authentik-mcp-server

Workflow-centric MCP server for the Authentik Identity Provider, written in Go with stdio transport.

Exposes Authentik identity operations as callable tools in Claude Code, enabling you to query user access, audit security events, and inspect your IAM posture directly from the CLI.

Tools

summarize_user_access

Returns a structured JSON summary of a user's identity, group memberships, recent activity, and accessible applications.

Input: username (string, required)

Output:

{
  "username": "alice",
  "email": "alice@example.com",
  "is_active": true,
  "last_login": "2026-01-15T09:00:00Z",
  "groups": ["admins", "vpn-users"],
  "recent_events": [
    {"action": "login", "datetime": "2026-01-15T09:00:00Z", "client_ip": "192.0.2.10"}
  ],
  "accessible_apps": ["Grafana", "Vault"]
}

audit_recent_security_events

Returns a markdown table of recent security-relevant events: login_failed, policy_denied, and secret_view. Events are fetched in parallel across all three action types, merged, and sorted by timestamp descending.

Input: limit (int, optional, default 20)

Output:

| DateTime | Action | Username | ClientIP |
|----------|--------|----------|----------|
| 2026-01-15T09:00:00Z | login_failed | alice | 192.0.2.10 |

Quick Start

Prerequisites

• Go 1.24+
• Authentik instance with an API token (Settings → System → Tokens)

Build

make build
# binary at bin/authentik-mcp

Run

export AUTHENTIK_URL=https://your-authentik-instance:9443
export AUTHENTIK_TOKEN=your-api-token
./bin/authentik-mcp

Smoke test

make smoke-test
# OK: connected to Authentik at https://your-authentik-instance:9443

Docker

make docker-build
docker run -e AUTHENTIK_URL=... -e AUTHENTIK_TOKEN=... authentik-mcp:latest

Claude Code Integration

Add to ~/.claude.json:

{
  "mcpServers": {
    "authentik": {
      "command": "/path/to/bin/authentik-mcp",
      "env": {
        "AUTHENTIK_URL": "https://your-authentik-instance:9443",
        "AUTHENTIK_TOKEN": "your-api-token"
      }
    }
  }
}

Restart Claude Code, then use the tools directly in conversation:

> use the authentik mcp to audit recent security events
> summarize access for user alice

Configuration

Architecture

• Transport: stdio (MCP standard, works with Claude Code and any MCP-compatible client)
• SDK: mark3labs/mcp-go v0.32.0
• HTTP client: Hand-crafted over the Authentik REST API (the official oapi-codegen generated client had type compatibility issues with the 3.2MB schema — see oapi-codegen.yaml retained for future use)
• Retry logic: 3 attempts, 500ms backoff on 5xx or network errors
• Auth: Authorization: Bearer <token> injected via transport middleware

API endpoints used

Roadmap

• Phase 3: list_groups, create_user, `set_user_passwor

... View full README on GitHub