takleb3rry/zitadel-mcp

An MCP (Model Context Protocol) server for Zitadel identity management. Manage users, projects, applications, roles, and service accounts through natural language from AI tools like Claude Code.
> *"Provision jane@example.com as an Admin."*
> — One tool call: creates the user, assigns the admin project role (v2 authorization), and grants ORG_USER_MANAGER so she can manage other users — no Super Admin required.
Tools (37)
| Category | Tool | Description |
|----------|------|-------------|
| **Users** | zitadel_list_users | List/search users |
| | zitadel_get_user | Get user details |
| | zitadel_create_user | Create user (sends invite email; optional client-supplied userId) |
| | zitadel_deactivate_user | Deactivate user |
| | zitadel_reactivate_user | Reactivate user |
| | zitadel_lock_user | Lock user |
| | zitadel_unlock_user | Unlock user |
| | zitadel_delete_user | Permanently delete user |
| **Projects** | zitadel_list_projects | List projects |
| | zitadel_get_project | Get project details |
| | zitadel_create_project | Create project |
| **Applications** | zitadel_list_apps | List apps in a project |
| | zitadel_get_app | Get app details + Client ID |
| | zitadel_create_oidc_app | Create OIDC application (incl. grantTypes / responseTypes / accessTokenType) |
| | zitadel_update_app | Update app (redirect URIs, accessTokenType, etc.) |
| **Roles** | zitadel_list_project_roles | List roles in a project |
| | zitadel_create_project_role | Create a role (standardized: admin/standard) |
| | zitadel_list_user_grants | List user's role grants |
| | zitadel_create_user_grant | Assign project roles (v2 authorization; flags off-vocabulary drift) |
| | zitadel_remove_user_grant | Remove role grant |
| **Org Managers** | zitadel_list_org_manager_roles | List supported manager roles (ORG_OWNER, ORG_USER_MANAGER, …) |
| | zitadel_list_org_managers | List who holds manager grants (filter by role) |
| | zitadel_grant_org_manager | Grant manager role(s) (default ORG_USER_MANAGER); idempotent |
| | zitadel_revoke_org_manager | Revoke manager role(s); guards the last ORG_OWNER |
| **Provisioning** | zitadel_provision_user | Atomic + idempotent: create user + assign admin/standard + (for Admins) ORG_USER_MANAGER |
| | zitadel_offboard_user | Remove role + revoke manager + deactivate; guards last-Admin & self-demotion |
| **Service Accounts** | zitadel_create_service_user | Create machine user |
| | zitadel_create_service_user_key | Generate key pair |
| | zitadel_list_service_user_keys | List keys (metadata only) |
| **Organizations** | zitadel_get_org | Get current org details |
| **Login Policy** | zitadel_get_login_policy | Get the org login policy (self-registration on/off, custom vs. inherited) |
| | zitadel_set_self_registration | Enable/disable self-registration (allowRegister) for the org — idempotent. **Opt-in:** requires ZITADEL_ENABLE_LOGIN_POLICY_WRITE=true |
| **Login Texts** *(Login V2)* | zitadel_get_hosted_login_translation | Read the new hosted-login (Login V2) text overrides for a locale — merged effective file, or onlyOverrides for this level's stored keys |
| | zitadel_set_hosted_login_translation | Override Login V2 texts for a locale (Settings v2 API) — pass flat dot-path keys mirroring apps/login/locales/ .json; merges onto shipped defaults, idempotent |
| **Utility** | zitadel_get_auth_config | Get .env.local template for an app |
| **Portal** | portal_register_app | Register app in portal DB |
| | portal_setup_full_app | One-click: Zitadel + portal setup |
Portal tools (portal_*) are only available when PORTAL_DATABASE_URL is configured.
zitadel_set_self_registration is only available when ZITADEL_ENABLE_LOGIN_POLICY_WRITE=true. It is off by default because enabling self-registration opens the organization to public signup for every application whose login resolves to that org, and — unlike every other write tool here — the change leaves behind no user, grant, or app record that would make it noticeable. The read-only zitadel_get_login_policy is always available.