Okta Server

A TypeScript Model Context Protocol server that exposes Okta incident-support and administrative workflows to MCP-compatible IDE clients over stdio.

Capabilities

• Read org metadata.
• Investigate user incidents with one summary tool.
• List and inspect users, groups, app assignments, MFA factors, sessions, policies, IdPs, network zones, and System Log events.
• Query focused user System Log events by actor, event type, and outcome.
• Optionally expose write/remediation tools for lifecycle, group membership, session clearing, password expiry, and MFA reset.

Requirements

• Node.js 20 or newer.
• An Okta org URL such as https://example.okta.com.
• An Okta API token with the least privileges needed for the tools you plan to use.

Setup

npm install
cp .env.example .env
npm run build

Set these environment variables before launching the server:

export OKTA_ORG_URL="https://your-org.okta.com"
export OKTA_API_TOKEN="your-okta-api-token"
export OKTA_REQUEST_TIMEOUT_MS="30000"
export OKTA_ENABLE_WRITE_TOOLS="false"

OKTA_ENABLE_WRITE_TOOLS defaults to false. Keep it false for read-only support triage. Set it to true only for trusted remediation sessions where your MCP host has explicit tool-call approval.

Run

For local development:

npm run dev

For the local React support console:

npm run build
export OKTA_ORG_URL="https://your-org.okta.com"
export OKTA_API_TOKEN="your-okta-api-token"
export OKTA_ENABLE_WRITE_TOOLS="false"
npm run ui

Open http://127.0.0.1:5173. The React app talks to a local HTTP bridge on port 4174, and the bridge talks to this MCP server over stdio.

For an MCP client, use the built entrypoint:

{
  "mcpServers": {
    "okta": {
      "command": "node",
      "args": ["/absolute/path/to/Okta MCP Server/dist/index.js"],
      "env": {
        "OKTA_ORG_URL": "https://your-org.okta.com",
        "OKTA_API_TOKEN": "your-okta-api-token"
      }
    }
  }
}

Tools

These remediation tools are registered only when OKTA_ENABLE_WRITE_TOOLS=true:

Incident Workflows

Common support prompts from an MCP client IDE:

• "Use Okta to summarize the incident context for user [email protected] since 2026-07-06T12:00:00Z."
• "Check whether this user has active sessions, enrolled factors, and recent MFA failures."
• "Find failed sign-in or app access events for [email protected] in the last two hours."
• "Compare the user's assigned groups with the failing application's assignments."
• "List sign-on and MFA policies that may affect this app or user."

Security Notes

• Use a scoped Okta admin/API token and rotate it regularly.
• Store OKTA_API_TOKEN in your MCP host's secret storage when available.
• Leave OKTA_ENABLE_WRITE_TOOLS=false for normal incident triage.
• Treat lifecycle, MFA reset, session clearing, and membership tools as privileged operations.
• Review MCP host approvals before allowing write operations.

See Architecture for component design, data flow, and extension guidance. See Using Okta MCP from Claude or VS Code for natural-language support workflows.