{
  "markdown": "# Okta Management MCP Servers\n\nGemini CLI extension that exposes **all 694 Okta Management API operations** as MCP tools — auto-generated from the official OpenAPI spec and split into **10 domain-specific servers** so you only load what you need.\n\n## Servers\n\n| Server | Tools | Domain |\n|--------|------:|--------|\n| `okta-users` | 93 | Users, Groups, Sessions, Factors, Credentials |\n| `okta-apps` | 75 | Applications, SSO, Provisioning, App Users/Groups |\n| `okta-authz` | 48 | Authorization Servers, Policies, Rules, Claims, Scopes |\n| `okta-idps` | 39 | Identity Providers, Keys, Identity Sources |\n| `okta-security` | 87 | Authenticators, Policies, Behavior Rules, Network Zones |\n| `okta-roles` | 81 | Role Assignments, Targets, Resource Sets, Custom Roles |\n| `okta-customization` | 97 | Brands, Themes, Custom Pages, Schemas, Emails |\n| `okta-org` | 68 | Org Settings, Features, Trusted Origins, Rate Limits |\n| `okta-hooks` | 55 | Event/Inline Hooks, Log Streams, System Log, SSF |\n| `okta-devices` | 51 | Devices, Agent Pools, Realms, Push Providers |\n\n## Installation\n\n### 1. Install the extension\n\n```bash\ngemini extension install /path/to/okta-mcp-server\n```\n\n### 2. Configure authentication\n\nThe servers support three authentication modes, auto-detected from environment variables.\n\n#### Option A — Private Key JWT *(recommended for automation)*\n\nBest for CI/CD, scripts, and server-to-server use. No user interaction required.\n\n**Okta setup:** Create a **Service** application in Okta Admin Console → Applications, enable **Client Credentials** grant type, and add a public key (JWK) under the application's credentials.\n\n```bash\nexport OKTA_ORG_URL=https://your-org.okta.com\nexport OKTA_CLIENT_ID=0oa...your-client-id\nexport OKTA_PRIVATE_KEY_FILE=/path/to/private-key.pem\n# Optional:\nexport OKTA_PRIVATE_KEY_KID=your-key-id        # if multiple keys are registered\nexport OKTA_SCOPES=\"okta.users.manage okta.apps.manage\"  # space-separated scopes\nexport OKTA_AUTH_SERVER_ID=default              # omit for org-level authorization server\n```\n\nAlternatively, pass the PEM key inline:\n\n```bash\nexport OKTA_PRIVATE_KEY=\"-----BEGIN RSA PRIVATE KEY-----\\n...\\n-----END RSA PRIVATE KEY-----\"\n```\n\n#### Option B — Device Authorization Grant *(recommended for interactive use)*\n\nBest for CLI sessions where a human is present. The server will print a URL and code — open the URL in your browser and enter the code to authorize.\n\n**Okta setup:** Create a **Native** application in Okta Admin Console → Applications, enable **Device Authorization** grant type, and ensure the authorization server policy allows device authorization.\n\n```bash\nexport OKTA_ORG_URL=https://your-org.okta.com\nexport OKTA_CLIENT_ID=0oa...your-client-id\n# Optional:\nexport OKTA_SCOPES=\"okta.users.manage okta.apps.manage\"\nexport OKTA_AUTH_SERVER_ID=default\n```\n\n#### Option C — SSWS API Token *(legacy)*\n\nStatic API token — simple but less secure. Kept for backward compatibility.\n\n```bash\nexport OKTA_ORG_URL=https://your-org.okta.com\nexport OKTA_API_TOKEN=your-ssws-token\n```\n\n### Auth mode priority\n\nWhen multiple variables are set, the server picks the most secure option:\n\n1. **Private Key JWT** — if `OKTA_CLIENT_ID` + `OKTA_PRIVATE_KEY` / `OKTA_PRIVATE_KEY_FILE` are set\n2. **Device Authorization Grant** — if only `OKTA_CLIENT_ID` is set\n3. **SSWS** — if only `OKTA_API_TOKEN` is set\n\n## Automatic Updates\n\nA [GitHub Actions workflow](.github/workflows/update-spec.yml) runs weekly (every Monday) to check for upstream changes to the [Okta OpenAPI spec](https://github.com/okta/okta-management-openapi-spec). If changes are detected, it regenerates the tool manifests and opens a PR automatically.\n\nYou can also trigger it manually from the Actions tab.\n\n## Regenerating (for contributors)\n\nIf you update the OpenAPI spec:\n\n1. Replace `okta-management-openapi.yaml`\n2. Run `npm install && npm run generate`\n3. Commit the updated JSON manifests in `src/servers/`\n\n## Project Structure\n\n```\n├── okta-management-openapi.yaml   # Okta OpenAPI spec (input)\n├── scripts/\n│   └── generate-tools.js          # Parses YAML → per-server JSON manifests\n├── src/\n│   ├── server-groups.js           # Tag-to-server mapping config\n│   ├── create-server.js           # Shared MCP server factory\n│   ├── okta-auth.js               # OAuth2 token manager (Device Auth / PKJWT / SSWS)\n│   ├── okta-client.js             # HTTP client (delegates auth to okta-auth.js)\n│   └── servers/                   # Pre-generated per-server manifests\n│       ├── okta-users.json\n│       ├── okta-apps.json\n│       └── ...\n├── servers/                       # Entry points (one per server)\n│   ├── okta-users.js\n│   ├── okta-apps.js\n│   └── ...\n└── gemini-extension.json          # Registers all 10 servers\n```\n",
  "bytes": 4771,
  "sha": "b1ce438140fc51e100a9434bf123d0378c96d502f9aba965bb70fdb307a45456",
  "repo_slug": "ebarti/okta-mcp-servers",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_ebarti_okta_mcp_servers_a5ba56bd/readme"
}