example: authentik_admin(operation="GetSystemInfo")
| Name | Required | Description | Default |
|---|---|---|---|
| params | No | ||
| operation | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must cover behavioral traits. It mentions 'Admin-only' implying restricted access, but does not disclose side effects, permissions, rate limits, or error behavior. The dispatching nature is hinted but not fully explained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise at four sentences, with the purpose front-loaded. The usage pattern and example are helpful. Slightly more structure (e.g., bullet points) could improve readability, but it is efficient for the content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description provides basic operational guidance but lacks details on return values, error handling, and the scope of admin operations beyond the example. The 'help' mechanism partially compensates, but the description could be more comprehensive for a tool with broad functionality.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains that the 'operation' parameter can be 'help' or a specific operation name, and that 'params' is a JSON object with parameters. The example clarifies usage. However, the 'params' object is left open-ended, and no details about valid operations are provided beyond the example.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states this tool is for admin-only Authentik operations, listing categories like settings, system, version, etc. It distinguishes from sibling tools like authentik_read or authentik_write by emphasizing admin-only scope. The example with 'GetSystemInfo' clarifies the intended use.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises calling with operation='help' to list available operations, which aids discovery. However, it does not provide explicit guidance on when to use this tool versus the sibling tools (e.g., for admin-specific tasks vs. general CRUD). No exclusion criteria or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
authentik_deleteA
Delete Authentik resources (destructive, irreversible).
Call with operation="help" to list all available delete operations. Otherwise pass the operation name and a JSON object with parameters.
Example: authentik_delete(operation="DeleteUser", params={"id": 1})
| Name | Required | Description | Default |
|---|---|---|---|
| params | No | ||
| operation | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It explicitly warns that the action is destructive and irreversible, which is crucial. It also explains the help mechanism. It lacks details on authorization requirements or rate limits but covers the key behavioral trait of irreversibility.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise: three sentences plus an example. It is front-loaded with the key behavioral warning ('destructive, irreversible'). Each sentence adds value, and the example clarifies usage. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description is somewhat complete: it explains the destructive nature, the help command, and provides an example. However, it lacks details about return values, error handling, and what specific resources can be deleted beyond the example. It is adequate but could be more thorough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only explains that operation='help' lists operations and gives an example with 'DeleteUser' and 'id', but does not elaborate on available operation values or the structure of params beyond being a JSON object. This is insufficient for an agent to correctly invoke the tool without additional discovery.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool deletes Authentik resources and emphasizes it is destructive and irreversible. It distinguishes itself from sibling tools like authentik_read and authentik_write by specifying delete operations. The purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a how-to-use pattern, including calling operation="help" to list available operations and giving an example. However, it does not explicitly state when to use this tool versus alternatives like authentik_write or authentik_admin, though the deletion context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
authentik_flows_readA
Query Authentik auth pipeline config: flows, stages, policies, sources, events (safe, read-only).
Call with operation="help" to list all available operations. Otherwise pass the operation name and a JSON object with parameters.
Example: authentik_flows_read(operation="ListFlows")
| Name | Required | Description | Default |
|---|---|---|---|
| params | No | ||
| operation | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Declares 'safe, read-only' but provides no further behavior details (e.g., auth requirements, rate limits, error handling). With no annotations, more detail would be beneficial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no fluff, proper front-loading of purpose, and example call.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Provides enough for an agent to start, but the generic operation pattern makes it incomplete without listing available operations. The help instruction compensates partially.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Adds meaning to 'operation' by showing help usage and describing parameter passing, but schema coverage is 0% and no operation list is provided. Relies on user knowing help.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it queries Authentik auth pipeline config, listing specific resources (flows, stages, policies, sources, events). Distinguishes from write siblings and more general authentik_read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies read-only usage but does not explicitly guide when to choose this tool over siblings like authentik_read or authentik_flows_write. No when-not-to-use advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
authentik_flows_writeA
Create or update Authentik auth pipeline config: flows, stages, policies, sources (non-destructive).
Call with operation="help" to list all available operations. Otherwise pass the operation name and a JSON object with parameters.
Example: authentik_flows_write(operation="CreateFlow", params={"name": "my-flow", "slug": "my-flow", "designation": "authorization"})
| Name | Required | Description | Default |
|---|---|---|---|
| params | No | ||
| operation | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It states the tool is non-destructive, which is a positive disclosure, but it lacks details on idempotency, conflict handling, permissions, or side effects. More behavioral context is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with four sentences: a clear summary, a usage tip, a general call pattern, and an example. No extraneous information; every sentence serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (multiple sub-operations via open-ended params) and no output schema, the description provides a starting point but is incomplete. The help mechanism is good, but a comprehensive listing or reference would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage. The description adds value by explaining the help operation and giving an example of how to call with operation and params. However, it does not document the structure of params for each operation, which is an open-ended object.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies the verb (create or update), the resource (Authentik auth pipeline config: flows, stages, policies, sources), and distinguishes it as non-destructive. It also contrasts with sibling tools like authentik_delete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description tells how to list available operations via operation='help' and gives an example but does not explicitly guide when to use this tool versus the generic authentik_write or other siblings. The context is implied but not direct.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
authentik_readA
Query Authentik data (safe, read-only). Policy bindings (app/flow access gates) are in authentik_flows_read.
Call with operation="help" to list all available read operations. Otherwise pass the operation name and a JSON object with parameters.
Example: authentik_read(operation="ListUsers", params={"search": "admin"})
| Name | Required | Description | Default |
|---|---|---|---|
| params | No | ||
| operation | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. States 'safe, read-only' and mentions a help operation, but omits details on authentication, rate limits, or response behavior. Adequate but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise, front-loaded with purpose, and efficient: no wasted words. Four sentences cover purpose, sibling distinction, usage example.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no description of return values. For a read tool, this is a significant gap. The help operation mention is helpful but incomplete for a general-purpose query tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage. Description adds context by explaining the 'help' operation and giving an example with operation and params. However, it doesn't enumerate valid operations or specify params structure beyond being a JSON object.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool queries Authentik data as a safe, read-only operation. It distinguishes from siblings by noting policy bindings are handled by authentik_flows_read, providing clear differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a usage example and directs policy-binding queries to a sibling tool. Lacks explicit when-not-to-use guidance for other tools, but the alternative is clearly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
authentik_versionA
Get the Authentik MCP server version and service status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It accurately describes a read-only operation with no side effects. While minimal, it is not misleading and provides sufficient transparency for a simple version/status check.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that communicates the tool's purpose without any wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (0 parameters, no output schema), the description adequately states what the tool does. It could mention the response format, but the lack of detail is acceptable for a minimal version check tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters and 100% schema coverage, so the description does not need to add parameter semantics. Baseline score of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool gets the server version and service status. It uses a specific verb 'Get' and identifies the resource, distinguishing it from sibling tools that handle flows, admin, read/write/delete operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for obtaining server info but does not explicitly state when or when not to use it, nor does it mention alternatives. Given its unique purpose, the lack of explicit guidance is acceptable but not ideal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
authentik_writeA
Create or update Authentik resources (non-destructive). Application/flow access gating (policy bindings) is in authentik_flows_write.
Call with operation="help" to list all available write operations. Otherwise pass the operation name and a JSON object with parameters.
Example: authentik_write(operation="CreateUser", params={"username": "alice", "name": "Alice"})
| Name | Required | Description | Default |
|---|---|---|---|
| params | No | ||
| operation | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behaviors. It states 'non-destructive' but omits side effects, authentication requirements, rate limits, or error handling. The transparency is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences plus an example, front-loaded with core purpose. Every sentence adds value, though the example could be integrated into a single sentence. No wordiness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and only 2 parameters with 0% coverage, the description does not specify return values, success/failure signals, or a comprehensive list of operations. The help command mitigates this, but completeness is moderate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains the operation parameter and params as a JSON object with an example, but does not list all possible operation names or their parameter schemas beyond 'help'. Meaning is added but insufficient for full autonomous use.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates or updates Authentik resources (non-destructive), and distinguishes it from authentik_flows_write which handles policy bindings. The verb ('create or update') and resource ('Authentik resources') are specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly directs application/flow access gating to authentik_flows_write, and instructs calling with operation='help' to list operations. It provides an example but does not elaborate on when to use this tool vs read/delete tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
7 tool updates
v1.0.0- First observed
authentik_admin - First observed
authentik_delete - First observed
authentik_flows_read - First observed
authentik_flows_write - First observed
authentik_read - First observed
authentik_version - First observed
authentik_write
TDQS
Tools are mostly distinct but there is potential confusion between authentik_write and authentik_flows_write, and between authentik_read and authentik_flows_read, as the domain-specific tools overlap with general ones.
Naming uses a consistent authentik_ prefix and snake_case, but the pattern varies: some tools include a domain (e.g., authentik_flows_write) while others do not (e.g., authentik_write), leading to minor inconsistency.
With 7 tools, the count is well-scoped for an Authentik administration server, covering core operations without being overwhelming or insufficient.
The tool set covers CRUD operations (create/update via write, read via read and flows_read, delete via delete) and admin actions, but lacks a distinct update-only tool; the write tool handles both create and update, which is acceptable but not ideal.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
111MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Official Microsoft MCP Server to query Microsoft Entra data using natural language
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceAn MCP Server that enables natural language interaction with the Open Policy Agent REST API, allowing users to manage policies, decisions, and data through conversational interfaces.1-
- AlicenseNot gradedqualityAmaintenanceMCP server for Authentik identity management, enabling natural language management of users, groups, applications, flows, policies, providers, and more.1957MIT
- AlicenseNot gradedqualityDmaintenanceA Model Context Protocol (MCP) server that provides a natural language interface for managing Keycloak identity and access management through its REST API.MIT
- AlicenseBqualityBmaintenanceMCP server for managing Coolify instances, enabling control of applications, databases, services, servers, and more via natural language.11638MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/nikitatsym/authentik-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server