authentik-mcp

MCP server for Authentik identity provider.

Install

{
  "mcpServers": {
    "authentik": {
      "command": "uvx",
      "args": ["--refresh", "--extra-index-url", "https://nikitatsym.github.io/authentik-mcp/simple", "authentik-mcp"],
      "env": {
        "AUTHENTIK_URL": "https://auth.example.com",
        "AUTHENTIK_TOKEN": "your-api-token"
      }
    }
  }
}

Where to paste:

• Claude Desktop — ~/Library/Application Support/Claude/claude_desktop_config.json
• Cursor — .cursor/mcp.json in your project
• Claude Code — ~/.claude.json top-level mcpServers

Or use the setup wizard to generate the config.

Getting an API token

Authentik admin panel → Directory → Tokens and App passwords → Create with API scope.

Groups

Tool	Description
authentik_read	Users, groups, apps, tokens, providers, outposts, crypto, RBAC (read-only)
authentik_write	Create/update core resources (non-destructive)
authentik_delete	Delete operations across all domains (destructive)
authentik_flows_read	Flows, stages, policies, sources, events (read-only)
authentik_flows_write	Create/update auth pipeline config (non-destructive)
authentik_admin	Admin settings, system info, lifecycle

Call any group with operation="help" to list available operations.

Application access control

Apps are open to all authenticated users until gated. Restrict an app to a group/user by binding it: CreatePolicyBinding(target=<app pk>, group=<group pk>) (or user=) in authentik_flows_write; inspect gates with ListPolicyBindings / ShowPolicyBinding in authentik_flows_read. Policy bindings live under the authentik_flows_* groups, not the core ones.