MCP server/cloud

Zitadel MCP Server

Enables faster, cleaner integration with Zitadel for user authentication.

★ 10takleb3rry/zitadel-mcp ↗by takleb3rryupdated
Manual setup required. The maintainer's config contains paths only you know - edit the placeholders below before adding it to Claude Code.
1

Prepare the server locally

Run this once before adding it to Claude Code.

git clone https://github.com/takleb3rry/zitadel-mcp.git
cd zitadel-mcp
npm install
npm run build
2

Register it in Claude Code

claude mcp add -e "ZITADEL_ISSUER=${ZITADEL_ISSUER}" -e "ZITADEL_SERVICE_ACCOUNT_USER_ID=${ZITADEL_SERVICE_ACCOUNT_USER_ID}" -e "ZITADEL_SERVICE_ACCOUNT_KEY_ID=${ZITADEL_SERVICE_ACCOUNT_KEY_ID}" -e "ZITADEL_SERVICE_ACCOUNT_PRIVATE_KEY=${ZITADEL_SERVICE_ACCOUNT_PRIVATE_KEY}" -e "ZITADEL_ORG_ID=${ZITADEL_ORG_ID}" zitadel-mcp -- node /path/to/zitadel-mcp/build/index.js

Replace any placeholder paths in the command with the real path on your machine.

Required:ZITADEL_ISSUERZITADEL_SERVICE_ACCOUNT_USER_IDZITADEL_SERVICE_ACCOUNT_KEY_IDZITADEL_SERVICE_ACCOUNT_PRIVATE_KEYZITADEL_ORG_ID+ 3 optional
3

Make your agent remember this setup

zitadel-mcp's config, env vars, and the gotchas you hit — recalled in every future Claude Code, Cursor, and Codex session. 

npx conare@latest

Free · one command · indexes the sessions already on disk. Set up in the browser instead →

What it does

  • Manage users, projects, and applications via natural language.
  • Automate role assignment and user grant management.
  • Generate authentication configuration templates for applications.
  • Support for service account and machine user management.
  • Optional portal database integration for one-click setup.

Tools 25

zitadel_list_usersList or search for users in the Zitadel instance.
zitadel_get_userRetrieve detailed information about a specific user.
zitadel_create_userCreate a new user and send an invite email.
zitadel_deactivate_userDeactivate an existing user account.
zitadel_reactivate_userReactivate a previously deactivated user account.
zitadel_list_projectsList all projects within the organization.
zitadel_get_projectGet detailed information about a specific project.
zitadel_create_projectCreate a new project.
zitadel_list_appsList all applications within a specific project.
zitadel_get_appGet application details including the Client ID.
zitadel_create_oidc_appCreate a new OIDC application.
zitadel_update_appUpdate application settings such as redirect URIs.
zitadel_list_project_rolesList all roles defined within a project.
zitadel_create_project_roleCreate a new role within a project.
zitadel_list_user_grantsList all role grants assigned to a user.
zitadel_create_user_grantAssign specific roles to a user.
zitadel_remove_user_grantRemove a role grant from a user.
zitadel_create_service_userCreate a new machine/service user.
zitadel_create_service_user_keyGenerate a new key pair for a service user.
zitadel_list_service_user_keysList metadata for service user keys.
zitadel_get_orgGet details for the current organization.
zitadel_list_orgsList all organizations available.
zitadel_get_auth_configGenerate a .env.local template for an application.
portal_register_appRegister an application in the portal database.
portal_setup_full_appPerform a one-click setup for Zitadel and portal integration.

Environment Variables

ZITADEL_ISSUERrequiredZitadel instance URL
ZITADEL_SERVICE_ACCOUNT_USER_IDrequiredService account user ID
ZITADEL_SERVICE_ACCOUNT_KEY_IDrequiredKey ID from the JSON key file
ZITADEL_SERVICE_ACCOUNT_PRIVATE_KEYrequiredBase64-encoded RSA private key
ZITADEL_ORG_IDrequiredOrganization ID
ZITADEL_PROJECT_IDDefault project ID for role operations
PORTAL_DATABASE_URLPostgres connection string for portal tools
LOG_LEVELLogging level (DEBUG, INFO, WARN, ERROR)

Try it

→Create a new user for [email protected] and assign her the app:finance role.
→List all applications in my current project and give me their client IDs.
→Generate a .env.local template for the finance-app.
→Create a new OIDC application for my project and show me the configuration details.
Original README from takleb3rry/zitadel-mcp

Zitadel MCP Server

An MCP (Model Context Protocol) server for Zitadel identity management. Manage users, projects, applications, roles, and service accounts through natural language from AI tools like Claude Code.

"Create a user for [email protected], assign her the app:finance role, and give me the auth config." — That's three tool calls the AI handles for you.

Tools (25)

Category Tool Description
Users zitadel_list_users List/search users
zitadel_get_user Get user details
zitadel_create_user Create user (sends invite email)
zitadel_deactivate_user Deactivate user
zitadel_reactivate_user Reactivate user
Projects zitadel_list_projects List projects
zitadel_get_project Get project details
zitadel_create_project Create project
Applications zitadel_list_apps List apps in a project
zitadel_get_app Get app details + Client ID
zitadel_create_oidc_app Create OIDC application
zitadel_update_app Update app (redirect URIs, etc.)
Roles zitadel_list_project_roles List roles in a project
zitadel_create_project_role Create a role (e.g., app:finance)
zitadel_list_user_grants List user's role grants
zitadel_create_user_grant Assign roles to user
zitadel_remove_user_grant Remove role grant
Service Accounts zitadel_create_service_user Create machine user
zitadel_create_service_user_key Generate key pair
zitadel_list_service_user_keys List keys (metadata only)
Organizations zitadel_get_org Get current org details
zitadel_list_orgs List organizations
Utility zitadel_get_auth_config Get .env.local template for an app
Portal portal_register_app Register app in portal DB
portal_setup_full_app One-click: Zitadel + portal setup

Portal tools (portal_*) are only available when PORTAL_DATABASE_URL is configured.

Prerequisites

  1. A Zitadel instance (Cloud or self-hosted)
  2. A service account with Org Owner or IAM Admin role
  3. A JSON key for the service account

Creating a Service Account

  1. In the Zitadel Console, go to Users > Service Users > New
  2. Give it a name (e.g., mcp-admin) and select Bearer token type
  3. Go to the service user's Keys tab > New > JSON
  4. Save the downloaded key file — you'll need the userId, keyId, and base64-encoded key
  5. Grant the service account the Org Owner role under Organization > Authorizations

Setup

git clone https://github.com/takleb3rry/zitadel-mcp.git
cd zitadel-mcp
npm install
npm run build

Configuration

Add the server to your MCP client config. The JSON block below works for both options:

  • Global (all projects): ~/.claude.json under the "mcpServers" key
  • Per-project: .mcp.json in the project root
{
  "mcpServers": {
    "zitadel": {
      "command": "node",
      "args": ["/path/to/zitadel-mcp/build/index.js"],
      "env": {
        "ZITADEL_ISSUER": "https://your-instance.zitadel.cloud",
        "ZITADEL_SERVICE_ACCOUNT_USER_ID": "...",
        "ZITADEL_SERVICE_ACCOUNT_KEY_ID": "...",
        "ZITADEL_SERVICE_ACCOUNT_PRIVATE_KEY": "...",
        "ZITADEL_ORG_ID": "...",
        "ZITADEL_PROJECT_ID": "..."
      }
    }
  }
}

Restart Claude Code after adding the config. The Zitadel tools will appear automatically.

Environment Variables

Variable Required Description
ZITADEL_ISSUER Yes Zitadel instance URL
ZITADEL_SERVICE_ACCOUNT_USER_ID Yes Service account user ID
ZITADEL_SERVICE_ACCOUNT_KEY_ID Yes Key ID from the JSON key file
ZITADEL_SERVICE_ACCOUNT_PRIVATE_KEY Yes Base64-encoded RSA private key (the key field from the downloaded JSON)
ZITADEL_ORG_ID Yes Organization ID
ZITADEL_PROJECT_ID No Default project ID for role operations
PORTAL_DATABASE_URL No Postgres connection string (enables portal tools)
LOG_LEVEL No DEBUG, INFO, WARN, ERROR (default: INFO)

Security

This server has admin-level access to your Zitadel instance. Understand what that means before using it:

  • The service account needs Org Owner (or IAM Admin for zitadel_list_orgs). It can create users, modify roles, and manage applications in your organization.
  • When you create an OIDC app (zitadel_create_oidc_app), the client secret is returned in the tool response. It is only available at creation time. The AI assistant (and its conversation history) will see it — save it immediately and treat it as sensitive.
  • When you generate a service acc

Frequently Asked Questions

What are the key features of Zitadel MCP?

Manage users, projects, and applications via natural language.. Automate role assignment and user grant management.. Generate authentication configuration templates for applications.. Support for service account and machine user management.. Optional portal database integration for one-click setup..

What can I use Zitadel MCP for?

Onboarding new team members by creating users and assigning roles automatically.. Quickly generating OIDC application credentials for new microservices.. Auditing user permissions and role grants across projects.. Streamlining local development setup by generating .env files directly from Zitadel config..

How do I install Zitadel MCP?

Install Zitadel MCP by running: git clone https://github.com/takleb3rry/zitadel-mcp.git && cd zitadel-mcp && npm install && npm run build

What MCP clients work with Zitadel MCP?

Zitadel MCP works with any MCP-compatible client including Claude Desktop, Claude Code, Cursor, and other editors with MCP support.

Conare · memory for coding agents

Turn this server into reusable context

Keep Zitadel MCP docs, env vars, and workflow notes in Conare so your agent carries them across sessions.

Set up free$npx conare@latest

Related MCP Servers

SSH MCP Server
Execute shell commands on remote Linux and Windows systems via SSH.
cloud655 stars
Remnawave MCP
Manage Remnawave VPN panels with 51 specialized tools for administration.
cloud86 stars
Hono MCP Server
Expose your Hono API endpoints as MCP tools.
cloud86 stars
n8n Manager for AI Agents
Manage n8n workflow automation instances through AI agent tools.
cloud62 stars
App Store Connect MCP
A Model Context Protocol server for the App Store Connect API.
cloud61 stars
Kilntainers
Give Every Agent an Ephemeral Linux Sandbox — via MCP
cloud50 stars