io.fusionauth/mcp-api

NPM · @FUSIONAUTH/MCP-API · SCANNED AUG 3

Preview release of FusionAuth API MCP server

Available components

+20 this week 66 66 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security88

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (Apache-2.0).Pass
Actively maintained (last published 118 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability60

AI-judged instruction clarity (fair).Partial
Tool/resource definitions use about 22835 tokens (~73/item across 310 items; 310 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage99

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
97% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @fusionauth/mcp-api

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

# add to Codex CLI

codex mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-fusionauth-mcp-api": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@fusionauth/mcp-api"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add io-fusionauth-mcp-api --command npx --arg -y --arg @fusionauth/mcp-api

# ~/.hermes/config.yaml

mcp_servers:
  io-fusionauth-mcp-api:
    command: "npx"
    args: ["-y", "@fusionauth/mcp-api"]

// mcp.json

{
  "mcpServers": {
    "io-fusionauth-mcp-api": {
      "command": "npx",
      "args": [
        "-y",
        "@fusionauth/mcp-api"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +30
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Security disclosure: fail → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → fair ▲ functional
- Licence: Apache-2.0 functional
1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
31 Jul 26 −25
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 46

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@fusionauth/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 110 packages

110 packages in the resolved dependency tree · 109 deprecated · 32 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 310 exposed · ~22,835 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

patchUserWithId ~93

Updates, via PATCH, the user with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	User API request object.
userId	string	yes	The Id of the user to update.

No output schema declared.

No examples provided.

patchWebhookWithId ~47

Patches the webhook with the given Id.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Webhook API request object.
webhookId	string	yes	The Id of the webhook to update.

No output schema declared.

No examples provided.

reconcileJWTWithId ~51

Reconcile a User to FusionAuth using JWT issued from another Identity Provider.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Login API request object used for login to third-party systems (i.e. Login with Facebook).

No output schema declared.

No examples provided.

Registers a user for an application. If you provide the User and the UserRegistration object on this request, it will create the user as well as register them for the application. This is called a Full Registration. However, if you only provide the UserRegistration object, then the user must already exist and they will be registered for the application. The user Id can also be provided and it will either be used to look up an existing user or it will be used for the newly created User.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Registration API request object.

No output schema declared.

No examples provided.

registerWithId ~184

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Registration API request object.
userId	string	yes	The Id of the user being registered for the application and optionally created.

No output schema declared.

No examples provided.

reindexWithId ~108

Requests Elasticsearch to delete and rebuild the index for FusionAuth users or entities. Be very careful when running this request as it will increase the CPU and I/O load on your database until the operation completes. Generally speaking you do not ever need to run this operation unless instructed by FusionAuth support, or if you are migrating a database another system and you are not brining along the Elasticsearch index. You have been warned.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Reindex API request

No output schema declared.

No examples provided.

removeUserFromFamilyWithId ~103

Removes a user from the family with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
familyId	string	yes	The Id of the family to remove the user from.
userId	string	yes	The Id of the user to remove from the family.

No output schema declared.

No examples provided.

retrieveActionWithId ~50

Retrieves a single action log (the log of a user action that was taken on a user previously) for the given Id.

Input Output Examples

Name	Type	Req	Description
actionId	string	yes	The Id of the action to retrieve.

No output schema declared.

No examples provided.

retrieveAPIKeyWithId ~37

Retrieves an authentication API key for the given Id.

Input Output Examples

Name	Type	Req	Description
keyId	string	yes	The Id of the API key to retrieve.

No output schema declared.

No examples provided.

retrieveApplication ~86

Retrieves all the applications that are currently inactive. OR Retrieves the application for the given Id or all the applications if the Id is null.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
inactive	string	—	—

No output schema declared.

No examples provided.

retrieveApplicationWithId ~82

Retrieves the application for the given Id or all the applications if the Id is null.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The application Id.

No output schema declared.

No examples provided.

retrieveAuditLogWithId ~38

Retrieves a single audit log for the given Id.

Input Output Examples

Name	Type	Req	Description
auditLogId	string	yes	The Id of the audit log to retrieve.

No output schema declared.

No examples provided.

retrieveConnectorWithId ~31

Retrieves the connector with the given Id.

Input Output Examples

Name	Type	Req	Description
connectorId	string	yes	The Id of the connector.

No output schema declared.

No examples provided.

retrieveConsentWithId ~75

Retrieves the Consent for the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
consentId	string	yes	The Id of the consent.

No output schema declared.

No examples provided.

retrieveDailyActiveReportWithId ~84

Retrieves the daily active user report between the two instants. If you specify an application Id, it will only return the daily active counts for that application.

Input Output Examples

Name	Type	Req	Description
applicationId	string	—	The application Id.
end	string	—	The end instant as UTC milliseconds since Epoch.
start	string	—	The start instant as UTC milliseconds since Epoch.

No output schema declared.

No examples provided.

retrieveDeviceUserCode ~90

Retrieve a user_code that is part of an in-progress Device Authorization Grant. This API is useful if you want to build your own login workflow to complete a device grant. This request will require an API key. OR Retrieve a user_code that is part of an in-progress Device Authorization Grant. This API is useful if you want to build your own login workflow to complete a device grant.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveEmailTemplate ~77

Retrieves the email template for the given Id. If you don't specify the Id, this will return all the email templates.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.

No output schema declared.

No examples provided.

retrieveEmailTemplatePreviewWithId ~78

Creates a preview of the email template provided in the request. This allows you to preview an email template that hasn't been saved to the database yet. The entire email template does not need to be provided on the request. This will create the preview based on whatever is given.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

retrieveEmailTemplateWithId ~94

Retrieves the email template for the given Id. If you don't specify the Id, this will return all the email templates.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
emailTemplateId	string	yes	The Id of the email template.

No output schema declared.

No examples provided.

retrieveEntityGrantWithId ~120

Retrieves an Entity Grant for the given Entity and User/Entity.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
entityId	string	yes	The Id of the Entity.
recipientEntityId	string	—	The Id of the Entity that the Entity Grant is for.
userId	string	—	The Id of the User that the Entity Grant is for.

No output schema declared.

No examples provided.

retrieveEntityTypeWithId ~35

Retrieves the Entity Type for the given Id.

Input Output Examples

Name	Type	Req	Description
entityTypeId	string	yes	The Id of the Entity Type.

No output schema declared.

No examples provided.

retrieveEntityWithId ~75

Retrieves the Entity for the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
entityId	string	yes	The Id of the Entity.

No output schema declared.

No examples provided.

retrieveEventLogWithId ~38

Retrieves a single event log for the given Id.

Input Output Examples

Name	Type	Req	Description
eventLogId	string	yes	The Id of the event log to retrieve.

No output schema declared.

No examples provided.

retrieveFamiliesWithId ~76

Retrieves all the families that a user belongs to.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
userId	string	—	The User's id

No output schema declared.

No examples provided.

retrieveFamilyMembersByFamilyIdWithId ~85

Retrieves all the members of a family by the unique Family Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
familyId	string	yes	The unique Id of the Family.

No output schema declared.

No examples provided.

retrieveFormFieldWithId ~34

Retrieves the form field with the given Id.

Input Output Examples

Name	Type	Req	Description
fieldId	string	yes	The Id of the form field.

No output schema declared.

No examples provided.

retrieveFormWithId ~31

Retrieves the form with the given Id.

Input Output Examples

Name	Type	Req	Description
formId	string	yes	The Id of the form.

No output schema declared.

No examples provided.

retrieveGroupWithId ~75

Retrieves the group for the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
groupId	string	yes	The Id of the group.

No output schema declared.

No examples provided.

retrieveIdentityProviderByTypeWithId ~89

Retrieves one or more identity provider for the given type. For types such as Google, Facebook, Twitter and LinkedIn, only a single identity provider can exist. For types such as OpenID Connect and SAMLv2 more than one identity provider can be configured so this request may return multiple identity providers.

Input Output Examples

Name	Type	Req	Description
type	string	—	The type of the identity provider.

No output schema declared.

No examples provided.

retrieveIdentityProviderLink ~117

Retrieve all Identity Provider users (links) for the user. Specify the optional identityProviderId to retrieve links for a particular IdP. OR Retrieve a single Identity Provider user (link).

Input Output Examples

Name	Type	Req	Description
identityProviderId	string	—	The unique Id of the identity provider. Specify this value to reduce the links returned to those for a particular IdP.
identityProviderUserId	string	—	The unique Id of the user in the 3rd party identity provider.
userId	string	—	The unique Id of the user.

No output schema declared.

No examples provided.

retrieveIdentityProviderWithId ~43

Retrieves the identity provider for the given Id or all the identity providers if the Id is null.

Input Output Examples

Name	Type	Req	Description
identityProviderId	string	yes	The identity provider Id.

No output schema declared.

No examples provided.

retrieveIPAccessControlListWithId ~43

Retrieves the IP Access Control List with the given Id.

Input Output Examples

Name	Type	Req	Description
ipAccessControlListId	string	yes	The Id of the IP Access Control List.

No output schema declared.

No examples provided.

retrieveJsonWebKeySetWithId ~33

Returns public keys used by FusionAuth to cryptographically verify JWTs using the JSON Web Key format.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveJwtPublicKey ~90

Retrieves the Public Key configured for verifying the JSON Web Tokens (JWT) issued by the Login API by the Application Id. OR Retrieves the Public Key configured for verifying JSON Web Tokens (JWT) by the key Id (kid).

Input Output Examples

Name	Type	Req	Description
applicationId	string	—	The Id of the Application for which this key is used.
keyId	string	—	The Id of the public key (kid).

No output schema declared.

No examples provided.

retrieveKeysWithId ~15

Retrieves all the keys.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveKeyWithId ~31

Retrieves the key for the given Id.

Input Output Examples

Name	Type	Req	Description
keyId	string	yes	The Id of the key.

No output schema declared.

No examples provided.

retrieveLambdasByTypeWithId ~38

Retrieves all the lambdas for the provided type.

Input Output Examples

Name	Type	Req	Description
type	string	—	The type of the lambda to return.

No output schema declared.

No examples provided.

retrieveLambdaWithId ~31

Retrieves the lambda for the given Id.

Input Output Examples

Name	Type	Req	Description
lambdaId	string	yes	The Id of the lambda.

No output schema declared.

No examples provided.

retrieveMessageTemplate ~33

Retrieves the message template for the given Id. If you don't specify the Id, this will return all the message templates.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveMessageTemplatePreviewWithId ~42

Creates a preview of the message template provided in the request, normalized to a given locale.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

retrieveMessageTemplateWithId ~50

Retrieves the message template for the given Id. If you don't specify the Id, this will return all the message templates.

Input Output Examples

Name	Type	Req	Description
messageTemplateId	string	yes	The Id of the message template.

No output schema declared.

No examples provided.

retrieveMessengerWithId ~31

Retrieves the messenger with the given Id.

Input Output Examples

Name	Type	Req	Description
messengerId	string	yes	The Id of the messenger.

No output schema declared.

No examples provided.

retrieveMonthlyActiveReportWithId ~84

Retrieves the monthly active user report between the two instants. If you specify an application Id, it will only return the monthly active counts for that application.

Input Output Examples

Name	Type	Req	Description
applicationId	string	—	The application Id.
end	string	—	The end instant as UTC milliseconds since Epoch.
start	string	—	The start instant as UTC milliseconds since Epoch.

No output schema declared.

No examples provided.

retrieveOauthConfigurationWithId ~87

Retrieves the Oauth2 configuration for the application for the given Application Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the Application to retrieve OAuth configuration.

No output schema declared.

No examples provided.

retrieveOAuthScopeWithId ~96

Retrieves a custom OAuth scope.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application that the OAuth scope belongs to.
scopeId	string	yes	The Id of the OAuth scope to retrieve.

No output schema declared.

No examples provided.

retrieveOpenIdConfigurationWithId ~22

Returns the well known OpenID Configuration JSON document

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrievePasswordValidationRulesWithId ~68

Retrieves the password validation rules for a specific tenant. This method requires a tenantId to be provided through the use of a Tenant scoped API key or an HTTP header X-FusionAuth-TenantId to specify the Tenant Id. This API does not require an API key.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrievePasswordValidationRulesWithTenantIdWithId ~48

Retrieves the password validation rules for a specific tenant. This API does not require an API key.

Input Output Examples

Name	Type	Req	Description
tenantId	string	yes	The Id of the tenant.

No output schema declared.

No examples provided.

retrievePendingChildrenWithId ~35

Retrieves all the children for the given parent email address.

Input Output Examples

Name	Type	Req	Description
parentEmail	string	—	The email of the parent.

No output schema declared.

No examples provided.

retrievePendingLinkWithId ~81

Retrieve a pending identity provider link. This is useful to validate a pending link and retrieve meta-data about the identity provider link.

Input Output Examples

Name	Type	Req	Description
pendingLinkId	string	yes	The pending link Id.
userId	string	—	The optional userId. When provided additional meta-data will be provided to identify how many links if any the user already has.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug