analyze_user_app_access is the standout: 'can this user reach that app?' normally means walking status, group memberships, app assignments, policies and MFA factors by hand, and here it comes back as one reasoned answer. The standard list/get tools are read-only lookups. It is beta, and the maintainer now points to a rebuilt successor, so treat this as the current-but-early version.
A server that lets an AI model read and analyze Okta resources through MCP, with standard lookup tools plus two admin accelerators for access and login-risk analysis.
- analyze_user_app_access evaluates whether a user can reach an app, walking status, group assignment, policy and MFA in one answer
- analyze_login_risk assesses login behaviour with VPN/Tor detection and geographic-impossibility checks
- Users — list_okta_users, get_okta_user, list_okta_user_groups, list_okta_user_applications and list_okta_user_factors
- Groups — list_okta_groups, get_okta_group, list_okta_group_members and list_okta_assigned_applications_for_group
- Applications — list_okta_applications, list_okta_application_users and list_okta_application_group_assignments
- Policies and network — list_okta_policy_rules, get_okta_policy_rule and list_okta_network_zones
- get_okta_event_logs for system log events, plus get_current_time and parse_relative_time
Python 3.8+ and an Okta tenant with API access. Set OKTA_CLIENT_ORGURL to your org URL and OKTA_API_TOKEN to an API token. Clone, create a venv, install requirements, then the client launches main.py. STDIO is the recommended transport; HTTP transport exists but is gated behind an explicit risk-acknowledgment flag. This is v0.1.1-BETA.
One command plus a key — DIR/okta-mcp-server/venv/Scripts/python DIR/okta-mcp-server/main.py, then supply credentials