# Apono Admin MCP Server

A Model Context Protocol (MCP) server lets AI clients connect to external tools and data sources in a consistent, secure way.

The Apono Admin MCP Server extends this capability to Apono’s Admin APIs, giving administrators a natural-language interface for managing access data and configurations:

* **Efficiency**: Retrieve and manage access data without manually querying multiple APIs
* **Security and compliance**: Administrative actions are routed through Apono’s policies and logged for auditing
* **Consistency**: The same queries and workflows are available across all supported AI tools

<figure><img src="https://1094436629-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fv6MBfUGvblSdAz31yJXm%2Fuploads%2Fgit-blob-05a7726af22efdd375fd9d0643f80ba7856851c6%2F2025-11-23%2010.02.24.gif?alt=media" alt=""><figcaption></figcaption></figure>

### Install the MCP Admin server

Apono supports the http (remote) mode to connect the AI client directly to the hosted Apono MCP endpoint.

The following sections provide setup instructions for each client.

### Install on Cursor

{% tabs %}
{% tab title="Manual" %}
Follow these steps to install the MCP Admin server:

1. In Cursor, click **Tools & MCP**. The **Tools & MCP** page appears.
2. Click **New MCP Server**. The **mcp.json** file opens in a new tab.
3. Add the following configuration to the file.

```json
{
  "mcpServers": {
    "Apono MCP": {
        "command": "npx",
        "args": [
            "mcp-remote",
            "https://mcp.apono.io",
            "--static-oauth-client-metadata",
            "{\"scope\":\"openid profile email groups\"}"
        ],
        "env": {
            "NODE_TLS_REJECT_UNAUTHORIZED": "1"
        }
    }
  }
}
```

4. Save the file.
5. Find the newly installed server and ensure the toggle is switched on.
6. Quit and restart Cursor.
   {% endtab %}
   {% endtabs %}

***

### Install on Claude

#### Connect Claude with Apono

**Prerequisite**

<table><thead><tr><th width="216.5546875">Item</th><th>Description</th></tr></thead><tbody><tr><td><strong>Owner role</strong></td><td>Organization admin account with the Owner role</td></tr></tbody></table>

**Installation**

Follow these steps to connect Claude with Apono:

1. In Claude, from the main navigation click **Admin settings > Connectors**. The **Connectors** page appears.
2. Click **Add custom connector**. The **Add custom connector** settings appear.
3. Enter a **Name** for the connector, such as *Apono Admin MCP*.
4. In the **Remote MCP Server URL** field, enter *<https://mcp.apono.io>*.
5. Click **Add**.

#### Add Apono Admin MCP to a user account

**Prerequisite**

<table><thead><tr><th width="216.5546875">Item</th><th>Description</th></tr></thead><tbody><tr><td><strong>Connector setup</strong></td><td><p>Settings enabling Claude to interact with Apono</p><p><br><a href="#connect-claude-with-apono">This must be completed</a> by an organization admin with the Owner role.</p></td></tr></tbody></table>

**Installation**

Follow these steps to add Apono Admin MCP to a user account:

1. In Claude, click **Settings > Connectors**. The **Connectors** page appears.
2. Click **Connect Apono Admin MCP**.

***

### Use the MCP server

Follow these steps to make inquiries to Apono:

1. In your AI client, open the chat or inline interface.
2. Start a conversation in your AI client to explore or manage access configurations. For example, you can list available access flows, check details for a specific bundle, or view users and groups in your Apono environment.

| Sample prompts                                                                                                                                                                     |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <ul><li>Show me all access flows with user {username}.</li><li>List all active users currently on-call via incident.io.</li><li>Which connector version is used for AWS?</li></ul> |

***

### Security notes

To use Apono safely, keep in mind how authorization and authentication work in your AI client.

#### Authorization

When you first run an Apono tool, your AI client may prompt you to authorize it. Select **Allow once** to ensure you maintain control over when and how each tool can be used.

#### Authentication

To authenticate with the Apono Admin MCP, click **Connect**. This will open a browser tab and authenticate you via SSO. You may be asked to re-authenticate periodically.

{% hint style="warning" %}
Different GPTs can behave differently.
{% endhint %}

***

### Available tools

When you use Apono through your AI client, the client communicates with the MCP server by calling specific Apono Admin MCP Server tools. Each tool maps to an API endpoint that handles a different part of the access management workflow.

The table below lists the available commands and their functions.

#### Users & Groups

<table><thead><tr><th width="215.12109375">Tool</th><th>Description</th></tr></thead><tbody><tr><td><strong>get_user</strong></td><td>Retrieve details of a specific user by ID or email</td></tr><tr><td><strong>list_users</strong></td><td>List all users with optional filtering by name, role, or source integration</td></tr><tr><td><strong>get_group</strong></td><td>Get details of a specific group by ID</td></tr><tr><td><strong>list_groups</strong></td><td>List all groups with optional filtering by name</td></tr><tr><td><strong>list_group_members</strong></td><td>Retrieve a list of access scopes</td></tr></tbody></table>

#### Access Control

<table><thead><tr><th width="215.12109375">Tool</th><th>Description</th></tr></thead><tbody><tr><td><strong>get_access_flow</strong></td><td>Retrieve details of a specific access flow</td></tr><tr><td><strong>list_access_flows</strong></td><td>List all access flows (defines what resources users can request)</td></tr><tr><td><strong>get_access_scope</strong></td><td>Get details of a specific access scope</td></tr><tr><td><strong>list_access_scopes</strong></td><td>List all access scopes</td></tr></tbody></table>

#### Bundles & Resources

<table><thead><tr><th width="215.12109375">Tool</th><th>Description</th></tr></thead><tbody><tr><td><strong>get_bundle</strong></td><td>Get details of a specific bundle</td></tr><tr><td><strong>list_bundles</strong></td><td>List all bundles available to request</td></tr></tbody></table>

#### Integrations & Connectors

<table><thead><tr><th width="215.12109375">Tool</th><th>Description</th></tr></thead><tbody><tr><td><strong>get_integration</strong></td><td>Get details of a specific integration</td></tr><tr><td><strong>list_integrations</strong></td><td>List all integrations with optional filtering by status, type, or category</td></tr><tr><td><strong>get_connector</strong></td><td>Get details of a specific connector</td></tr><tr><td><strong>list_connectors</strong></td><td>List all connectors with optional filtering by status</td></tr></tbody></table>

#### Activity & Reporting

<table><thead><tr><th width="215.12109375">Tool</th><th>Description</th></tr></thead><tbody><tr><td><strong>list_activity_reports</strong></td><td>List activity reports (insights into active/granted access)</td></tr><tr><td><strong>get_activity_report</strong></td><td>Get details of a specific activity report</td></tr></tbody></table>

#### Attributes

<table><thead><tr><th width="215.12109375">Tool</th><th>Description</th></tr></thead><tbody><tr><td><strong>list_attributes</strong></td><td>List attributes (user descriptors like group, department, etc.)</td></tr></tbody></table>