Zitadel MCP Server
An MCP (Model Context Protocol) server for Zitadel identity management. Manage users, projects, applications, roles, and service accounts through natural language from AI tools like Claude Code.
"Provision jane@example.com as an Admin." — One tool call: creates the user, assigns the
adminproject role (v2 authorization), and grantsORG_USER_MANAGERso she can manage other users — no Super Admin required.
Tools (37)
| Category | Tool | Description |
|---|---|---|
| Users | zitadel_list_users |
List/search users |
zitadel_get_user |
Get user details | |
zitadel_create_user |
Create user (sends invite email; optional client-supplied userId) |
|
zitadel_deactivate_user |
Deactivate user | |
zitadel_reactivate_user |
Reactivate user | |
zitadel_lock_user |
Lock user | |
zitadel_unlock_user |
Unlock user | |
zitadel_delete_user |
Permanently delete user | |
| Projects | zitadel_list_projects |
List projects |
zitadel_get_project |
Get project details | |
zitadel_create_project |
Create project | |
| Applications | zitadel_list_apps |
List apps in a project |
zitadel_get_app |
Get app details + Client ID | |
zitadel_create_oidc_app |
Create OIDC application (incl. grantTypes / responseTypes / accessTokenType) |
|
zitadel_update_app |
Update app (redirect URIs, accessTokenType, etc.) |
|
| Roles | zitadel_list_project_roles |
List roles in a project |
zitadel_create_project_role |
Create a role (standardized: admin/standard) |
|
zitadel_list_user_grants |
List user's role grants | |
zitadel_create_user_grant |
Assign project roles (v2 authorization; flags off-vocabulary drift) | |
zitadel_remove_user_grant |
Remove role grant | |
| Org Managers | zitadel_list_org_manager_roles |
List supported manager roles (ORG_OWNER, ORG_USER_MANAGER, …) |
zitadel_list_org_managers |
List who holds manager grants (filter by role) | |
zitadel_grant_org_manager |
Grant manager role(s) (default ORG_USER_MANAGER); idempotent |
|
zitadel_revoke_org_manager |
Revoke manager role(s); guards the last ORG_OWNER |
|
| Provisioning | zitadel_provision_user |
Atomic + idempotent: create user + assign admin/standard + (for Admins) ORG_USER_MANAGER |
zitadel_offboard_user |
Remove role + revoke manager + deactivate; guards last-Admin & self-demotion | |
| Service Accounts | zitadel_create_service_user |
Create machine user |
zitadel_create_service_user_key |
Generate key pair | |
zitadel_list_service_user_keys |
List keys (metadata only) | |
| Organizations | zitadel_get_org |
Get current org details |
| Login Policy | zitadel_get_login_policy |
Get the org login policy (self-registration on/off, custom vs. inherited) |
zitadel_set_self_registration |
Enable/disable self-registration (allowRegister) for the org — idempotent. Opt-in: requires ZITADEL_ENABLE_LOGIN_POLICY_WRITE=true |
|
| Login Texts (Login V2) | zitadel_get_hosted_login_translation |
Read the new hosted-login (Login V2) text overrides for a locale — merged effective file, or onlyOverrides for this level's stored keys |
zitadel_set_hosted_login_translation |
Override Login V2 texts for a locale (Settings v2 API) — pass flat dot-path keys mirroring apps/login/locales/<locale>.json; merges onto shipped defaults, idempotent |
|
| Utility | zitadel_get_auth_config |
Get .env.local template for an app |
| Portal | portal_register_app |
Register app in portal DB |
portal_setup_full_app |
One-click: Zitadel + portal setup |
