Scope-based tool loading
Learn about the scope-based tool loading mechanism of the Okta Managed MCP Server.
Early Access release
Overview
The Okta Managed MCP Server uses scope-based tool loading to ensure that only the tools your app is authorized to use are exposed to the LLM.
How it works
- Startup filtering
- After authentication completes, the server reads the scopes in your access token. The server compares each tool's required scope against your access token's scopes. Tools whose required scope isn't present are silently removed from the tool registry and don't appear in the tools list.
- Runtime enforcement
- If you don't have the required scope, you can't perform the action and receive an error message in the tool execution response.
Scope-to-tool mapping
Each tool is categorized by type: IAM (Identity and Access Management) or OIG (Okta Identity Governance).
| Tool name | Type | Available Okta scopes |
|---|---|---|
okta_user_management |
IAM | okta.users.read and okta.users.manage |
okta_group_management |
IAM | okta.groups.read and okta.groups.manage |
okta_application_management |
IAM | okta.apps.read and okta.apps.manage |
okta_access_management |
IAM | okta.policies.read and okta.policies.manage |
okta_syslog |
IAM | okta.logs.read |
okta_device_management |
IAM | okta.deviceAssurance.read and okta.deviceAssurance.manage |
okta_customization_management |
IAM | okta.brands.read, okta.brands.manage, okta.templates.read, okta.templates.manage, okta.domains.read, okta.domains.manage, okta.emailDomains.read, and okta.emailDomains.manage |
okta_identity_governance (Access requests) |
OIG | okta.governance.accessRequests.read, okta.governance.accessRequests.manage, okta.accessRequests.request.read, okta.accessRequests.request.manage, okta.accessRequests.catalog.read, okta.accessRequests.condition.read, and okta.accessRequests.condition.manage |
okta_identity_governance (Access certifications) |
OIG | okta.governance.accessCertifications.manage and okta.governance.accessCertifications.read |
okta_identity_governance (Entitlement management) |
OIG | okta.governance.entitlements.read, okta.governance.entitlements.manage, okta.governance.collections.read, okta.governance.collections.manage, okta.governance.labels.read, okta.governance.labels.manage, okta.governance.resourceOwner.read, and okta.governance.resourceOwner.manage |
okta_identity_governance (Delegate appointments) |
OIG | okta.governance.delegates.read, okta.governance.delegates.manage, and okta.governance.principalSettings.manage |
okta_identity_governance (My requests) |
OIG | okta.accessRequests.request.read and okta.accessRequests.catalog.read |
okta_identity_governance (My settings) |
OIG | okta.governance.principalSettings.read and okta.governance.principalSettings.manage |