Authentik MCP Server

What is Authentik MCP Server?

A collection of Model Context Protocol (MCP) servers for integrating with the Authentik identity platform. Available in both Python and Node.js implementations, it offers full-featured servers with CRUD capabilities and diagnostic-only servers for read‑only monitoring. Designed for administrators and developers who need programmatic control or observability over their Authentik instance.

How to use Authentik MCP Server?

Install the desired package (e.g., authentik-mcp or authentik-diag-mcp), then configure your MCP‑compatible tool (such as VS Code or Claude Desktop) to point to the server binary and provide the Authentik API token and base URL as arguments. Do not run the servers directly via CLI; let the MCP tool manage their lifecycle. Example configuration snippets using uvx (Python) and npx (Node.js) are provided in the README.

Key features of Authentik MCP Server

• Full CRUD on users, groups, applications, tokens, flows, and providers
• Read‑only diagnostic monitoring of events, system health, and audit trails
• Available in both Python (uv) and Node.js (TypeScript) implementations
• Token‑based authentication with separate tokens for full vs. diagnostic access
• Event monitoring, system health checks, and audit trail analysis
• Supports filtering, searching, and detailed status queries

Use cases of Authentik MCP Server

• Automate user and group management tasks (create, update, delete)
• Monitor security events and troubleshoot authentication issues
• Generate compliance reports with audit trail analysis
• Check system health, version info, and configuration drift
• View read‑only application, flow, and provider statuses for diagnostics

FAQ from Authentik MCP Server

What is the difference between full and diagnostic servers?

Full servers (authentik-mcp) provide complete CRUD operations on all resources. Diagnostic servers (authentik-diag-mcp) are read‑only and focused on monitoring, event search, and health checks.

What are the runtime requirements?

Python 3.10+ with uv (recommended) or Node.js 18.0.0+ with npm/yarn. A valid Authentik API token with appropriate permissions is required.

How do I get an API token?

Log into Authentik as an administrator, navigate to Directory > Tokens, create a token (read‑only for diagnostic servers, full permissions for full servers), and copy it for use with the MCP server.

Can I run these servers directly from the command line?

No. The packages are intended to be managed by an MCP‑compatible tool or platform. Direct CLI use is not supported in production.

Where does the data reside?

All data stays within your Authentik instance. The servers interact with the Authentik API and do not store any data locally.