M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
A

Access MCP Server

Official
Manage internal access through MCP.
How to install ↓ Compare GitHub source repository ↗
Category
Other #51 of 230
Stars
★ 481 Very popular
Transport
Streamable HTTP
Runtime
Python 3.13 · Node.js · Docker
Credentials
API key / credential required
License
Apache-2.0
Last commit
Tools
3
63FMRS · C

The source identifies this as an MCP server embedded in Discord's Access project. It exposes permission discovery and request-submission capabilities over Streamable HTTP and is disabled by default. The source does not provide the complete names of all 21 tools or a client installation configuration example.

Strongest · Documentation 16/20 Weakest · Reliability 9/20

Reliability
9/20
Security and permissions
15/20
Maintenance
11/20
Documentation
16/20
Setup experience
12/20
Why each score
Reliability 9/20
The README describes optional MCP mounting, 21 tools, authentication providers, scope checks, and audit tagging, and it references pytest, ruff, ty, and CI checks, making the normal path plausible. However, the manifest is not cached and there is no MCP-specific test result or tool-level execution evidence, so initialization, tool-list handshake, parameter contracts, and error handling cannot be verified. This deduction keeps the static score at or below 12.
Security and permissions 15/20
The evidence shows that MCP is off by default, supports Cloudflare/OIDC bearer-token verification, validates OIDC signature, issuer, expiry, and audience, applies scopes and per-tool authorization, and limits MCP writes to pending requests rather than direct approval or permission mutation. MCP activity is also audit-tagged. Points are deducted because the default fallback scope includes create_requests, writes have no explicit second-step confirmation mechanism, and the supplied material cannot verify implementation details, rate limiting, sensitive-data boundaries, or all failure paths. No red-line condition is evidenced.
Maintenance 11/20
The repository is not archived, declares Apache-2.0 licensing, and documents locked dependencies, a CI client-drift check, and test/lint/type-check commands, indicating some maintenance foundation. Points are deducted because the material provides no release history, commit activity, issue-response record, dependency-update evidence, clearly identified maintenance team, or security-response channel. Stars and issue counts are not credited.
Documentation 16/20
The README gives substantial coverage of deployment, database setup, OIDC/Cloudflare authentication, MCP enablement, tool categories, scope semantics, discovery, auditing, development mode, and limitations, with environment-variable examples. Points are deducted because it lacks per-tool parameter and return-value documentation, complete mainstream-client configuration examples, cost or resource-impact guidance, and concrete troubleshooting or verifiable run results.
Setup experience 12/20
The README provides steps covering Python/uv, database setup, Okta, Docker, production authentication, and local MCP use, including the MCP endpoint and development mode. Points are deducted because a working connection depends on deploying Access, configuring Okta/Cloudflare or OIDC, setting up a database, and supplying a high-privilege Okta API token. There is no complete configuration example for a mainstream MCP client, and the setup remains manual and environment-heavy. The static calibration therefore caps this at 15.

Static review · not runListed 2026-08-14

Read the FMRS scoring method →

Fit and risk

What it can accessUses the networkChanges third-party account dataConnects to a database

Best for

  • Organizations that need centralized visibility into Okta-related internal access.
  • Teams that want MCP clients to assist with permission discovery and pending request submission.
  • Operators able to configure Cloudflare Access or OIDC for an Access deployment.

Not for

  • Workflows requiring MCP to approve or reject requests.
  • Workflows requiring direct MCP mutation of groups, roles, or apps.
  • Users without an Access deployment, Okta data, or a supported authentication setup.

Required permissions

  • Access to the Okta API is required; development setup calls for Group Admin and Application Admin roles plus group-management permissions.
  • Production deployments require Cloudflare Access or OIDC authentication.
  • MCP tools require read_all or create_requests scopes, while Access authorization rules still apply to each operation.

Risks and side effects

  • A misconfigured Okta API token may grant excessive group or application administration privileges.
  • Tokens without an explicit scope receive read_all and create_requests by default; operators can configure read-only or fail-closed behavior.
  • Enabling MCP allows authenticated clients to read access data and submit pending requests.
  • Incorrect proxy Host or OIDC callback configuration can create redirect-URI risks; the source recommends ALLOWED_HOSTS and OIDC_OVERWRITE_REDIRECT_URI.

Setup

Before you start

Runtime：Python 3.13 · Node.js · Docker

OKTA_API_TOKEN optionalsecret Okta API Token created in the Okta admin dashboard, requiring Group Admin / Application Admin roles.
DATABASE_URI optionalsecret Database connection URI; sqlite:///access.db for dev, a postgresql:// URI in production.
SECRET_KEY optionalsecret Secret used to sign the OIDC session cookie; generate with python -c 'import secrets; print(secrets.token_hex())'.
OIDC_CLIENT_SECRETS optionalsecret Path to your client_secrets. or the inline JSON string with OIDC client credentials.
Other optional settings (9)
ENABLE_MCP optional Set to true to mount the embedded MCP server at /mcp; off by default.
MCP_FALLBACK_SCOPES optional Fallback scopes for MCP tokens with no scope claim; defaults to read_all,create_requests.
OIDC_MCP_AUDIENCE optional OAuth audience validated against the aud claim of MCP bearer tokens when OIDC is enabled; typically the registered MCP application client id.
MCP_RESOURCE_URL optional Canonical public URL of the MCP resource (e.g. https://access.example.com/mcp); set explicitly behind a proxy that rewrites Host.
OKTA_DOMAIN optional Your Okta domain, e.g. mydomain.oktapreview.com.
CURRENT_OKTA_USER_EMAIL optional Okta user email used to resolve identity by the dev auth provider in development mode.
CLOUDFLARE_TEAM_DOMAIN optional Cloudflare Zero Trust Team domain used for Cloudflare Access MCP authentication.
CLOUDFLARE_APPLICATION_AUDIENCE optional Cloudflare Access application AUD tag used for MCP authentication.
OIDC_SERVER_METADATA_URL optional OIDC discovery document URL; when set, enables the MCP OIDC bearer-token auth provider.

Set ENABLE_MCP=true in the production configuration for an Access deployment, then connect the MCP client to https://<your-access-deployment>/mcp. MCP uses Streamable HTTP. Configure either Cloudflare Access or OIDC authentication; development and test environments can use the development provider based on CURRENT_OKTA_USER_EMAIL. The source does not provide a client configuration example.

Check that it works

Set ENABLE_MCP=true in .env and run make run-backend, then point an MCP client (e.g. Claude Code or mcp-inspector) at http://localhost:6060/mcp — in development mode no credential is needed, and the tool list should show create_access_request, create_role_request, and create_group_request.

Troubleshooting

  1. Verify ENABLE_MCP=true and use the deployed /mcp POST endpoint.
  2. Ensure Cloudflare Access and OIDC are not both configured for MCP; they are mutually exclusive.
  3. For OIDC, check OIDC_SERVER_METADATA_URL, OIDC_MCP_AUDIENCE, and token signature, iss, exp, and aud validation.
  4. For Cloudflare Access, check the team domain, application audience, and token source.
  5. If a tool is denied, check token scopes, user identity, and the corresponding REST authorization rule.
  6. For local development, verify ENV is development or test and set CURRENT_OKTA_USER_EMAIL.

Things to try

Once connected, you can ask your AI assistant things like:

  • List the groups and roles currently available to me
  • File an access request for me to join a group
  • As a role owner, request that my role be granted access to a group
  • Submit a request to create a new group

Tools 3

create_access_request writes
Requests group membership or ownership for the current user.
create_role_request writes
Allows a role owner to request that a role be granted access to a group.
create_group_request writes
Requests creation of a new group, role, or application group.

Use cases

Browse available groups, roles, apps, and access requests.
Submit access, role, or group-creation requests for the authenticated user.
Distinguish MCP-originated mutations from web activity in audit logs.

Supported clients

Claude Code
Claude.ai
Cursor
Zed
Self-hosted modelsPartial support

Listed from the project's documentation, not tested by this site.

Overview

Access is Discord's centralized portal for employees to discover, request, and manage access to the internal systems needed for their work. When its optional MCP server is enabled, compatible clients can browse groups, roles, apps, users, tags, audit entries, memberships, and requests, and submit access requests on behalf of the authenticated user.

Similar servers

BioMCP 75 · B

One binary. One grammar. Evidence from the biomedical sources you already trust.

★ 654 · Tools 11 Compare with this →
Compare with other MCP servers

Source revision b3decabfe60b Data synced 2026-10-12 Read the FMRS scoring method