Okta MCP

What it does

The Okta MCP server is Okta's own Model Context Protocol server for the Okta Admin Management APIs. It lets an AI client such as Claude Desktop or VS Code with GitHub Copilot list, create and change users, groups, applications, policies and branding in an Okta org through natural language. The open-source version lives at okta/okta-mcp-server on GitHub under the Apache-2.0 license, and its README describes it as Generally Available. It is written in Python and uses Okta's Python SDK.

Okta now documents two ways to run it:

• Okta Open Source MCP Server: a self-hosted server you run on your own machine or private network. It uses the STDIO transport and the Device Authorization flow or Private Key JWT for sign-in.
• Okta Managed MCP Server: a cloud-hosted server that Okta runs at https://{yourOktaDomain}/mcp, reached over HTTPS with OIDC and PKCE. Okta lists it as an Early Access release.

This listing covers both, with most detail on the open-source server because its code, tool list and configuration are public. For the managed server, Okta lists supported feature areas rather than tool names: identity management (users, groups and app assignments), policy management, System Log queries, Okta Identity Governance (access certifications, access requests and entitlements), device assurance and brand customization. All of them depend on the scopes assigned to your client ID.

Tools it exposes

The README groups tools by resource. Each group needs a matching Okta API scope, and write tools need the manage version of that scope:

• Users (okta.users.read / okta.users.manage): list_users, get_user, create_user, update_user, deactivate_user, delete_deactivated_user, get_user_profile_attributes, list_user_groups
• Groups (okta.groups.*): list_groups, get_group, create_group, update_group, delete_group, list_group_users, list_group_apps, add_user_to_group, remove_user_from_group
• Applications (okta.apps.*): list_applications, get_application, create_application, update_application, delete_application, activate_application, deactivate_application, plus list_catalog_apps, get_catalog_app and install_oin_app for the Okta Integration Network catalog
• Policies and rules (okta.policies.*): list, get, create, update, delete, activate and deactivate for both policies and policy rules
• Device assurance policies (okta.deviceAssurance.*): list, get, create, replace and delete
• System log (okta.logs.read): get_logs for sign-in attempts and other events
• Brands, themes, custom sign-in and error pages, email templates, custom domains and email domains, each with read and manage tools

Setup

The README offers three install paths: Docker (which it recommends), uv from a clone, and the PyPI package. The PyPI route needs no clone. The README lists Python 3.13 or later and uv (or pipx) as prerequisites; the Okta developer guide still says Python 3.8 or higher, so follow the README if they disagree.

Claude Desktop with PyPI (Device Authorization Grant):

{
  "mcpServers": {
    "okta-mcp-server": {
      "command": "uvx",
      "args": ["okta-mcp-server"],
      "env": {
        "OKTA_ORG_URL": "<OKTA_ORG_URL>",
        "OKTA_CLIENT_ID": "<OKTA_CLIENT_ID>",
        "OKTA_SCOPES": "<OKTA_SCOPES>"
      }
    }
  }
}

For browserless sign-in, add OKTA_PRIVATE_KEY and OKTA_KEY_ID to the same env block. uvx okta-mcp-server always pulls the latest release, so the README suggests pinning a version such as okta-mcp-server@1.1.2 in production.

VS Code: the README gives a PyPI block with inputs prompts for the org URL, client ID and scopes that runs the same uvx command, plus a settings.json variant for a local clone (uv run --directory) that also prompts for the private key and key ID. Okta's guide notes that VS Code needs GitHub Copilot in agent mode, and you start the server from the Copilot tools list.

Docker: clone the repo, copy .env.example to .env, run docker-compose up -d, and point your client at docker run -i --rm ... okta-mcp-server. Docker cannot open a browser on the host, so Device Authorization means copying the sign-in URL from the container logs. The README recommends Private Key JWT for Docker.

The managed server needs no install: you point a client at https://{yourOktaDomain}/mcp after creating an OIDC app integration. Okta's client guide covers VS Code with GitHub Copilot in detail and names Claude Desktop, Gemini and Amazon Bedrock as clients that follow the same pattern. Because the self-hosted option runs on your own machine, it belongs with other local MCP server options.

Authentication and scopes

You first create an app integration in the Okta Admin Console:

• Device Authorization Grant (interactive): an OIDC Native Application with the Device Authorization grant type. You approve access in the browser with a user code.
• Private Key JWT (browserless): an API Services app with public key / private key client authentication and DPoP turned off, plus an admin role assigned to the app.

In both cases you grant Okta API scopes on the app and repeat them in OKTA_SCOPES. At startup the server compares each tool's required scope against OKTA_SCOPES and silently drops any tool you have not granted, so the agent never sees it. A second check runs at call time. Okta notes that Device Authorization is not supported for Private Cloud tenants, which must use Private Key JWT.

Permissions and safety

• Least privilege by scope. Start with read scopes such as okta.users.read. Adding any okta.*.manage scope enables writes for that resource, and a manage scope also unlocks the matching reads.
• Confirmation for destructive actions. Deletes and deactivations use the MCP Elicitation API, so clients that support it show a confirmation dialog. Other clients receive a JSON payload the model must relay to you.
• Rate limits. The README warns that the server consumes your org's Management API rate limits. The managed server adds its own limit of 100 requests per minute per org and returns HTTP 429 when either limit is hit.
• Debug output. OKTA_MCP_INCLUDE_RAW=1 sends stack trace text to the client; the README says to use it only when triaging a failure.

Limits and requirements

• The open-source server uses the STDIO transport and runs on your own computer, container or private cloud network, so you host and maintain it yourself.
• The managed server is Early Access. It needs an "IT Products - Okta Managed MCP Server" subscription plus a Core Identity or Identity Governance entitlement, and it is not available for Okta for Government Moderate, Okta for US Military (DoD IL4) or Okta for Government High.
• The managed server requires clients that support the 2025-11-25 MCP protocol version.

Who it is for

Identity and IT admins, help desk teams and platform engineers who manage an Okta org and want an agent to answer questions like "which users failed to sign in in the last 24 hours" or to automate group and app assignments. Developers can try it against a free Okta Integrator org before connecting it to production. Before you hand an agent write access to your identity provider, read what to check before installing an MCP server.

Pricing

As of October 2026, the open-source server is free under Apache-2.0, and you need an Okta org with admin permissions. Okta's guide uses the Okta Integrator Free Plan for setup. The Managed MCP Server needs a separate Okta subscription, and Okta does not publish a price for it on the pages we checked.

Alternatives

There is no other identity provider server in our directory yet. If your admin work is mostly in a cloud platform rather than Okta, see:

• Azure MCP server for Microsoft Azure resources.
• AWS MCP server for AWS docs and IAM-controlled API calls.
• Cloudflare MCP server for Cloudflare accounts and Workers.

What we could not verify

• The official MCP Registry did not respond on 2026-10-23, so we could not confirm whether Okta has a registry entry.
• Okta does not publish a price for the Managed MCP Server, and its release notes give no Early Access date.
• Okta lists the Managed MCP Server's feature areas but not its individual tool names, so we could not compare the two tool sets one to one.

Sources

• Okta MCP server overview: https://developer.okta.com/docs/guides/okta-open-source-mcp-server/main/
• Okta Open Source MCP Server install guide: https://developer.okta.com/docs/guides/mcp-server/main
• Configure and start the server: https://developer.okta.com/docs/guides/start-mcp-server/main/
• GitHub repository and README: https://github.com/okta/okta-mcp-server
• PyPI package: https://pypi.org/project/okta-mcp-server/
• Okta Managed MCP Server overview: https://help.okta.com/mcp/en-us/content/topics/mcpserver/mcpserver.htm
• Okta Managed MCP Server supported features: https://help.okta.com/mcp/en-us/content/topics/mcpserver/mcpserver-supported-features.htm
• MCP client configuration overview: https://help.okta.com/mcp/en-us/content/topics/mcpserver/mcp-client-configuration-overview.htm
• Managed MCP Server release notes: https://help.okta.com/mcp/en-us/content/topics/releasenotes/mcpserver/mcpserver-releasenotes.htm