Okta Workspace MCP
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Okta Workspace MCPstart Okta MCP"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Okta Workspace MCP
A Model Context Protocol (MCP) server for Okta identity management. Provides AI assistants with secure, authenticated access to your Okta organization through Browser Session or OIDC/OAuth authentication.
Features
Browser Session mode -- authenticate through your browser with full SSO and MFA support, then interact with Okta through the MCP
OIDC/OAuth mode -- standard Authorization Code + PKCE flow for programmatic access
Identity context --
whoami,userinfo, group membership, and app assignmentsOrganization tools -- read-only access to users, groups, and applications (requires appropriate scopes)
Guided setup -- interactive first-run configuration via MCP form elicitation
Related MCP server: Okta MCP Server
Quick Start
Install
git clone https://github.com/oreneHack/okta_mcp.git
cd okta_mcp
npm installRegister in your MCP client
Claude Code / VS Code:
Add to your MCP settings:
{
"okta-workspace": {
"type": "stdio",
"command": "node",
"args": ["path/to/okta_mcp/scripts/okta-mcp.mjs"]
}
}Or install globally:
npm install -g okta-workspace-mcpThen register okta-workspace-mcp as a stdio MCP server in your client.
Authenticate
Ask your AI assistant:
"Connect to Okta" or "Start Okta MCP"
The guided setup collects your Okta org URL and authentication preference (Browser Session or OIDC/OAuth). Subsequent launches reuse saved settings.
Authentication Modes
Browser Session
Opens an isolated browser window for authentication. Supports all Okta sign-on policies including MFA, FastPass, and device trust. Session metadata is stored locally with redacted cookie values.
Available tools after authentication:
Tool | Description |
| Session state and activity |
| Current page content (sanitized) |
| Navigate within your Okta org |
| Read Okta API endpoints (GET only) |
OIDC/OAuth
Standard Authorization Code + PKCE flow. Requires a Native OIDC application registered in your Okta org with a loopback redirect URI.
Recommended scopes:
Scope | Purpose |
| Identity (minimum) |
| Token refresh |
| User directory access |
| Group directory access |
| Application inventory |
Configuration
Configuration is stored under ~/.okta-workspace-mcp/:
File | Purpose |
| Selected mode and Okta org |
| Public OIDC client settings |
| Local OAuth token cache |
Environment Variables
All settings can be provided via okta-start form elicitation. Environment
variables are optional overrides for managed or headless deployments.
Variable | Description | Default |
| Okta org URL ( | Set via |
| OIDC application client ID | Set via |
| Authorization server ID |
|
| Space-delimited OAuth scopes |
|
See .env.example for the full list.
Available Tools
Tool | Description |
| Configure and authenticate |
| Connection and authentication status |
| Clear saved configuration |
| Current user identity |
| Detailed user profile |
| OAuth token metadata |
| Group memberships |
| Assigned applications |
| Organization user directory |
| Single user lookup |
| User search |
| Organization groups |
| Organization applications |
Security
See SECURITY.md for data handling policies and recommended hardening steps.
Cookie values are redacted in all MCP tool responses
OAuth tokens are cached locally and never exposed in tool output
Browser Session uses an isolated temporary profile
Metadata service binds to
127.0.0.1only
Requirements
Node.js 20+
Chrome or Microsoft Edge (Browser Session mode)
Okta organization (any edition, including free developer orgs)
License
Available Tools
23 toolsget-userA
Get one user visible to the connected Okta administrator (requires okta.users.read)
| Name | Required | Description | Default |
|---|---|---|---|
| userId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavioral context about permission requirements and visibility, but lacks details on return format, error behavior, or side effects. Since no annotations are provided, the description carries the full burden and could be more thorough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently conveys the core purpose and two key constraints (visibility, permission). No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description omits what the tool returns and potential error conditions. For a simple read tool, this is acceptable but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter userId is defined in the schema with type string and length constraints, but the description adds no explanation of what the userId represents (e.g., format, source). With 0% schema description coverage, the description should compensate but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool gets one user, specifies the required permission (okta.users.read), and the visibility condition (visible to the connected Okta administrator). Among sibling tools like list-users and search-users, this distinguishes itself by targeting a single user retrieval.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context on when to use (requires specific permission, visible user) but does not explicitly mention when not to use or name alternative tools. However, the permission and visibility conditions give practical guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list-appsB
List applications visible to the connected Okta administrator (requires okta.apps.read)
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. Description mentions the required permission but does not disclose behavior like pagination, ordering, or whether it returns all apps. Minimal transparency beyond the read-only nature implied by 'list'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence front-loads the purpose and permission. Every word is informative; no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool with one parameter and no output schema. Description provides basic purpose and permission but lacks explanation of 'limit' and expected response. Adequate but could improve with parameter detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain the 'limit' parameter. Without any guidance on its function (e.g., pagination limit), the agent cannot infer its semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'List' and resource 'applications' with a scope 'visible to the connected Okta administrator', distinguishing it from sibling 'my-apps'. The required permission is also provided.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'my-apps' or 'search-users'. The description only states a permission requirement, not context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list-groupsC
List groups visible to the connected Okta administrator (requires okta.groups.read)
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states the basic operation and permission, but does not disclose any behavioral traits such as pagination, rate limits, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded and contains no redundant information. Every word serves a purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, and the description does not explain what the tool returns (e.g., list of group names, full objects). The presence of a 'limit' parameter hints at pagination but is not clarified. The description is insufficient for an agent to understand the full behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not mention the 'limit' parameter or explain its meaning. The parameter's semantics are entirely left for the agent to infer from the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (list) and resource (groups) with scope ('visible to the connected Okta administrator'). It also mentions required permission. However, it does not differentiate from sibling tool 'my-groups' which might also list groups.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions a prerequisite permission ('requires okta.groups.read') but gives no guidance on when to use this tool vs alternatives, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list-usersB
List users visible to the connected Okta administrator (requires okta.users.read)
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions the required permission but does not disclose pagination behavior, ordering, error handling, or whether the operation is safe (read-only). The behavior is partially implied but insufficiently detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, concise and to the point. However, it could include a brief note about the 'limit' parameter without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one optional parameter and no output schema or annotations, the description should provide more context (e.g., return format, pagination). It only covers purpose and permission, leaving many usage aspects unclear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter ('limit') with 0% schema description coverage. The description does not mention this parameter or explain its purpose (e.g., pagination limit). The schema provides constraints but the description adds no value beyond that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the action ('list users'), the scope ('visible to the connected Okta administrator'), and a prerequisite ('requires okta.users.read'). It clearly distinguishes from sibling tools like 'get-user' (single user) and 'search-users' (searching with filters).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool lists all visible users, but does not explicitly state when to use it versus alternatives like 'search-users' for filtering. No 'when-not-to-use' guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
my-appsA
List application links assigned to the connected user (requires okta.users.read)
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description is minimal. It indicates a read operation, but does not disclose potential side effects, errors, or response details beyond listing apps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no filler, includes key permission context. Highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool, description is adequate but lacks details on output format or pagination. With no output schema, additional context on return structure would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has zero parameters, so description does not need to add parameter details. Baseline score of 4 applies as no compensation needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it lists application links for the connected user, with a specific verb and resource. However, it does not explicitly differentiate from the sibling 'list-apps', though the scope hint helps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a permission requirement ('requires okta.users.read') but lacks explicit guidance on when to use versus alternatives like 'list-apps' or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
my-groupsB
Show group names from the verified ID-token groups claim when configured
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description mentions 'when configured', hinting at conditional behavior, but does not specify what happens if not configured (empty result, error) or any authentication requirements. With no annotations, the description provides minimal behavioral insight.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with 12 words, no redundancy, front-loaded with the key action. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless tool, the description is adequate but lacks output format details and error handling. Given no output schema, more context about the return value (e.g., list of strings, empty array) would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so the schema covers all. The description adds context about the data source ('verified ID-token groups claim'), which is relevant but not parameter-related. Baseline of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it shows group names from the verified ID-token groups claim, indicating a specific data source. However, it does not distinguish itself from sibling tool 'list-groups', which might imply broader group listing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'list-groups' or 'whoami'. There is no context on prerequisites or scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-browser-closeA
Close the live isolated Okta browser and delete its temporary profile
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description discloses destructive behavior (deletes profile) but lacks details on effects on other sessions or confirmation steps. No annotations to supplement.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no unnecessary words, front-loaded with action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Reasonably complete for a no-param tool; could mention prerequisite (browser must be started via okta-start) but not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist; schema coverage is 100%. Description adds no param info but none needed. Baseline for 0 params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool closes the isolated browser and deletes its temporary profile. Distinct from siblings like okta-browser-snapshot or okta-browser-navigate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implied usage (when you want to end the browser session), but no explicit when-to-use vs alternatives or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-browser-harvest-tokensA
Silently harvest OAuth tokens from all assigned public OIDC apps using prompt=none and PKCE, and store them in the collector at /v1/tokens
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It reveals that the operation is silent and uses prompt=none, and that tokens are stored in a collector. However, it does not disclose whether it overwrites existing tokens, if any user interaction is required for consent, or potential side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 22 words, front-loading the key action. Every word earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the action and result (storing in collector) but lacks explicit mention of return value or preconditions (e.g., browser session must be active). With no output schema, the return format is unclear. Adequate but with gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the baseline is 4. There are no parameters to describe, and the description does not add any parameter information, which is acceptable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('harvest') and resource ('OAuth tokens from all assigned public OIDC apps'), and details the method (prompt=none and PKCE). It clearly distinguishes from siblings like okta-oauth-login, which suggests interactive login.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when or when not to use this tool, nor does it name alternatives. The context from sibling tools implies it is for non-interactive harvesting, but no direct guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-browser-readA
Perform a read-only GET from the authenticated browser to a same-origin /api/v1/ path; sensitive token, cookie, password, secret, and credential fields are redacted
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Same-origin Okta API path beginning with /api/v1/ |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must cover behavioral traits. It correctly notes it is read-only, uses an authenticated browser, and redacts sensitive fields. Lacks mention of potential rate limits or session requirements, but covers the critical traits for a read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence efficiently conveys purpose, method, path restriction, and data redaction. No extraneous text, front-loaded with critical information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and one parameter, the description is adequate but could specify the return format (likely API JSON) and note that it requires an active browser session. The sibling list is large, but this tool's narrow scope is clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes the 'path' parameter fully. The description adds value by clarifying the HTTP method (GET) and authentication context, beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool performs a read-only GET from an authenticated browser to a same-origin /api/v1/ path. The verb and resource are specific, and it distinguishes itself from sibling tools that perform writes or other operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for reading Okta API data via browser session, but does not explicitly state when to use this tool over alternatives like 'get-user' or 'list-users', nor does it mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-browser-refresh-proofB
Immediately publish a fresh authenticated browser proof to the loopback collector with every cookie value redacted
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries full burden. It discloses the publication action and cookie redaction, but does not mention potential side effects, authentication requirements, or what happens to existing state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no extraneous information. Every word contributes to understanding the tool's function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters or output schema, the description is reasonably complete but leaves gaps: e.g., what is the loopback collector, what is the return value, and are there any prerequisites? The description could be more detailed about the context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and schema description coverage is 100%. Baseline for 0 parameters is 4, and no additional parameter clarification is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Immediately publish a fresh authenticated browser proof to the loopback collector with every cookie value redacted'. It specifies the resource and verb, but does not explicitly differentiate from sibling tools like 'okta-browser-session-proof'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives or when not to use it. The description lacks context for optimal usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-browser-session-proofB
Open or reuse a live isolated browser, authenticate to the configured tenant, and publish redacted cookie proofs at authentication and every five minutes while the session remains active
| Name | Required | Description | Default |
|---|---|---|---|
| authorized | Yes | Must be true to acknowledge an authorized disposable lab | |
| timeoutSeconds | No | ||
| tenantConfirmation | Yes | Exact configured tenant URL or hostname |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It discloses that the tool opens/reuses a browser, authenticates, and publishes proofs every 5 minutes. However, it does not explain what 'redacted cookie proofs' are, whether the tool blocks or runs asynchronously, or side effects on existing sessions. Partially transparent but missing key behavioral details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of about 30 words, front-loaded with action and outcome. It conveys essential information without redundancy. Could be slightly restructured for readability, but overall concise and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool managing a live session with periodic proof publication, the description lacks details on output (what does 'publish proofs' mean? Where do they go?), return values, and asynchronous behavior. Also no mention of side effects. Given no output schema and moderate complexity, the description is incomplete but minimally adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% (authorized and tenantConfirmation documented, timeoutSeconds not). The tool description adds context: 'authenticate to the configured tenant' maps to tenantConfirmation, and 'authorized disposable lab' maps to authorized. But timeoutSeconds is not explained, and the description does not clarify that it controls session max duration. Baseline score due to partial compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool opens or reuses an isolated browser, authenticates, and periodically publishes cookie proofs. It distinguishes from siblings like okta-browser-snapshot and okta-browser-harvest-tokens, though not explicitly from okta-browser-refresh-proof. The verb 'open or reuse' is specific, making the purpose clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description implies it's for establishing a session with ongoing proof publication, but does not state when not to use it (e.g., for one-time snapshots) or prerequisites. Lacks 'when-to-use' or 'when-not-to-use' context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-browser-snapshotA
Read a sanitized snapshot of the authenticated Okta page: title, headings, visible text, and controls without input values, cookies, tokens, or arbitrary JavaScript
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses that the snapshot is sanitized, omitting sensitive data. However, it does not mention potential side effects, authentication requirements, or whether the page is refreshed. Overall, good transparency for a read-only tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and then lists specifics. Every word adds value, with no wasted verbiage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description explains what the snapshot contains (title, headings, text, controls) but does not specify the format (e.g., structured text, HTML). It adequately covers the return content for a snapshot tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the description does not need to explain them. The schema coverage is 100%, and the baseline for no parameters is 4. The description adds no param info, but that is acceptable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads a sanitized snapshot of the authenticated Okta page, listing what is included (title, headings, visible text, controls) and excluded (input values, cookies, tokens, arbitrary JS). This distinguishes it from sibling tools like 'okta-browser-read' by emphasizing sanitization.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is provided. The description does not compare this tool to alternatives like 'okta-browser-read' or 'okta-browser-harvest-tokens', leaving the agent to infer its purpose without context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-browser-statusA
Show the live isolated browser state, current same-origin page, authenticated identity, and proof schedule without exposing cookies
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses a key behavioral trait: 'without exposing cookies', which is a security consideration. However, it does not mention whether the tool requires authentication, whether it is idempotent, or any potential side effects, though for a read-only status tool these are less critical.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently conveys the tool's purpose and key characteristics. It is front-loaded with the verb 'Show' and lists multiple aspects without redundancy or wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has zero parameters and no output schema, the description provides sufficient context for a status-check tool. It could be enhanced by hinting at the output format (e.g., JSON) or typical use cases, but it is adequate for the low complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters (100% coverage, zero params). The description does not need to explain parameters, and the baseline score of 4 applies since there is nothing to add.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Shows' specific resources: isolated browser state, current same-origin page, authenticated identity, and proof schedule. It also distinguishes itself from siblings by noting it does not expose cookies, and it contrasts with manipulation tools like okta-browser-navigate or okta-browser-harvest-tokens.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for checking browser state but provides no explicit guidance on when to use this tool versus alternatives such as okta-browser-snapshot or okta-status. No when-not-to-use or conditionals are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-oauth-loginC
AUTHORIZED LAB: authenticate through the configured Okta OIDC client with Authorization Code and PKCE
| Name | Required | Description | Default |
|---|---|---|---|
| authorized | Yes | ||
| tenantConfirmation | Yes | Exact configured tenant URL or hostname |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavioral traits. It mentions the authentication flow (OIDC, PKCE) but fails to describe side effects (e.g., session creation, token storage), required user interaction, or the meaning of the 'authorized' parameter. The agent lacks awareness of what invoking this tool will do beyond the stated authentication mechanism.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise. However, the prefix 'AUTHORIZED LAB:' is somewhat extraneous and not directly helpful for understanding the tool's function. The core information is front-loaded and clear, so it earns a high score despite the minor redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of an OAuth login flow, the description is incomplete. It does not explain the overall process, how the parameters are used in the authentication interaction, or what happens after successful authentication (e.g., tokens, redirections). The lack of an output schema is not compensated by the description. The agent would need significant additional context to use this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 50% description coverage (tenantConfirmation has a description, authorized does not). The tool description adds no explanation of the parameters: it does not clarify what 'authorized' means, how it affects behavior, or the expected format of 'tenantConfirmation'. The description fails to add value beyond the schema's minimal information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: 'authenticate through the configured Okta OIDC client with Authorization Code and PKCE'. It specifies the verb (authenticate), the resource (Okta OIDC client), and the method (Authorization Code with PKCE). This makes the purpose distinct from sibling tools like okta-start, okta-reset, and okta-status, which are likely for different phases or operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There is no mention of prerequisites, typical workflows, or situations where this tool should or should not be used. Among the many sibling tools, no comparison or context is given, leaving the agent without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-oauth-reuse-proofB
AUTHORIZED LAB: demonstrate bearer-token reuse with two read-only UserInfo calls and publish only a SHA-256 token fingerprint
| Name | Required | Description | Default |
|---|---|---|---|
| authorized | Yes | ||
| tenantConfirmation | Yes | Exact configured tenant URL or hostname |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It discloses that the tool makes two read-only UserInfo calls and publishes a token fingerprint, clarifying non-destructive behavior. However, lacks details on error conditions, side effects, or what 'publish' means.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is highly concise and front-loaded. Every word contributes meaning, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (demonstrating token reuse with two parameters and no output schema), the description provides a basic understanding but lacks details on return format, error handling, and prerequisites. Adequate for a lab tool but not fully comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only 50% of parameters have schema descriptions (tenantConfirmation). The description adds no additional meaning beyond the schema for either parameter. It does not explain how 'authorized' or 'tenantConfirmation' relate to the token reuse demonstration.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool demonstrates bearer-token reuse with two read-only UserInfo calls and publishes a SHA-256 token fingerprint. It uses specific verbs and resources, differentiating from sibling tools like okta-oauth-login or userinfo.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. The 'AUTHORIZED LAB' prefix implies lab use but no explicit when-to-use or when-not-to-use conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-resetA
Reset this MCP to its fresh-install state for an authorized demonstration: close the live browser, cancel pending OAuth, clear saved mode/tenant and local OAuth cache, and make the next okta-start show the authentication configuration form
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | Yes | Must be true to confirm removal of the saved Okta MCP authentication setup |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden and effectively discloses destructive actions (close, cancel, clear) and the effect on okta-start. It could mention that saved authentication is removed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single long sentence that front-loads the purpose, but could be split for readability. It contains no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required param, no output schema), the description adequately covers purpose, actions, and usage context. Missing return value details are acceptable without output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single confirm parameter; the description does not add parameter-specific guidance beyond implying its necessity for destructive confirmation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool resets the MCP to fresh-install state for demonstrations, listing specific actions (close browser, cancel OAuth, clear cache) and distinguishing it from sibling tools like okta-start.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies usage 'for an authorized demonstration', providing clear context. However, it does not explicitly advise against using in normal operations or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-startB
Canonical startup flow: configure Browser Session or OIDC/OAuth on first use, reuse saved setup on later calls, and begin authentication. Set reconfigure=true only when the user explicitly wants to change setup
| Name | Required | Description | Default |
|---|---|---|---|
| orgUrl | No | ||
| scopes | No | ||
| clientId | No | ||
| authServer | No | ||
| authorized | No | ||
| reconfigure | No | ||
| callbackHost | No | ||
| callbackPort | No | ||
| timeoutSeconds | No | ||
| authenticationMode | No | ||
| tenantConfirmation | No | ||
| beginAuthentication | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, description carries full burden. It states configuration and authentication start but does not disclose side effects like session creation, state mutation, or behavior on repeated calls beyond reuse. Lacks detail on destructive actions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with key concepts front-loaded. No extraneous content. Every part is informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 12 parameters and no output schema, the description is incomplete. It explains the overall flow but does not clarify the role of most parameters, order of operations, or return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only the reconfigure parameter is described explicitly. The other 11 parameters (e.g., orgUrl, scopes) have no schema descriptions and the description adds no extra meaning. Schema coverage is 0%, so description fails to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it is the 'canonical startup flow' for configuring and beginning authentication, distinguishing between first use (configure) and later calls (reuse). However, it does not explicitly differentiate from sibling tools like okta-oauth-login or okta-browser-session-proof.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear guidance on when to set reconfigure=true ('only when the user explicitly wants to change setup'). Implies usage for initial setup and subsequent reuse, but does not specify when not to use it or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
okta-statusA
Show the selected authentication mode, configured tenant, connection state, and latest redacted proofs
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the full burden. It describes outputs (authentication mode, tenant, etc.) but does not mention permissions, rate limits, or side effects. The term 'latest redacted proofs' is ambiguous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that succinctly lists the tool's outputs. Every word contributes to understanding, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema is provided, so the description should clarify the return format. It lists four items but does not specify if the output is structured or textual. For a simple status tool, this is moderately complete but could be better.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters, the baseline is 4. The description adds value by enumerating what information is displayed, which goes beyond the empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it shows the authentication mode, tenant, connection state, and latest redacted proofs. The verb 'Show' and specific resources make the purpose obvious, distinguishing it from sibling tools like okta-start or okta-browser-navigate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. While it is implied for checking status before other Okta actions, there is no 'when not to use' or comparison to similar tools like whoami or userinfo.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search-usersA
Search users visible to the connected Okta administrator (requires okta.users.read)
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry behavioral transparency. It discloses the scope (users visible to the admin) and required permission, which is adequate for a simple search tool. However, it does not detail other behaviors like search type (partial/exact) or response structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, 12 words, no wasted words. However, it could be restructured to include parameter guidance without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with one parameter and no output schema, the description covers the essential purpose and scope. Lacks details on search semantics (e.g., exact vs fuzzy) and pagination, leaving some gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not add any meaning to the 'query' parameter beyond the schema's type/constraints. It should provide details on format, allowed fields, or search behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches users, specifies the scope ('visible to the connected Okta administrator'), and includes the required permission. This distinguishes it from siblings like list-users (likely lists all) and get-user (single user).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions the required permission, which is a usage condition, but does not explicitly state when to use this tool over alternatives (e.g., list-users) or provide exclusions. Usage is implied but not fully guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
token-detailsA
Show safe token metadata without returning bearer values
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite no annotations, the description clearly discloses a key behavioral trait: it does not return bearer values. It also implies a safe, read-only operation. However, it does not mention auth requirements or other side effects, which are likely minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no unnecessary words, front-loaded with verb and resource. Highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the tool has no parameters and is simple, the description lacks details on what specific metadata fields are returned (e.g., issuer, type, expiration). Without an output schema, the agent may not know the structure of the response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters and 100% schema coverage trivially, baseline is 4. No parameter info is needed beyond what the schema provides, and the description adds no confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'Show', resource 'token metadata', and qualifier 'safe without returning bearer values'. This effectively distinguishes it from sibling tools like okta-browser-harvest-tokens which likely return bearer values.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description implies use when needing token metadata without exposing bearer values, but does not explicitly state when not to use or provide alternatives. No guidance against using other informational tools like whoami or userinfo.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
userinfoA
Fetch the connected OIDC user's profile from Okta UserInfo
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only says 'Fetch', implying read-only. Misses disclosure about authentication requirements, error conditions, or data volume. For a tool with no annotations, this is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words, efficiently conveys the essential purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool with no parameters or output schema; description covers the basic purpose but omits what the profile contains or any limitations (e.g., requires authenticated session). Slightly incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; schema coverage 100%. Description adds context (Okta UserInfo) beyond schema, meeting the baseline expectation for 0-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'Fetch', resource 'connected OIDC user's profile', and source 'Okta UserInfo'. Distinguishes from sibling tools like 'whoami' by specifying OIDC scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implied usage (fetch profile), but no explicit guidance on when to use vs alternatives like 'whoami', 'my-groups', or 'my-apps'. Lacks when-not or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
whoamiA
Show the connected OIDC user's verified Okta identity and granted scopes
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It correctly implies a read-only operation without side effects. However, it does not explicitly state that no mutation occurs, nor does it mention authentication requirements or rate limits. The simplicity of the tool (no params) mitigates the need for extensive disclosure, earning a 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that immediately conveys the tool's purpose. No extraneous information. Perfectly concise and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description adequately specifies what the tool does but lacks detail on the output format. Since there is no output schema, the description should hint at the structure of returned data (e.g., 'returns a JSON object with fields...'). The phrase 'verified Okta identity and granted scopes' is somewhat vague, leaving the agent to guess the exact fields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is 100% (empty object). The baseline for no parameters is 4. The description does not add parameter-level detail, which is unnecessary here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool shows the connected OIDC user's verified Okta identity and granted scopes. The verb 'show' and specific resource 'verified Okta identity and granted scopes' distinguish it from siblings like 'userinfo' or 'token-details', which might show different aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, when not to use it, or which sibling tools cover similar ground (e.g., userinfo, token-details).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
23 tool updates
v1.4.0- First observed
get-user - First observed
list-apps - First observed
list-groups - First observed
list-users - First observed
my-apps - First observed
my-groups - First observed
okta-browser-close - First observed
okta-browser-harvest-tokens - First observed
okta-browser-navigate - First observed
okta-browser-read - First observed
okta-browser-refresh-proof - First observed
okta-browser-session-proof - First observed
okta-browser-snapshot - First observed
okta-browser-status - First observed
okta-oauth-login - First observed
okta-oauth-reuse-proof - First observed
okta-reset - First observed
okta-start - First observed
okta-status - First observed
search-users - First observed
token-details - First observed
userinfo - First observed
whoami
TDQS
Most tools have distinct purposes, but a few pairs may cause confusion, such as okta-status vs okta-browser-status (both show state) and whoami vs userinfo (both provide user identity). Descriptions help clarify, but some overlap remains.
The naming follows a mostly consistent pattern with 'okta-' prefix and category (browser, oauth) followed by a verb. However, standalone tools like whoami, userinfo, and token-details break the pattern, and admin tools use list/get/search without the prefix.
With 23 tools, the surface is comprehensive but slightly heavy. It covers authentication setup, browser session management, OIDC flows, and read-only admin queries, but could potentially be split into smaller focused servers.
The server provides decent coverage for authentication and read-only admin operations, but notably missing write operations for users, groups, and apps (create, update, delete), which may leave agents unable to complete full lifecycle management tasks.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
- StytchOAuthdev.stytch.mcp
The Stytch MCP server is a reference implementation that demonstrates remote MCP server authentication and authorization using Stytch Connected Apps. It provides OAuth 2.1-compliant authorization (including PKCE), Dynamic Client Registration, and validates Stytch-issued access tokens to enable AI agents to securely interact with external services through permissioned access, supporting scopes like openid, email, profile, and manage:project_data.
An MCP server that provides read access to your cloud storage providers, bank accounts and more.
An MCP server for deep research or task groups
Security research canary remote MCP server for owned-account testing.
Related MCP Servers
- AlicenseAqualityCmaintenanceA secure MCP server providing read-only access to Argo CD instances using browser session cookies, enabling querying of applications, projects, clusters, and repositories.14MIT
- FlicenseNot gradedqualityDmaintenanceAn MCP server for managing Okta users (CRUD operations) with full OAuth 2.1 compliance, enabling secure integration with Claude Desktop and other MCP clients.-
- FlicenseNot gradedqualityDmaintenanceA production-ready MCP server for Identity and Access Management with Okta integration, providing user and group management, audit logging, and permission guardrails.-
- AlicenseAqualityCmaintenanceMCP server for Okta authentication, enabling AI agents to log in, check sessions, list, delete, and get cookies using saved Okta sessions.54MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/oreneHack/okta_mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server