analyze_user_app_accessLABSCO SUMMARY
The two analysis tools collapse a multi-screen investigation into one question.
analyze_user_app_access is the standout: 'can this user reach that app?' normally means walking status, group memberships, app assignments, policies and MFA factors by hand, and here it comes back as one reasoned answer. The standard list/get tools are read-only lookups. It is beta, and the maintainer now points to a rebuilt successor, so treat this as the current-but-early version.
What it is
A server that lets an AI model read and analyze Okta resources through MCP, with standard lookup tools plus two admin accelerators for access and login-risk analysis.
What you get
- analyze_user_app_access evaluates whether a user can reach an app, walking status, group assignment, policy and MFA in one answer
- analyze_login_risk assesses login behaviour with VPN/Tor detection and geographic-impossibility checks
- Users — list_okta_users, get_okta_user, list_okta_user_groups, list_okta_user_applications and list_okta_user_factors
- Groups — list_okta_groups, get_okta_group, list_okta_group_members and list_okta_assigned_applications_for_group
- Applications — list_okta_applications, list_okta_application_users and list_okta_application_group_assignments
- Policies and network — list_okta_policy_rules, get_okta_policy_rule and list_okta_network_zones
- get_okta_event_logs for system log events, plus get_current_time and parse_relative_time
Requirements
Python 3.8+ and an Okta tenant with API access. Set OKTA_CLIENT_ORGURL to your org URL and OKTA_API_TOKEN to an API token. Clone, create a venv, install requirements, then the client launches main.py. STDIO is the recommended transport; HTTP transport exists but is gated behind an explicit risk-acknowledgment flag. This is v0.1.1-BETA.
Setup effort
Build from source — git clone https://github.com/fctr-id/okta-mcp-server.git
USE CASES
01
Answering why a user can or cannot reach an app
Run the access analysis and get status, group assignment, policy and MFA reasoned through in one response.
02
Judging whether a login looks compromised
Analyze the login behaviour with VPN/Tor detection and geographic-impossibility checks.
03
Auditing what a user has access to
List the user's groups and application assignments and the factors they have enrolled.
04
Investigating events in the system log
Pull Okta system log events with time-based filtering.
05
Reviewing a policy's rules
List the rules for a policy and read one in detail with its conditions and actions.
20 tools
Listed in project docs. Your client may show a different list.
analyze_login_risklist_okta_usersget_okta_userlist_okta_user_groupslist_okta_user_applicationslist_okta_user_factorslist_okta_groupsget_okta_grouplist_okta_group_memberslist_okta_assigned_applications_for_grouplist_okta_applicationslist_okta_application_userslist_okta_application_group_assignmentslist_okta_policy_rulesget_okta_policy_rulelist_okta_network_zonesget_okta_event_logsget_current_timeparse_relative_timeBEFORE YOU INSTALL
What to know first
Tools you get
20 tools named in the project's documentation.
Requires
- Python 3.8+
- An Okta tenant with API access
- OKTA_CLIENT_ORGURL in your environment
- OKTA_API_TOKEN in your environment
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
This one is built from source rather than installed with a single command.
Server setup
TERMINAL
git clone https://github.com/fctr-id/okta-mcp-server.git
cd okta-mcp-server
python -m venv venv
source venv/bin/activate # On Windows use: venv\Scripts\activate
pip install -r requirements.txtMCP Clients
Claude Desktop — stdio
CLAUDE DESKTOP — STDIO · JSON
{
"mcpServers": {
"okta-mcp-server": {
"command": "<YOUR_DIR>/okta-mcp-server/venv/Scripts/python",
"args": [
"<YOUR_DIR>/okta-mcp-server/main.py"
],
"env": {
"OKTA_CLIENT_ORGURL": "https://dev-1606.okta.com",
"OKTA_API_TOKEN": "<YOUR_OKTA_API_TOKEN>"
}
}
}
}<YOUR_DIR> is the full path of the folder you ran git clone in, the one that holds the okta-mcp-server folder (on macOS/Linux the venv's Python is venv/bin/python rather than venv/Scripts/python). https://dev-1606.okta.com in OKTA_CLIENT_ORGURL is a sample; yours is your Okta org URL. OKTA_API_TOKEN is your API token.
