TAKO Okta

TAKO Okta MCP Server lets you securely query Okta resources via AI assistants using the Model Context Protocol. It supports dual-mode operation, flexible transports, and enterprise-grade security features to empower IAM teams, security engineers, and Okta administrators to build safe, auditable AI-driven workflows against their Okta environment.

How to use

Choose your preferred transport and connect an MCP client. You can run in STDIO mode for local desktop clients or in HTTP mode for remote deployments. In Basic MCP mode you expose a standard set of Okta tools to the AI, and in Agent Mode you allow the AI to discover and invoke operations dynamically. Start the HTTP transport to enable remote access, or use the STDIO transport to integrate with desktop tools like Claude Desktop, Cursor, or VS Code.

How to install

# Prerequisites
- Python 3.8+ (with pip)
- Optional: Docker if you prefer containerized deployment

# Option 1. STDIO (local desktop clients) - using Python directly
# 1. Clone the MCP server repository (assumes you have access to the codebase)
# 2. Create a Python virtual environment and activate it
uv venv .venv
source .venv/bin/activate

# 3. Install the server package in editable mode
uv pip install -e .

# 4. Configure environment for your Okta access (see Configuration section below)
# 5. Run in STDIO mode (the CLI example shown uses the module entry point)
python -m fctr_okta_mcp.server

# Option 2. HTTP (remote/web access)
# 1. Run the HTTP transport server
python -m fctr_okta_mcp.server --http-transport --i-understand-the-risks

Additional configuration and setup notes

Configuration is controlled via environment variables. Create a .env file and populate the necessary values to enable your Okta integration, authentication method, transport mode, and runtime limits. The most commonly used variables include the Okta organization URL, the API token or OAuth2 credentials, and mode switches for Agent and HTTP transports.

Configuration and security

Key configuration options include enabling Agent Mode for dynamic API discovery, choosing the HTTP transport base URL, and setting concurrency and timeouts to align with your Okta plan. A secure code execution sandbox validates generated code before execution, restricting dangerous patterns and imports, whitelisting safe operations, and limiting network access to safe endpoints via GET requests only.

Security and rate limits

The server enforces an AST-based sandbox to prevent unsafe code execution and applies a strict whitelist of allowed functions. Data privacy practices ensure Okta data is only used for query purposes, with large results exported to CSV and auto-cleaned after a set period. Monitor your concurrent API requests by adjusting OKTA_CONCURRENT_LIMIT to stay within plan constraints. If you see “Concurrent limit rate exceeded” warnings, reduce the limit or pause delays between requests.

Get help

If you need assistance, verify your .env configuration and Okta API token permissions, confirm MCP client compatibility, and check server logs in the logs/ directory for clues. Reach out via support channels for guidance and issues.

License

Elastic License 2.0 - See LICENSE.

Available tools

okta_user_list

List users with filtering, search, and pagination

okta_user_get

Get detailed user profile by ID or login

okta_user_list_groups

List groups a user belongs to

okta_user_list_applications

List applications assigned to a user

okta_user_list_factors

List enrolled authentication factors

okta_group_list

List groups with filtering and pagination

okta_group_get

Get detailed group information

okta_group_list_users

List members of a group

okta_group_list_applications

List applications assigned to a group

okta_app_list

List applications with filtering

okta_app_get

Get detailed application information

okta_app_list_users

List users assigned to an application

okta_app_list_groups

List groups assigned to an application

okta_log_get_events

Query system log events with advanced filtering

okta_policy_list_rules

List rules for a specific policy

okta_policy_get_rule

Get detailed policy rule configuration

okta_network_list_zones

List network zones

okta_network_get_zone

Get detailed network zone information

okta_datetime_now

Get current UTC timestamp for queries

okta_datetime_parse_relative

Parse natural language time expressions