Idira Privilege Cloud MCP Server

An MCP server for Idira (formerly CyberArk) Privilege Cloud, built on the official ark-sdk-python library. Provides 53 tools for privileged access management.

Supports two authentication modes:

• OAuth per-user mode (recommended) – each user authenticates with their own Idira Identity credentials via OAuth. Requires Streamable HTTP transport and an OIDC app in Idira Identity (setup guide).
• Legacy service account mode – a single shared service account authenticates all requests via stdio transport. Simpler setup, shown in Quick Start below.

Quick Start

This sets up the legacy service account mode via stdio. For OAuth per-user mode, see OAuth Per-User Mode.

1. Install uv (if not already installed):

curl -LsSf https://astral.sh/uv/install.sh | sh

2. Configure Claude Desktop - Add to your configuration file:

{
  "mcpServers": {
    "cyberark-privilege-cloud": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/aaearon/mcp-privilege-cloud.git",
        "mcp-privilege-cloud"
      ],
      "env": {
        "CYBERARK_CLIENT_ID": "your-service-user-username",
        "CYBERARK_CLIENT_SECRET": "your-service-user-password"
      }
    }
  }
}

3. Restart Claude Desktop - The MCP server will appear in the tools menu (hammer icon) when connected.

Claude Code

claude mcp add cyberark-privilege-cloud \
  -e CYBERARK_CLIENT_ID=your-service-user-username \
  -e CYBERARK_CLIENT_SECRET=your-service-user-password \
  -- uvx --from git+https://github.com/aaearon/mcp-privilege-cloud.git mcp-privilege-cloud

Example Prompts

Once configured, you can ask Claude things like:

• “List all accounts in the Production safe”
• “Show me Windows accounts that are failing management”
• “Create a new safe called ‘DevOps-Credentials’ with 30-day retention”
• “Add the DevOps team as safe members with retrieve permissions”
• “List all active platforms and their account counts”
• “Show me active privileged sessions”

Prerequisites

• Idira Identity Service User with:
  • Appropriate Identity roles for the desired operations (e.g., Privilege Cloud Administrator for platform management)
  • Safe permissions granting access to the safes and accounts you want to manage
• For OAuth per-user mode: an OIDC app in Idira Identity (see setup guide)

Configuration

OAuth Per-User Mode