Saviynt

MCP server for the Saviynt Enterprise Identity Cloud (EIC) API v24.2.
221 tools across 15 modules

Project Structure

saviynt-mcp/
├── pyproject.toml
├── .env.example
└── saviynt_mcp/
    ├── __init__.py
    ├── auth.py                      # Shared auth: refresh-token flow + helpers
    ├── server.py                    # Root MCP — mounts all 15 sub-servers
    │
    ├── authentication.py            #  1.0  2 tools
    ├── identity_administration.py   #  2.0  69 tools
    ├── analytics.py                 #  3.0  10 tools
    ├── access_request.py            #  4.0  59 tools
    ├── delegated_administration.py  #  5.0  5 tools
    ├── attestations.py              #  6.0  6 tools
    ├── campaigns.py                 #  7.0  28 tools
    ├── segregation_of_duties.py     #  8.0  4 tools
    ├── password_reset.py            #  9.0  6 tools
    ├── common_utilities.py          # 10.0  14 tools
    ├── dashboard.py                 # 11.0  3 tools
    ├── ldap.py                      # 12.0  7 tools
    ├── paa.py                       # 13.0  1 tool
    ├── transport.py                 # 14.0  3 tools
    └── policies.py                  # 15.0  4 tools

Authentication

All tools automatically obtain a Bearer token using the OAuth refresh-token flow.
You only need to set one environment variable:

SAVIYNT_REFRESH_TOKEN=<your refresh token>

The token is fetched on first use, cached in memory, and automatically refreshed when it nears expiry.
No manual token management is needed.

Prerequisites

• Python 3.11+
• uv

Setup

cd saviynt-mcp

# Install dependencies
uv sync

# Configure
cp .env.example .env
# Edit .env: set SAVIYNT_BASE_URL and SAVIYNT_REFRESH_TOKEN

Running

# Load .env then start (stdio transport for MCP clients)
export $(cat .env | xargs)
uv run saviynt-mcp

Or without a .env file:

SAVIYNT_BASE_URL=https://acme.saviyntcloud.com \
SAVIYNT_REFRESH_TOKEN=your-refresh-token \
SAVIYNT_LOG_LEVEL=INFO \
uv run saviynt-mcp

Claude Desktop Integration

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "saviynt-eic": {
      "command": "uv",
      "args": [
        "run",
        "--project", "/absolute/path/to/saviynt-mcp",
        "saviynt-mcp"
      ],
      "env": {
        "SAVIYNT_BASE_URL": "https://acme.saviyntcloud.com",
        "SAVIYNT_REFRESH_TOKEN": "your-refresh-token",
        "SAVIYNT_LOG_LEVEL": "INFO"
      }
    }
  }
}

Tool Naming

Tools are mounted under their category prefix, e.g.:

Tool	MCP name
Create User	identity_administration_create_user
Fetch Campaign List	campaigns_fetch_campaign_list
Get Pending Requests	access_request_get_list_of_pending_requests_for_approver
Fetch Technical Rules	policies_fetch_technical_rules

Tool Parameters

Each tool accepts:

• Named parameters matching the Postman collection request body fields
• extra: dict — catch-all for any additional body fields not listed explicitly

Example:

# Create a user
await identity_administration_create_user(
    username="jdoe",
    firstname="John",
    startdate="01-01-2025",
    enddate="12-31-2025",
    extra={"email": "[email protected]", "department": "Engineering"}
)

Environment Variables

Variable	Required	Description
SAVIYNT_BASE_URL	✅	Tenant URL, e.g. https://acme.saviyntcloud.com
SAVIYNT_REFRESH_TOKEN	✅	OAuth refresh token
SAVIYNT_LOG_LEVEL	❌	Logging level (DEBUG, INFO, WARNING, ERROR). Defaults to INFO.

License

This project is licensed under the MIT License.