io.fusionauth/mcp-api
NPM · @FUSIONAUTH/MCP-API · SCANNED SEP 24
Preview release of FusionAuth API MCP server
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 34 of 111 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 170 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability67
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 22835 tokens (~73/item across 310 items; 310 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 97% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 44 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "deleteAPIKeyWithId" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 310 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.fusionauth/mcp-api server?
io.fusionauth/mcp-api runs locally as an npm package, launched with npx -y @fusionauth/mcp-api. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @fusionauth/mcp-api
claude mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api
{
"mcpServers": {
"io-fusionauth-mcp-api": {
"command": "npx",
"args": [
"-y",
"@fusionauth/mcp-api"
]
}
}
} {
"servers": {
"io-fusionauth-mcp-api": {
"command": "npx",
"args": [
"-y",
"@fusionauth/mcp-api"
]
}
}
} codex mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"io-fusionauth-mcp-api": {
"type": "local",
"command": [
"npx",
"-y",
"@fusionauth/mcp-api"
],
"enabled": true
}
}
} openclaw mcp add io-fusionauth-mcp-api --command npx --arg -y --arg @fusionauth/mcp-api
mcp_servers:
io-fusionauth-mcp-api:
command: "npx"
args: ["-y", "@fusionauth/mcp-api"] {
"McpServers": {
"io-fusionauth-mcp-api": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@fusionauth/mcp-api"
]
}
}
} assistant mcp add io-fusionauth-mcp-api -t stdio -c npx -a -y @fusionauth/mcp-api
{
"mcpServers": {
"io-fusionauth-mcp-api": {
"command": "npx",
"args": [
"-y",
"@fusionauth/mcp-api"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 23 Sept 26 −3
- Stability: pass → 0.80 functional
- 22 Sept 26 +1
- Stability: 0.97 → pass security
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 +1
- Stability: 0.97 → pass security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Analysed npm/@fusionauth/mcp-api@0.1.14
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 111 packages
| Packages resolved | 111 |
|---|---|
| Stale | 34 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
createMessengerWithId ~69
Creates a messenger. You can optionally specify an Id for the messenger, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| messengerId | string | yes | The Id for the messenger. If not provided a secure random UUID will be generated. |
| requestBody | object | – | The JSON request body. |
No output schema declared.
No examples provided.
createOAuthScope ~133
Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creating the scope for. You can optionally specify an Id for the OAuth scope on the URL, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| applicationId | string | yes | The Id of the application to create the OAuth scope on. |
| requestBody | object | – | The Application Scope API request object. |
No output schema declared.
No examples provided.
createOAuthScopeWithId ~160
Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creating the scope for. You can optionally specify an Id for the OAuth scope on the URL, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| applicationId | string | yes | The Id of the application to create the OAuth scope on. |
| requestBody | object | – | The Application Scope API request object. |
| scopeId | string | yes | The Id of the OAuth scope. If not provided a secure random UUID will be generated. |
No output schema declared.
No examples provided.
createTenant ~86
Creates a tenant. You can optionally specify an Id for the tenant, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| requestBody | object | – | The JSON request body. |
No output schema declared.
No examples provided.
createTenantWithId ~112
Creates a tenant. You can optionally specify an Id for the tenant, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| requestBody | object | – | The JSON request body. |
| tenantId | string | yes | The Id for the tenant. If not provided a secure random UUID will be generated. |
No output schema declared.
No examples provided.
createTheme ~42
Creates a Theme. You can optionally specify an Id for the theme, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Theme API request object. |
No output schema declared.
No examples provided.
createThemeWithId ~68
Creates a Theme. You can optionally specify an Id for the theme, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Theme API request object. |
| themeId | string | yes | The Id for the theme. If not provided a secure random UUID will be generated. |
No output schema declared.
No examples provided.
createToken ~180
Exchange User Credentials for a Token. If you will be using the Resource Owner Password Credential Grant, you will make a request to the Token endpoint to exchange the user’s email and password for an access token. OR Exchange a Refresh Token for an Access Token. If you will be using the Refresh Token Grant, you will make a request to the Token endpoint to exchange the user’s refresh token for an access token. OR Exchanges an OAuth authorization code and code_verifier for an access token. Makes a request to the Token endpoint to exchange the authorization code returned from the Authorize endpoint and a code_verifier for an access token. OR Exchanges an OAuth authorization code for an access token. Makes a request to the Token endpoint to exchange the authorization code returned from the Authorize endpoint for an access token. OR Make a Client Credentials grant request to obtain an access token.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
createUser ~86
Creates a user. You can optionally specify an Id for the user, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| requestBody | object | – | User API request object. |
No output schema declared.
No examples provided.
createUserAction ~98
Creates a user action. This action cannot be taken on a user until this call successfully returns. Anytime after that the user action can be applied to any user.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| requestBody | object | – | User Action API request object. |
No output schema declared.
No examples provided.
createUserActionReason ~58
Creates a user reason. This user action reason cannot be used when actioning a user until this call completes successfully. Anytime after that the user action reason can be used.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | User Action Reason API request object. |
No output schema declared.
No examples provided.
createUserActionReasonWithId ~88
Creates a user reason. This user action reason cannot be used when actioning a user until this call completes successfully. Anytime after that the user action reason can be used.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | User Action Reason API request object. |
| userActionReasonId | string | yes | The Id for the user action reason. If not provided a secure random UUID will be generated. |
No output schema declared.
No examples provided.
createUserActionWithId ~126
Creates a user action. This action cannot be taken on a user until this call successfully returns. Anytime after that the user action can be applied to any user.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| requestBody | object | – | User Action API request object. |
| userActionId | string | yes | The Id for the user action. If not provided a secure random UUID will be generated. |
No output schema declared.
No examples provided.
createUserChangePassword ~135
Changes a user's password using their access token (JWT) instead of the changePasswordId A common use case for this method will be if you want to allow the user to change their own password. Remember to send refreshToken in the request body if you want to get a new refresh token when login using the returned oneTimePassword. OR Changes a user's password using their identity (loginId and password). Using a loginId instead of the changePasswordId bypasses the email verification and allows a password to be changed directly without first calling the #forgotPassword method.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Change password request object. |
No output schema declared.
No examples provided.
createUserConsent ~28
Creates a single User consent.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | API response for User consent. |
No output schema declared.
No examples provided.
createUserConsentWithId ~56
Creates a single User consent.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | API response for User consent. |
| userConsentId | string | yes | The Id for the User consent. If not provided a secure random UUID will be generated. |
No output schema declared.
No examples provided.
createUserLinkWithId ~41
Link an external user from a 3rd party identity provider to a FusionAuth user.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | The JSON request body. |
No output schema declared.
No examples provided.
createUserVerifyEmail ~182
Administratively verify a user's email address. Use this method to bypass email verification for the user. The request body will contain the userId to be verified. An API key is required when sending the userId in the request body. OR Confirms a user's email address. The request body will contain the verificationId. You may also be required to send a one-time use code based upon your configuration. When the tenant is configured to gate a user until their email address is verified, this procedures requires two values instead of one. The verificationId is a high entropy value and the one-time use code is a low entropy value that is easily entered in a user interactive form. The two values together are able to confirm a user's email address and mark the user's email address as verified.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | The JSON request body. |
No output schema declared.
No examples provided.
createUserWithId ~112
Creates a user. You can optionally specify an Id for the user, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| requestBody | object | – | User API request object. |
| userId | string | yes | The Id for the user. If not provided a secure random UUID will be generated. |
No output schema declared.
No examples provided.
createWebhook ~43
Creates a webhook. You can optionally specify an Id for the webhook, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Webhook API request object. |
No output schema declared.
No examples provided.
createWebhookWithId ~69
Creates a webhook. You can optionally specify an Id for the webhook, if not provided one will be generated.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Webhook API request object. |
| webhookId | string | yes | The Id for the webhook. If not provided a secure random UUID will be generated. |
No output schema declared.
No examples provided.
deleteAPIKeyWithId ~37
Deletes the API key for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| keyId | string | yes | The Id of the authentication API key to delete. |
No output schema declared.
No examples provided.
deleteApplicationRoleWithId ~121
Hard deletes an application role. This is a dangerous operation and should not be used in most circumstances. This permanently removes the given role from all users that had it.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| applicationId | string | yes | The Id of the application that the role belongs to. |
| roleId | string | yes | The Id of the role to delete. |
No output schema declared.
No examples provided.
deleteApplicationWithId ~161
Hard deletes an application. This is a dangerous operation and should not be used in most circumstances. This will delete the application, any registrations for that application, metrics and reports for the application, all the roles for the application, and any other data associated with the application. This operation could take a very long time, depending on the amount of data in your database. OR Deactivates the application with the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| applicationId | string | yes | The Id of the application to delete. |
| hardDelete | string | – | – |
No output schema declared.
No examples provided.
deleteConnectorWithId ~33
Deletes the connector for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| connectorId | string | yes | The Id of the connector to delete. |
No output schema declared.
No examples provided.
deleteConsentWithId ~77
Deletes the consent for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| consentId | string | yes | The Id of the consent to delete. |
No output schema declared.
No examples provided.
deleteEmailTemplateWithId ~81
Deletes the email template for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| emailTemplateId | string | yes | The Id of the email template to delete. |
No output schema declared.
No examples provided.
deleteEntityGrantWithId ~126
Deletes an Entity Grant for the given User or Entity.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| entityId | string | yes | The Id of the Entity that the Entity Grant is being deleted for. |
| recipientEntityId | string | – | The Id of the Entity that the Entity Grant is for. |
| userId | string | – | The Id of the User that the Entity Grant is for. |
No output schema declared.
No examples provided.
deleteEntityTypePermissionWithId ~79
Hard deletes a permission. This is a dangerous operation and should not be used in most circumstances. This permanently removes the given permission from all grants that had it.
| Name | Type | Req | Description |
|---|---|---|---|
| entityTypeId | string | yes | The Id of the entityType the the permission belongs to. |
| permissionId | string | yes | The Id of the permission to delete. |
No output schema declared.
No examples provided.
deleteEntityTypeWithId ~37
Deletes the Entity Type for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| entityTypeId | string | yes | The Id of the Entity Type to delete. |
No output schema declared.
No examples provided.
deleteEntityWithId ~77
Deletes the Entity for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| entityId | string | yes | The Id of the Entity to delete. |
No output schema declared.
No examples provided.
deleteFormFieldWithId ~36
Deletes the form field for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| fieldId | string | yes | The Id of the form field to delete. |
No output schema declared.
No examples provided.
deleteFormWithId ~33
Deletes the form for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| formId | string | yes | The Id of the form to delete. |
No output schema declared.
No examples provided.
deleteGroupMembersWithId ~31
Removes users as members of a group.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Group Member Delete Request |
No output schema declared.
No examples provided.
deleteGroupWithId ~77
Deletes the group for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| groupId | string | yes | The Id of the group to delete. |
No output schema declared.
No examples provided.
deleteIdentityProviderWithId ~37
Deletes the identity provider for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| identityProviderId | string | yes | The Id of the identity provider to delete. |
No output schema declared.
No examples provided.
deleteIPAccessControlListWithId ~45
Deletes the IP Access Control List for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| ipAccessControlListId | string | yes | The Id of the IP Access Control List to delete. |
No output schema declared.
No examples provided.
deleteJwtRefresh ~413
Revokes refresh tokens using the information in the JSON body. The handling for this method is the same as the revokeRefreshToken method and is based on the information you provide in the RefreshDeleteRequest object. See that method for additional information. OR Revoke all refresh tokens that belong to a user by user Id for a specific application by applicationId. OR Revoke all refresh tokens that belong to a user by user Id. OR Revoke all refresh tokens that belong to an application by applicationId. OR Revokes a single refresh token by using the actual refresh token value. This refresh token value is sensitive, so be careful with this API request. OR Revokes refresh tokens. Usage examples: - Delete a single refresh token, pass in only the token. revokeRefreshToken(token) - Delete all refresh tokens for a user, pass in only the userId. revokeRefreshToken(null, userId) - Delete all refresh tokens for a user for a specific application, pass in both the userId and the applicationId. revokeRefreshToken(null, userId, applicationId) - Delete all refresh tokens for an application revokeRefreshToken(null, null, applicationId) Note: <code>null</code> may be handled differently depending upon the programming language. See also: (method names may vary by language... but you'll figure it out) - revokeRefreshTokenById - revokeRefreshTokenByToken - revokeRefreshTokensByUserId - revokeRefreshTokensByApplicationId - revokeRefreshTokensByUserIdForApplication
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | – | The unique Id of the application that you want to delete refresh tokens for. |
| requestBody | object | – | Request for the Refresh Token API to revoke a refresh token rather than using the URL parameters. |
| token | string | – | The refresh token to delete. |
| userId | string | – | The unique Id of the user that you want to delete all refresh tokens for. |
No output schema declared.
No examples provided.
deleteKeyWithId ~33
Deletes the key for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| keyId | string | yes | The Id of the key to delete. |
No output schema declared.
No examples provided.
deleteLambdaWithId ~33
Deletes the lambda for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| lambdaId | string | yes | The Id of the lambda to delete. |
No output schema declared.
No examples provided.
deleteMessageTemplateWithId ~37
Deletes the message template for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| messageTemplateId | string | yes | The Id of the message template to delete. |
No output schema declared.
No examples provided.
deleteMessengerWithId ~33
Deletes the messenger for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| messengerId | string | yes | The Id of the messenger to delete. |
No output schema declared.
No examples provided.
deleteOAuthScopeWithId ~117
Hard deletes a custom OAuth scope. OAuth workflows that are still requesting the deleted OAuth scope may fail depending on the application's unknown scope policy.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| applicationId | string | yes | The Id of the application that the OAuth scope belongs to. |
| scopeId | string | yes | The Id of the OAuth scope to delete. |
No output schema declared.
No examples provided.
deleteTenantWithId ~210
Deletes the tenant based on the given request (sent to the API as JSON). This permanently deletes all information, metrics, reports and data associated with the tenant and everything under the tenant (applications, users, etc). OR Deletes the tenant for the given Id asynchronously. This method is helpful if you do not want to wait for the delete operation to complete. OR Deletes the tenant based on the given Id on the URL. This permanently deletes all information, metrics, reports and data associated with the tenant and everything under the tenant (applications, users, etc).
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| async | string | – | – |
| requestBody | object | – | Request for the Tenant API to delete a tenant rather than using the URL parameters. |
| tenantId | string | yes | The Id of the tenant to delete. |
No output schema declared.
No examples provided.
deleteThemeWithId ~33
Deletes the theme for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| themeId | string | yes | The Id of the theme to delete. |
No output schema declared.
No examples provided.
deleteUserActionReasonWithId ~41
Deletes the user action reason for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| userActionReasonId | string | yes | The Id of the user action reason to delete. |
No output schema declared.
No examples provided.
deleteUserActionWithId ~122
Deletes the user action for the given Id. This permanently deletes the user action and also any history and logs of the action being applied to any users. OR Deactivates the user action with the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| hardDelete | string | – | – |
| userActionId | string | yes | The Id of the user action to delete. |
No output schema declared.
No examples provided.
deleteUserBulk ~164
Deletes the users with the given Ids, or users matching the provided JSON query or queryString. The order of preference is Ids, query and then queryString, it is recommended to only provide one of the three for the request. This method can be used to deactivate or permanently delete (hard-delete) users based upon the hardDelete boolean in the request body. Using the dryRun parameter you may also request the result of the action without actually deleting or deactivating any users. OR Deactivates the users with the given Ids.
| Name | Type | Req | Description |
|---|---|---|---|
| dryRun | string | – | – |
| hardDelete | string | – | – |
| requestBody | object | – | User API delete request object. |
| userIds | string | – | The ids of the users to deactivate. |
No output schema declared.
No examples provided.
deleteUserLinkWithId ~93
Remove an existing link that has been made from a 3rd party identity provider to a FusionAuth user.
| Name | Type | Req | Description |
|---|---|---|---|
| identityProviderId | string | – | The unique Id of the identity provider. |
| identityProviderUserId | string | – | The unique Id of the user in the 3rd party identity provider to unlink. |
| userId | string | – | The unique Id of the FusionAuth user to unlink. |
No output schema declared.
No examples provided.
deleteUserRegistrationWithId ~138
Deletes the user registration for the given user and application along with the given JSON body that contains the event information. OR Deletes the user registration for the given user and application.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| applicationId | string | yes | The Id of the application to remove the registration for. |
| requestBody | object | – | Registration delete API request object. |
| userId | string | yes | The Id of the user whose registration is being deleted. |
No output schema declared.
No examples provided.
What is the io.fusionauth/mcp-api server?
io.fusionauth/mcp-api is listed in the public MCP registry as io.fusionauth/mcp-api. Preview release of FusionAuth API MCP server. This page covers its npm package (@fusionauth/mcp-api).
Is the io.fusionauth/mcp-api server safe to use?
io.fusionauth/mcp-api scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.fusionauth/mcp-api server expose?
io.fusionauth/mcp-api exposes 310 tools: retrieveJsonWebKeySetWithId, retrieveOpenIdConfigurationWithId, createAPIKey, retrieveAPIKeyWithId, updateAPIKeyWithId, and 305 more. Their descriptions and schemas cost roughly 22,835 tokens of context every time the server is loaded.
Is the io.fusionauth/mcp-api server still maintained?
io.fusionauth/mcp-api is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.fusionauth/mcp-api server under?
io.fusionauth/mcp-api declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.