takleb3rry/zitadel-mcp

开发工具

本页由 AI 翻译，技术细节请以原文为准。查看原文

11 stars 8 forks 质量 79 趋势 28MIT

Repository Install

MCP server for Zitadel identity management — manage users, projects, apps, roles, and service accounts from AI tools

概览

An MCP (Model Context Protocol) server for Zitadel identity management. Manage users, projects, applications, roles, and service accounts through natural language from AI tools like Claude Code. "Provision [email protected] as an Admin." — One tool call: creates the user, assigns the admin project role (v2 authorization), and grants ORG_USER_MANAGER so she can manage other users — no Super Admin required. Portal tools (portal_*) are only available when PORTAL_DATABASE_URL is configured. zitadel_set_self_registration is only available when ZITADEL_ENABLE_LOGIN_POLICY_WRITE=true. It is off by default because enabling self-registration opens the organization to public signup for every application whose login resolves to that org, and — unlike every other write tool here — the change leaves behind no user, grant, or app record that would make it noticeable. The read-only zitadel_get_login_policy is always available.

README

以下为原文 README 节选，完整内容请查看原文。

Zitadel MCP Server

An MCP (Model Context Protocol) server for Zitadel identity management. Manage users, projects, applications, roles, and service accounts through natural language from AI tools like Claude Code.

“Provision [email protected] as an Admin.” — One tool call: creates the user, assigns the admin project role (v2 authorization), and grants ORG_USER_MANAGER so she can manage other users — no Super Admin required.

Tools (37)

Category	Tool	Description
Users	`zitadel_list_users`	List/search users
	`zitadel_get_user`	Get user details
	`zitadel_create_user`	Create user (sends invite email; optional client-supplied `userId`)
	`zitadel_deactivate_user`	Deactivate user
	`zitadel_reactivate_user`	Reactivate user
	`zitadel_lock_user`	Lock user
	`zitadel_unlock_user`	Unlock user
	`zitadel_delete_user`	Permanently delete user
Projects	`zitadel_list_projects`	List projects
	`zitadel_get_project`	Get project details
	`zitadel_create_project`	Create project
Applications	`zitadel_list_apps`	List apps in a project
	`zitadel_get_app`	Get app details + Client ID
	`zitadel_create_oidc_app`	Create OIDC application (incl. `grantTypes` / `responseTypes` / `accessTokenType`)
	`zitadel_update_app`	Update app (redirect URIs, `accessTokenType`, etc.)
Roles	`zitadel_list_project_roles`	List roles in a project
	`zitadel_create_project_role`	Create a role (standardized: `admin`/`standard`)
	`zitadel_list_user_grants`	List user’s role grants
	`zitadel_create_user_grant`	Assign project roles (v2 authorization; flags off-vocabulary drift)
	`zitadel_remove_user_grant`	Remove role grant
Org Managers	`zitadel_list_org_manager_roles`	List supported manager roles (ORG_OWNER, ORG_USER_MANAGER, …)
	`zitadel_list_org_managers`	List who holds manager grants (filter by role)
	`zitadel_grant_org_manager`	Grant manager role(s) (default `ORG_USER_MANAGER`); idempotent
	`zitadel_revoke_org_manager`	Revoke manager role(s); guards the last `ORG_OWNER`
Provisioning	`zitadel_provision_user`	Atomic + idempotent: create user + assign `admin`/`standard` + (for Admins) `ORG_USER_MANAGER`
	`zitadel_offboard_user`	Remove role + revoke manager + deactivate; guards last-Admin & self-demotion
Service Accounts	`zitadel_create_service_user`	Create machine user
	`zitadel_create_service_user_key`	Generate key pair
	`zitadel_list_service_user_keys`	List keys (metadata only)
Organizations	`zitadel_get_org`	Get current org details
Login Policy	`zitadel_get_login_policy`	Get the org login policy (self-registration on/off, custom vs. inherited)

在 GitHub 查看完整 README

安装

This server does not publish a one-line install command.

Open the repository installation guide 新手？先看 mcpskill.org 教程 →

配置

{
  "mcpServers": {
    "zitadel": {
      "command": "node",
      "args": ["/path/to/zitadel-mcp/build/index.js"],
      "env": {
        "ZITADEL_ISSUER": "https://your-instance.zitadel.cloud",
        "ZITADEL_SERVICE_ACCOUNT_USER_ID": "...",
        "ZITADEL_SERVICE_ACCOUNT_KEY_ID": "...",
        "ZITADEL_SERVICE_ACCOUNT_PRIVATE_KEY": "...",
        "ZITADEL_ORG_ID": "...",
        "ZITADEL_PROJECT_ID": "..."
      }
    }
  }
}