io.fusionauth/mcp-api

NPM · @FUSIONAUTH/MCP-API · SCANNED AUG 3

Preview release of FusionAuth API MCP server

Available components

+20 this week 66 66 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security88

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (Apache-2.0).Pass
Actively maintained (last published 118 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability60

AI-judged instruction clarity (fair).Partial
Tool/resource definitions use about 22835 tokens (~73/item across 310 items; 310 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage99

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
97% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @fusionauth/mcp-api

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

# add to Codex CLI

codex mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-fusionauth-mcp-api": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@fusionauth/mcp-api"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add io-fusionauth-mcp-api --command npx --arg -y --arg @fusionauth/mcp-api

# ~/.hermes/config.yaml

mcp_servers:
  io-fusionauth-mcp-api:
    command: "npx"
    args: ["-y", "@fusionauth/mcp-api"]

// mcp.json

{
  "mcpServers": {
    "io-fusionauth-mcp-api": {
      "command": "npx",
      "args": [
        "-y",
        "@fusionauth/mcp-api"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +30
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Security disclosure: fail → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → fair ▲ functional
- Licence: Apache-2.0 functional
1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
31 Jul 26 −25
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 46

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@fusionauth/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 110 packages

110 packages in the resolved dependency tree · 109 deprecated · 32 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 310 exposed · ~22,835 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

actionUserWithId ~65

Takes an action on a user. The user being actioned is called the "actionee" and the user taking the action is called the "actioner". Both user ids are required in the request object.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The user action request object.

No output schema declared.

No examples provided.

activateReactorWithId ~49

Activates the FusionAuth Reactor using a license Id and optionally a license text (for air-gapped deployments)

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Request for managing FusionAuth Reactor and licenses.

No output schema declared.

No examples provided.

approveDeviceWithId ~16

Approve a device grant.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

cancelActionWithId ~45

Cancels the user action.

Input Output Examples

Name	Type	Req	Description
actionId	string	yes	The action Id of the action to cancel.
requestBody	object	—	The user action request object.

No output schema declared.

No examples provided.

changePasswordWithId ~129

Changes a user's password using the change password Id. This usually occurs after an email has been sent to the user and they clicked on a link to reset their password. As of version 1.32.2, prefer sending the changePasswordId in the request body. To do this, omit the first parameter, and set the value in the request body.

Input Output Examples

Name	Type	Req	Description
changePasswordId	string	yes	The change password Id used to find the user. This value is generated by FusionAuth once the change password workflow has been initiated.
requestBody	object	—	Change password request object.

No output schema declared.

No examples provided.

checkChangePasswordUsingIdWithId ~144

Check to see if the user must obtain a Trust Token Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication. An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.

Input Output Examples

Name	Type	Req	Description
changePasswordId	string	yes	The change password Id used to find the user. This value is generated by FusionAuth once the change password workflow has been initiated.

No output schema declared.

No examples provided.

commentOnUserWithId ~75

Adds a comment to the user's account.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

completeVerifyIdentityWithId ~39

Completes verification of an identity using verification codes from the Verify Start API.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Verify Complete API request object.

No output schema declared.

No examples provided.

completeWebAuthnAssertionWithId ~52

Complete a WebAuthn authentication ceremony by validating the signature against the previously generated challenge without logging the user in

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Request to complete the WebAuthn registration ceremony

No output schema declared.

No examples provided.

completeWebAuthnLoginWithId ~53

Complete a WebAuthn authentication ceremony by validating the signature against the previously generated challenge and then login the user in

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Request to complete the WebAuthn registration ceremony

No output schema declared.

No examples provided.

completeWebAuthnRegistrationWithId ~53

Complete a WebAuthn registration ceremony by validating the client request and saving the new credential

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Request to complete the WebAuthn registration ceremony for a new credential,.

No output schema declared.

No examples provided.

createAPIKey ~98

Creates an API key. You can optionally specify a unique Id for the key, if not provided one will be generated. an API key can only be created with equal or lesser authority. An API key cannot create another API key unless it is granted to that API key. If an API key is locked to a tenant, it can only create API Keys for that same tenant.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Authentication key request object.

No output schema declared.

No examples provided.

createAPIKeyWithId ~126

Input Output Examples

Name	Type	Req	Description
keyId	string	yes	The unique Id of the API key. If not provided a secure random Id will be generated.
requestBody	object	—	Authentication key request object.

No output schema declared.

No examples provided.

createApplication ~87

Creates an application. You can optionally specify an Id for the application, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	The Application API request object.

No output schema declared.

No examples provided.

createApplicationRole ~131

Creates a new role for an application. You must specify the Id of the application you are creating the role for. You can optionally specify an Id for the role inside the ApplicationRole object itself, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application to create the role on.
requestBody	object	—	The Application API request object.

No output schema declared.

No examples provided.

createApplicationRoleWithId ~157

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application to create the role on.
requestBody	object	—	The Application API request object.
roleId	string	yes	The Id of the role. If not provided a secure random UUID will be generated.

No output schema declared.

No examples provided.

createApplicationWithId ~115

Creates an application. You can optionally specify an Id for the application, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id to use for the application. If not provided a secure random UUID will be generated.
requestBody	object	—	The Application API request object.

No output schema declared.

No examples provided.

createAuditLogWithId ~89

Creates an audit log with the message and user name (usually an email). Audit logs should be written anytime you make changes to the FusionAuth database. When using the FusionAuth App web interface, any changes are automatically written to the audit log. However, if you are accessing the API, you must write the audit logs yourself.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

createConnector ~43

Creates a connector. You can optionally specify an Id for the connector, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

createConnectorWithId ~69

Creates a connector. You can optionally specify an Id for the connector, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
connectorId	string	yes	The Id for the connector. If not provided a secure random UUID will be generated.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

createConsent ~91

Creates a user consent type. You can optionally specify an Id for the consent type, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	API request for User consent types.

No output schema declared.

No examples provided.

createConsentWithId ~117

Creates a user consent type. You can optionally specify an Id for the consent type, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
consentId	string	yes	The Id for the consent. If not provided a secure random UUID will be generated.
requestBody	object	—	API request for User consent types.

No output schema declared.

No examples provided.

createEmailTemplate ~87

Creates an email template. You can optionally specify an Id for the template, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Email template request.

No output schema declared.

No examples provided.

createEmailTemplateWithId ~114

Creates an email template. You can optionally specify an Id for the template, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
emailTemplateId	string	yes	The Id for the template. If not provided a secure random UUID will be generated.
requestBody	object	—	Email template request.

No output schema declared.

No examples provided.

createEntity ~86

Creates an Entity. You can optionally specify an Id for the Entity. If not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Entity API request object.

No output schema declared.

No examples provided.

createEntityType ~46

Creates a Entity Type. You can optionally specify an Id for the Entity Type, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Entity Type API request object.

No output schema declared.

No examples provided.

createEntityTypePermission ~93

Creates a new permission for an entity type. You must specify the Id of the entity type you are creating the permission for. You can optionally specify an Id for the permission inside the EntityTypePermission object itself, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
entityTypeId	string	yes	The Id of the entity type to create the permission on.
requestBody	object	—	Entity Type API request object.

No output schema declared.

No examples provided.

createEntityTypePermissionWithId ~119

Input Output Examples

Name	Type	Req	Description
entityTypeId	string	yes	The Id of the entity type to create the permission on.
permissionId	string	yes	The Id of the permission. If not provided a secure random UUID will be generated.
requestBody	object	—	Entity Type API request object.

No output schema declared.

No examples provided.

createEntityTypeWithId ~74

Creates a Entity Type. You can optionally specify an Id for the Entity Type, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
entityTypeId	string	yes	The Id for the Entity Type. If not provided a secure random UUID will be generated.
requestBody	object	—	Entity Type API request object.

No output schema declared.

No examples provided.

createEntityWithId ~112

Creates an Entity. You can optionally specify an Id for the Entity. If not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
entityId	string	yes	The Id for the Entity. If not provided a secure random UUID will be generated.
requestBody	object	—	Entity API request object.

No output schema declared.

No examples provided.

createFamily ~105

Creates a family with the user Id in the request as the owner and sole member of the family. You can optionally specify an Id for the family, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	API request for managing families and members.

No output schema declared.

No examples provided.

createFamilyWithId ~131

Creates a family with the user Id in the request as the owner and sole member of the family. You can optionally specify an Id for the family, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
familyId	string	yes	The Id for the family. If not provided a secure random UUID will be generated.
requestBody	object	—	API request for managing families and members.

No output schema declared.

No examples provided.

createForm ~41

Creates a form. You can optionally specify an Id for the form, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Form response.

No output schema declared.

No examples provided.

createFormField ~47

Creates a form field. You can optionally specify an Id for the form, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The FormField API request object.

No output schema declared.

No examples provided.

createFormFieldWithId ~74

Creates a form field. You can optionally specify an Id for the form, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
fieldId	string	yes	The Id for the form field. If not provided a secure random UUID will be generated.
requestBody	object	—	The FormField API request object.

No output schema declared.

No examples provided.

createFormWithId ~67

Creates a form. You can optionally specify an Id for the form, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
formId	string	yes	The Id for the form. If not provided a secure random UUID will be generated.
requestBody	object	—	Form response.

No output schema declared.

No examples provided.

createGroup ~86

Creates a group. You can optionally specify an Id for the group, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Group API request object.

No output schema declared.

No examples provided.

createGroupMembersWithId ~29

Creates a member in a group.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Group Member Request

No output schema declared.

No examples provided.

createGroupWithId ~112

Creates a group. You can optionally specify an Id for the group, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
groupId	string	yes	The Id for the group. If not provided a secure random UUID will be generated.
requestBody	object	—	Group API request object.

No output schema declared.

No examples provided.

createIdentityProvider ~45

Creates an identity provider. You can optionally specify an Id for the identity provider, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

createIdentityProviderWithId ~73

Creates an identity provider. You can optionally specify an Id for the identity provider, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
identityProviderId	string	yes	The Id of the identity provider. If not provided a secure random UUID will be generated.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

createIntrospect ~58

Inspect an access token issued as the result of the Client Credentials Grant. OR Inspect an access token issued as the result of the User based grant such as the Authorization Code Grant, Implicit Grant, the User Credentials Grant or the Refresh Grant.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

createIPAccessControlList ~51

Creates an IP Access Control List. You can optionally specify an Id on this create request, if one is not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

createIPAccessControlListWithId ~82

Creates an IP Access Control List. You can optionally specify an Id on this create request, if one is not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
accessControlListId	string	yes	The Id for the IP Access Control List. If not provided a secure random UUID will be generated.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

createLambda ~42

Creates a Lambda. You can optionally specify an Id for the lambda, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Lambda API request object.

No output schema declared.

No examples provided.

createLambdaWithId ~68

Creates a Lambda. You can optionally specify an Id for the lambda, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
lambdaId	string	yes	The Id for the lambda. If not provided a secure random UUID will be generated.
requestBody	object	—	Lambda API request object.

No output schema declared.

No examples provided.

createLogout ~181

The Logout API is intended to be used to remove the refresh token and access token cookies if they exist on the client and revoke the refresh token stored. This API takes the refresh token in the JSON body. OR The Logout API is intended to be used to remove the refresh token and access token cookies if they exist on the client and revoke the refresh token stored. This API does nothing if the request does not contain an access token or refresh token cookies.

Input Output Examples

Name	Type	Req	Description
global	string	—	When this value is set to true all the refresh tokens issued to the owner of the provided token will be revoked.
refreshToken	string	—	The refresh_token as a request parameter instead of coming in via a cookie. If provided this takes precedence over the cookie.
requestBody	object	—	Request for the Logout API that can be used as an alternative to URL parameters.

No output schema declared.

No examples provided.

createMessageTemplate ~47

Creates an message template. You can optionally specify an Id for the template, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	A Message Template Request to the API

No output schema declared.

No examples provided.

createMessageTemplateWithId ~74

Creates an message template. You can optionally specify an Id for the template, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
messageTemplateId	string	yes	The Id for the template. If not provided a secure random UUID will be generated.
requestBody	object	—	A Message Template Request to the API

No output schema declared.

No examples provided.

createMessenger ~43

Creates a messenger. You can optionally specify an Id for the messenger, if not provided one will be generated.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug