CyberArk Privilege Cloud MCP Server

An MCP server for CyberArk Privilege Cloud, built on the official ark-sdk-python library. Provides 53 tools for privileged access management.

Supports two authentication modes:

• OAuth per-user mode (recommended) -- each user authenticates with their own CyberArk Identity credentials via OAuth. Requires Streamable HTTP transport and an OIDC app in CyberArk Identity (setup guide).
• Legacy service account mode -- a single shared service account authenticates all requests via stdio transport. Simpler setup, shown in Quick Start below.

Quick Start

This sets up the legacy service account mode via stdio. For OAuth per-user mode, see OAuth Per-User Mode.

1. Install uv (if not already installed):

curl -LsSf https://astral.sh/uv/install.sh | sh

2. Configure Claude Desktop - Add to your configuration file:

{
  "mcpServers": {
    "cyberark-privilege-cloud": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/aaearon/mcp-privilege-cloud.git",
        "mcp-privilege-cloud"
      ],
      "env": {
        "CYBERARK_CLIENT_ID": "your-service-user-username",
        "CYBERARK_CLIENT_SECRET": "your-service-user-password"
      }
    }
  }
}

3. Restart Claude Desktop - The MCP server will appear in the tools menu (hammer icon) when connected.

Claude Code

claude mcp add cyberark-privilege-cloud \
  -e CYBERARK_CLIENT_ID=your-service-user-username \
  -e CYBERARK_CLIENT_SECRET=your-service-user-password \
  -- uvx --from git+https://github.com/aaearon/mcp-privilege-cloud.git mcp-privilege-cloud

Example Prompts

Once configured, you can ask Claude things like:

• "List all accounts in the Production safe"
• "Show me Windows accounts that are failing management"
• "Create a new safe called 'DevOps-Credentials' with 30-day retention"
• "Add the DevOps team as safe members with retrieve permissions"
• "List all active platforms and their account counts"
• "Show me active privileged sessions"

Prerequisites

• CyberArk Identity Service User with:
  • Appropriate Identity roles for the desired operations (e.g., Privilege Cloud Administrator for platform management)
  • Safe permissions granting access to the safes and accounts you want to manage
• For OAuth per-user mode: an OIDC app in CyberArk Identity (see setup guide)

Configuration

OAuth Per-User Mode

Each connecting user authenticates with their own CyberArk Identity credentials via OAuth. The server verifies user identity from the OIDC JWT, then uses a shared service account platform token for all PCloud API calls.

Requires Streamable HTTP transport -- see Docker Deployment or set MCP_TRANSPORT=streamable-http when running locally.

... View full README on GitHub