io.fusionauth/mcp-api

NPM · @FUSIONAUTH/MCP-API · SCANNED AUG 3

Preview release of FusionAuth API MCP server

Available components

+20 this week 66 66 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security88

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (Apache-2.0).Pass
Actively maintained (last published 118 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability60

AI-judged instruction clarity (fair).Partial
Tool/resource definitions use about 22835 tokens (~73/item across 310 items; 310 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage99

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
97% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @fusionauth/mcp-api

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

# add to Codex CLI

codex mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-fusionauth-mcp-api": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@fusionauth/mcp-api"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add io-fusionauth-mcp-api --command npx --arg -y --arg @fusionauth/mcp-api

# ~/.hermes/config.yaml

mcp_servers:
  io-fusionauth-mcp-api:
    command: "npx"
    args: ["-y", "@fusionauth/mcp-api"]

// mcp.json

{
  "mcpServers": {
    "io-fusionauth-mcp-api": {
      "command": "npx",
      "args": [
        "-y",
        "@fusionauth/mcp-api"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +30
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Security disclosure: fail → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → fair ▲ functional
- Licence: Apache-2.0 functional
1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
31 Jul 26 −25
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 46

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@fusionauth/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 110 packages

110 packages in the resolved dependency tree · 109 deprecated · 32 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 310 exposed · ~22,835 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

deleteUserTwoFactorWithId ~107

Disable two-factor authentication for a user using a JSON body rather than URL parameters. OR Disable two-factor authentication for a user.

Input Output Examples

Name	Type	Req	Description
code	string	—	The two-factor code used verify the the caller knows the two-factor secret.
methodId	string	—	The two-factor method identifier you wish to disable
requestBody	object	—	The JSON request body.
userId	string	yes	The Id of the User for which you're disabling two-factor authentication.

No output schema declared.

No examples provided.

deleteUserWithId ~164

Deletes the user based on the given request (sent to the API as JSON). This permanently deletes all information, metrics, reports and data associated with the user. OR Deletes the user for the given Id. This permanently deletes all information, metrics, reports and data associated with the user. OR Deactivates the user with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
hardDelete	string	—	—
requestBody	object	—	User API delete request object for a single user.
userId	string	yes	The Id of the user to delete (required).

No output schema declared.

No examples provided.

deleteWebAuthnCredentialWithId ~41

Deletes the WebAuthn credential for the given Id.

Input Output Examples

Name	Type	Req	Description
id	string	yes	The Id of the WebAuthn credential to delete.

No output schema declared.

No examples provided.

deleteWebhookWithId ~33

Deletes the webhook for the given Id.

Input Output Examples

Name	Type	Req	Description
webhookId	string	yes	The Id of the webhook to delete.

No output schema declared.

No examples provided.

enableTwoFactorWithId ~49

Enable two-factor authentication for a user.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.
userId	string	yes	The Id of the user to enable two-factor authentication.

No output schema declared.

No examples provided.

exchangeRefreshTokenForJWTWithId ~34

Exchange a refresh token for a new JWT.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

forgotPasswordWithId ~44

Begins the forgot password sequence, which kicks off an email to the user so that they can reset their password.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Forgot password request object.

No output schema declared.

No examples provided.

generateKey ~34

Generate a new RSA or EC key pair or an HMAC secret.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Key API request object.

No output schema declared.

No examples provided.

generateKeyWithId ~60

Generate a new RSA or EC key pair or an HMAC secret.

Input Output Examples

Name	Type	Req	Description
keyId	string	yes	The Id for the key. If not provided a secure random UUID will be generated.
requestBody	object	—	Key API request object.

No output schema declared.

No examples provided.

generateTwoFactorRecoveryCodesWithId ~55

Generate two-factor recovery codes for a user. Generating two-factor recovery codes will invalidate any existing recovery codes.

Input Output Examples

Name	Type	Req	Description
userId	string	yes	The Id of the user to generate new Two Factor recovery codes.

No output schema declared.

No examples provided.

generateTwoFactorSecretUsingJWTWithId ~69

Generate a Two Factor secret that can be used to enable Two Factor authentication for a User. The response will contain both the secret and a Base32 encoded form of the secret which can be shown to a User when using a 2 Step Authentication application such as Google Authenticator.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

identityProviderLoginWithId ~103

Handles login via third-parties including Social login, external OAuth and OpenID Connect, and other login systems.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Login API request object used for login to third-party systems (i.e. Login with Facebook).

No output schema declared.

No examples provided.

importKey ~34

Import an existing RSA or EC key pair or an HMAC secret.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Key API request object.

No output schema declared.

No examples provided.

importKeyWithId ~60

Import an existing RSA or EC key pair or an HMAC secret.

Input Output Examples

Name	Type	Req	Description
keyId	string	yes	The Id for the key. If not provided a secure random UUID will be generated.
requestBody	object	—	Key API request object.

No output schema declared.

No examples provided.

importRefreshTokensWithId ~144

Bulk imports refresh tokens. This request performs minimal validation and runs batch inserts of refresh tokens with the expectation that each token represents a user that already exists and is registered for the corresponding FusionAuth Application. This is done to increases the insert performance. Therefore, if you encounter an error due to a database key violation, the response will likely offer a generic explanation. If you encounter an error, you may optionally enable additional validation to receive a JSON response body with specific validation errors. This will slow the request down but will allow you to identify the cause of the failure. See the validateDbConstraints request parameter.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Refresh Token Import request.

No output schema declared.

No examples provided.

importUsersWithId ~138

Bulk imports users. This request performs minimal validation and runs batch inserts of users with the expectation that each user does not yet exist and each registration corresponds to an existing FusionAuth Application. This is done to increases the insert performance. Therefore, if you encounter an error due to a database key violation, the response will likely offer a generic explanation. If you encounter an error, you may optionally enable additional validation to receive a JSON response body with specific validation errors. This will slow the request down but will allow you to identify the cause of the failure. See the validateDbConstraints request parameter.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Import request.

No output schema declared.

No examples provided.

importWebAuthnCredentialWithId ~39

Import a WebAuthn credential

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	API request to import an existing WebAuthn credential(s)

No output schema declared.

No examples provided.

issueJWTWithId ~150

Issue a new access token (JWT) for the requested Application after ensuring the provided JWT is valid. A valid access token is properly signed and not expired. <p> This API may be used in an SSO configuration to issue new tokens for another application after the user has obtained a valid token from authentication.

Input Output Examples

Name	Type	Req	Description
applicationId	string	—	The Application Id for which you are requesting a new access token be issued.
refreshToken	string	—	An existing refresh token used to request a refresh token in addition to a JWT in the response. <p>The target application represented by the applicationId request parameter must have refresh tokens e…

No output schema declared.

No examples provided.

loginPingWithId ~196

Sends a ping to FusionAuth indicating that the user was automatically logged into an application. When using FusionAuth's SSO or your own, you should call this if the user is already logged in centrally, but accesses an application where they no longer have a session. This helps correctly track login counts, times and helps with reporting.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application that they logged into.
callerIPAddress	string	—	The IP address of the end-user that is logging in. If a null value is provided the IP address will be that of the client or last proxy that sent the request.
userId	string	yes	The Id of the user that was logged in.

No output schema declared.

No examples provided.

loginPingWithRequestWithId ~135

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Login Ping API request object.

No output schema declared.

No examples provided.

loginWithId ~95

Authenticates a user to FusionAuth. This API optionally requires an API key. See <code>Application.loginConfiguration.requireAuthentication</code>.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Login API request object.

No output schema declared.

No examples provided.

lookupIdentityProviderWithId ~60

Retrieves the identity provider for the given domain. A 200 response code indicates the domain is managed by a registered identity provider. A 404 indicates the domain is not managed.

Input Output Examples

Name	Type	Req	Description
domain	string	—	The domain or email address to lookup.

No output schema declared.

No examples provided.

modifyActionWithId ~69

Modifies a temporal user action by changing the expiration of the action and optionally adding a comment to the action.

Input Output Examples

Name	Type	Req	Description
actionId	string	yes	The Id of the action to modify. This is technically the user action log Id.
requestBody	object	—	The user action request object.

No output schema declared.

No examples provided.

passwordlessLoginWithId ~33

Complete a login request using a passwordless code

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

patchAPIKeyWithId ~58

Updates an API key with the given Id.

Input Output Examples

Name	Type	Req	Description
keyId	string	yes	The Id of the API key. If not provided a secure random api key will be generated.
requestBody	object	—	Authentication key request object.

No output schema declared.

No examples provided.

patchApplicationRoleWithId ~117

Updates, via PATCH, the application role with the given Id for the application.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application that the role belongs to.
requestBody	object	—	The Application API request object.
roleId	string	yes	The Id of the role to update.

No output schema declared.

No examples provided.

patchApplicationWithId ~94

Updates, via PATCH, the application with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application to update.
requestBody	object	—	The Application API request object.

No output schema declared.

No examples provided.

patchConnectorWithId ~49

Updates, via PATCH, the connector with the given Id.

Input Output Examples

Name	Type	Req	Description
connectorId	string	yes	The Id of the connector to update.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

patchConsentWithId ~95

Updates, via PATCH, the consent with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
consentId	string	yes	The Id of the consent to update.
requestBody	object	—	API request for User consent types.

No output schema declared.

No examples provided.

patchEmailTemplateWithId ~96

Updates, via PATCH, the email template with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
emailTemplateId	string	yes	The Id of the email template to update.
requestBody	object	—	Email template request.

No output schema declared.

No examples provided.

patchEntityTypePermissionWithId ~73

Patches the permission with the given Id for the entity type.

Input Output Examples

Name	Type	Req	Description
entityTypeId	string	yes	The Id of the entityType that the permission belongs to.
permissionId	string	yes	The Id of the permission to patch.
requestBody	object	—	Entity Type API request object.

No output schema declared.

No examples provided.

patchEntityTypeWithId ~54

Updates, via PATCH, the Entity Type with the given Id.

Input Output Examples

Name	Type	Req	Description
entityTypeId	string	yes	The Id of the Entity Type to update.
requestBody	object	—	Entity Type API request object.

No output schema declared.

No examples provided.

patchEntityWithId ~94

Updates, via PATCH, the Entity with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
entityId	string	yes	The Id of the Entity Type to update.
requestBody	object	—	Entity API request object.

No output schema declared.

No examples provided.

patchFormFieldWithId ~51

Patches the form field with the given Id.

Input Output Examples

Name	Type	Req	Description
fieldId	string	yes	The Id of the form field to patch.
requestBody	object	—	The FormField API request object.

No output schema declared.

No examples provided.

patchFormWithId ~44

Patches the form with the given Id.

Input Output Examples

Name	Type	Req	Description
formId	string	yes	The Id of the form to patch.
requestBody	object	—	Form response.

No output schema declared.

No examples provided.

patchGroupWithId ~93

Updates, via PATCH, the group with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
groupId	string	yes	The Id of the group to update.
requestBody	object	—	Group API request object.

No output schema declared.

No examples provided.

patchIdentityProviderWithId ~53

Updates, via PATCH, the identity provider with the given Id.

Input Output Examples

Name	Type	Req	Description
identityProviderId	string	yes	The Id of the identity provider to update.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

patchIntegrationsWithId ~31

Updates, via PATCH, the available integrations.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The Integration Request

No output schema declared.

No examples provided.

patchIPAccessControlListWithId ~56

Update the IP Access Control List with the given Id.

Input Output Examples

Name	Type	Req	Description
accessControlListId	string	yes	The Id of the IP Access Control List to patch.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

patchLambdaWithId ~49

Updates, via PATCH, the lambda with the given Id.

Input Output Examples

Name	Type	Req	Description
lambdaId	string	yes	The Id of the lambda to update.
requestBody	object	—	Lambda API request object.

No output schema declared.

No examples provided.

patchMessageTemplateWithId ~56

Updates, via PATCH, the message template with the given Id.

Input Output Examples

Name	Type	Req	Description
messageTemplateId	string	yes	The Id of the message template to update.
requestBody	object	—	A Message Template Request to the API

No output schema declared.

No examples provided.

patchMessengerWithId ~49

Updates, via PATCH, the messenger with the given Id.

Input Output Examples

Name	Type	Req	Description
messengerId	string	yes	The Id of the messenger to update.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

patchOAuthScopeWithId ~121

Updates, via PATCH, the custom OAuth scope with the given Id for the application.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application that the OAuth scope belongs to.
requestBody	object	—	The Application Scope API request object.
scopeId	string	yes	The Id of the OAuth scope to update.

No output schema declared.

No examples provided.

patchRegistrationWithId ~108

Updates, via PATCH, the registration for the user with the given Id and the application defined in the request.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Registration API request object.
userId	string	yes	The Id of the user whose registration is going to be updated.

No output schema declared.

No examples provided.

patchSystemConfigurationWithId ~34

Updates, via PATCH, the system configuration.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Request for the system configuration API.

No output schema declared.

No examples provided.

patchTenantWithId ~93

Updates, via PATCH, the tenant with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	The JSON request body.
tenantId	string	yes	The Id of the tenant to update.

No output schema declared.

No examples provided.

patchThemeWithId ~49

Updates, via PATCH, the theme with the given Id.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Theme API request object.
themeId	string	yes	The Id of the theme to update.

No output schema declared.

No examples provided.

patchUserActionReasonWithId ~59

Updates, via PATCH, the user action reason with the given Id.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	User Action Reason API request object.
userActionReasonId	string	yes	The Id of the user action reason to update.

No output schema declared.

No examples provided.

patchUserActionWithId ~98

Updates, via PATCH, the user action with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	User Action API request object.
userActionId	string	yes	The Id of the user action to update.

No output schema declared.

No examples provided.

patchUserConsentWithId ~49

Updates, via PATCH, a single User consent by Id.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	API response for User consent.
userConsentId	string	yes	The User Consent Id

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug