> For the complete documentation index, see [llms.txt](https://docs.apono.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.apono.io/docs/audits-and-reports/apono-admin-mcp-server.md).

# Apono Admin MCP Server

Govern and manage Apono from the AI tools you already use

The Admin MCP Server connects an AI agent such as Claude Code to your Apono account. The agent can then answer questions like *who can access the production database*, *who has active access right now*, *why was this request auto-approved*, or *who changed this access flow last week*.

The agent can also create and update access flows and bundles. It previews each change and applies it only after you confirm. The agent operates within your existing Apono permissions. Your role determines what it can view or change, and space-specific roles limit configuration changes to your [assigned spaces](https://docs.apono.io/docs/user-administration/space-management#spaces).

The Admin MCP Server provides the following benefits:

* **Efficiency**: Explore and manage access configurations without manually querying multiple APIs.
* **Secure authentication**: Connect using your organization's SSO and your individual Apono identity. Periodic reauthentication may be required.
* **Auditability**: Track administrative changes in the audit log, with your Apono identity recorded as the user and the MCP identified as the source.

{% hint style="info" %}
**Data handling**: Apono does not independently send your data to an AI model. Information returned through the MCP server is processed by the AI model used by your client.
{% endhint %}

***

### Limitations

Before configuring the Admin MCP Server, review the following limitations:

* **Automatic (auto-grant) access flows**: You cannot create or modify automatic access flows, or convert an existing access flow to automatic granting, through the Admin MCP Server.
* **Access scopes**: You can add existing access scopes to access flows, but you cannot create or modify access scopes through the Admin MCP Server. Use bundles to manage access instead.
* **Access flow or bundle deletion**: Deletion is not supported. To disable an access flow, ask your AI client to deactivate it.

***

### Prerequisites

<table><thead><tr><th width="205.2447509765625">Item</th><th>Description</th></tr></thead><tbody><tr><td><strong>MCP features enabled</strong></td><td><p>Setting that controls whether MCP features are available in your Apono account</p><p>On the <a href="https://app.apono.io/settings/account"><strong>Account Settings</strong></a> page, under <strong>AI &#x26; Automation</strong>, confirm that <strong>Enable MCP features</strong> is <strong>ON</strong>. This setting is enabled by default.</p><p>Learn more about <a href="/docs/architecture-and-security/account-settings.md#ai-and-automation">AI and Automation account settings</a>.</p></td></tr><tr><td><strong>Apono role</strong></td><td><p>Apono account with one of the following <a href="/docs/user-administration/role-based-access-control-rbac-reference.md">RBAC</a> roles:</p><ul><li>Admin</li><li>Power User</li><li>Viewer</li><li>Space Owner</li><li>Space Manager</li><li>Space Viewer</li></ul><p>The Admin MCP Server uses your existing role and space permissions. Configuration changes are available only to users with the appropriate permissions.</p></td></tr></tbody></table>

***

### Configure your AI Client

{% hint style="danger" %}
This version replaces the previous Apono Admin MCP Server (mcp.apono.io).

If you installed the previous Apono Admin MCP Server, remove it from your AI client before configuring the new endpoint.
{% endhint %}

{% tabs %}
{% tab title="Claude Code" %}
Follow these steps:

1. In a terminal, run the following command.

{% code overflow="wrap" %}

```shellscript
claude mcp add --transport http --scope user Apono-Admin https://api.apono.io/api/client/v1/admin-mcp
```

{% endcode %}

{% hint style="success" icon="lightbulb" %}
The `--scope user` makes the server available in every project. To share the configuration through your repository's **.mcp.json**, use `--scope project`.
{% endhint %}

2. Start Claude Code.
3. In Claude Code, run the following command.

{% code overflow="wrap" %}

```
/mcp
```

{% endcode %}

4. Select **Apono-Admin**.
5. Select **Authenticate**. Your browser opens the Apono sign-in page.
6. Sign in to Apono.
   {% endtab %}

{% tab title="Claude" %}
Follow these steps:

1. Follow the [Claude Help Center instructions](https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-mcp) for adding a custom connector.
2. Enter Apono Admin as the connector name.
3. Enter the following remote MCP server URL: *<https://api.apono.io/api/client/v1/admin-mcp>*
4. Sign in to Apono when prompted.
   {% endtab %}

{% tab title="Cursor" %}
**Installation link**

Follow these steps:

1. Click the following button to install the MCP Server. The **MCP** page in Cursor opens.

<a href="cursor://anysphere.cursor-deeplink/mcp/install?name=Apono-Admin&#x26;config=eyJ1cmwiOiJodHRwczovL2FwaS5hcG9uby5pby9hcGkvY2xpZW50L3YxL2FkbWluLW1jcCJ9" class="button primary">Add to Cursor</a>

***

**Configuration file**

Follow these steps:

1. In Cursor, open **Cursor Settings > Open MCPs**.
2. Select **New MCP Server**. The **\~/.cursor/mcp.json** file opens.
3. Add the following `Apono-Admin` entry.

{% code overflow="wrap" %}

```json
{
  "mcpServers": {
    "Apono-Admin": {
      "url": "https://api.apono.io/api/client/v1/admin-mcp"
    }
  }
}
```

{% endcode %}

4. Save the file.
5. On the **Open MCPs** page, click **Connect** next to **Apono-Admin**.
6. Sign in to Apono when prompted.

{% hint style="success" icon="lightbulb" %}
To enable the MCP server for a single project, add the same configuration to **.cursor/mcp.json** at the project root.
{% endhint %}
{% endtab %}

{% tab title="Codex" %}
Follow these steps:

1. In a terminal, run the following command to add the MCP server.

{% code overflow="wrap" %}

```shellscript
codex mcp add apono-admin --url https://api.apono.io/api/client/v1/admin-mcp
```

{% endcode %}

2. In a terminal, sign in to Apono.

{% code overflow="wrap" %}

```shellscript
codex mcp login apono-admin
```

{% endcode %}

3. Start Codex.
4. In Codex, run the following command.

{% code overflow="wrap" %}

```
/mcp
```

{% endcode %}

5. Confirm that **Apono-Admin** is listed.
   {% endtab %}
   {% endtabs %}

***

### Use the Admin MCP Server

Open a new chat in your AI client and ask a question about your Apono environment. What you can retrieve or change depends on your Apono role and space permissions.

#### Explore access and configurations

Use natural-language questions to investigate current and historical access, approval decisions, and access configurations. You can also explore your Apono inventory, including integrations, connectors, users, groups, resources, bundles, attributes, and access scopes.

<table><thead><tr><th width="201.994140625">Topic</th><th>Example prompt</th></tr></thead><tbody><tr><td><strong>Access rights</strong></td><td><em>Who can access the prod-payments database, and through which access flow?</em></td></tr><tr><td><strong>Active access (current or historical)</strong></td><td><em>Who has access to prod-payments now, and who had it on September 1?</em></td></tr><tr><td><strong>Access requests</strong></td><td><em>Why did john@acme.com's last request to prod-payments need approval?</em></td></tr><tr><td><strong>Access flows</strong></td><td><em>Which access flows already cover the analytics Snowflake integration?</em></td></tr><tr><td><strong>Audit log</strong></td><td><em>What changed in our access flows in the last 7 days, and who made the changes?</em></td></tr><tr><td><strong>Inventory</strong></td><td><em>Which connectors are unhealthy?</em></td></tr></tbody></table>

#### Manage access configurations

Use natural-language prompts to manage access flows and bundles.

<table><thead><tr><th width="201.994140625">Change</th><th>Example prompt</th></tr></thead><tbody><tr><td><strong>Create an access flow</strong></td><td><em>Let the data team request read access to prod-payments for 2 hours, approved by their manager.</em></td></tr><tr><td><strong>Update an access flow</strong></td><td><em>Require MFA on the prod-payments-admin flow.</em></td></tr><tr><td><strong>Deactivate an access flow</strong></td><td><em>Deactivate the legacy-billing access flow.</em></td></tr><tr><td><strong>Create a bundle</strong></td><td><em>Create a bundle with read access to all the analytics Snowflake databases.</em></td></tr><tr><td><strong>Update a bundle</strong></td><td><em>Add the reporting database to the Analytics Read bundle.</em></td></tr></tbody></table>

#### Review and apply changes

Before applying a configuration change, the AI client follows this process:

1. **Previews the proposed change**. Apono applies only changes that have been previewed. The preview summarizes who receives what access, for how long, and who approves it. It also warns if the change expands access. Nothing is saved at this stage.
2. **Requests confirmation**. The AI client asks you to confirm the proposed change or request revisions before applying it.
3. **Applies the confirmed change**. If the access flow or bundle has changed since the preview, the AI client presents an updated preview instead.

Every applied change is recorded in the audit log under your Apono identity, with the MCP identified as its source.

***

### Troubleshooting

<details>

<summary><strong>Apono tools do not appear, or every request fails.</strong></summary>

In the Apono UI, on the [**Account Settings**](https://app.apono.io/settings/account) page, confirm that **Enable MCP features** is **ON**.

</details>

<details>

<summary><strong>With a read-only role, the AI client can't create or update access flows and bundles.</strong></summary>

Your Apono role does not permit the change. Contact an Apono administrator.

</details>

<details>

<summary><strong>The change is outside your space.</strong></summary>

You can modify access flows and bundles only within spaces covered by your role.

</details>

<details>

<summary><strong>The AI client cannot configure automatic granting or create or modify an access scope.</strong></summary>

These operations are not supported through the Admin MCP Server. See [Limitations](#limitations) for details and alternatives.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.apono.io/docs/audits-and-reports/apono-admin-mcp-server.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.