AuthAction MCP Server

AuthAction has its own MCP server. Add it to an MCP client such as Claude Code, Claude, Cursor or VS Code, sign in with your AuthAction account, and your coding agent can set up sign-in for the app you are building, debug tokens, and answer questions about your tenants.

Connect

Server	URL	Can
Full	https://mcp.authaction.com	Read and make changes
Read-only	https://mcp.authaction.com/read	Read only

In Claude Code:

claude mcp add --transport http authaction https://mcp.authaction.com

For read-only access, use the second URL instead:

claude mcp add --transport http authaction https://mcp.authaction.com/read

The first time a tool runs, your MCP client opens the AuthAction sign-in page. You see the same tenants and data as in the dashboard, and nothing more.

Read-only

The read-only server lists and inspects, and never changes anything. A token issued for it cannot make changes through the MCP server or by calling the AuthAction API directly. Use it for questions such as “how many users signed up last week” when you don’t want an agent able to change a production tenant.

Integrating sign-in

A typical session when adding AuthAction to an app:

1. Pick the tenant: tenants_list.
2. Create the application: applications_create. Use type spa or native for a browser or mobile front end: they use authorization code with PKCE and need no client secret. Use m2m only for backend services.
3. Set the callback URLs: applications_update with, for example, http://localhost:3000/callback.
4. Turn on a login method: connections_list, then connections_enable_client. Social connections without your own keys use AuthAction development keys, which are fine while you build.
5. Protect your API (optional): api_servers_create with your API’s URL as the identifier, then api_servers_enable_client.
6. Write the config: integration_config_get returns the domain, issuer, endpoints, client ID, the flow to use, the API audience and suggested environment variables, plus warnings for anything that will make sign-in fail.

Client secrets are never returned to the agent. For a backend (m2m) application, copy the secret from the dashboard into your app’s secret store.

Debugging tokens

When your API answers 401, ask your agent to run token_inspect on the token. It checks the signature, issuer, audience and expiry against your tenant and explains what is wrong, for example:

• the token expired, and when
• it was issued by a different tenant, so AUTHACTION_DOMAIN points at the wrong one
• it is an ID token, but your API needs an access token requested with audience
• its audience is not an API in your tenant

Questions about your users

users_stats counts sign-ups per day and per connection for a date range (the last 30 days by default), so “how many people signed up last week, and with what” is one call. users_list filters by sign-up time (createdAfter, createdBefore) and sorts newest or oldest.

Tools

Area	Read	Change
Tenants and workspaces	tenants_list, tenants_get, workspaces_list_mine, workspaces_list_tenants, workspaces_list_members, workspaces_list_admin_invites, tenant_members_list, tenant_members_list_invitations	tenants_create, tenants_update, tenant_members_invite, tenant_members_delete, tenant_members_delete_invitation, workspaces_invite_admin, workspaces_update_settings
Applications	applications_list, applications_get, integration_config_get	applications_create, applications_update
APIs	api_servers_list, api_servers_get	api_servers_create, api_servers_update, api_servers_enable_client
Connections	connections_list, connections_list_enterprise, connections_get, connections_list_users	connections_create, connections_update, connections_enable_client
Users	users_list, users_stats, users_get, users_list_applications, users_list_roles, users_list_passkeys	users_create, users_add_roles
Roles	roles_list, roles_get, roles_list_users	roles_create, roles_update, roles_assign_users
Organizations and plans	organizations_list, organizations_get, organization_members_list, plans_list, plans_get, plans_list_users, plans_list_orgs
Machine identities	workload_identities_list, workload_identities_get, federated_issuers_list, federated_issuers_get
Other	email_logs_list, tenants_list_custom_domains, profile_get, token_inspect

The read-only server offers only the Read column. The only tools that remove anything are tenant_members_delete and tenant_members_delete_invitation, which take a member or invitation off a tenant; MCP clients ask before running them.

Connection secrets (OAuth client secrets, SAML private keys, LDAP bind passwords) and application client secrets are never returned. Connections report clientSecretConfigured: true instead.