io.fusionauth/mcp-api

NPM · @FUSIONAUTH/MCP-API · SCANNED AUG 3

Preview release of FusionAuth API MCP server

Available components

+20 this week 66 66 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security88

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (Apache-2.0).Pass
Actively maintained (last published 118 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability60

AI-judged instruction clarity (fair).Partial
Tool/resource definitions use about 22835 tokens (~73/item across 310 items; 310 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage99

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
97% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @fusionauth/mcp-api

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

# add to Codex CLI

codex mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-fusionauth-mcp-api": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@fusionauth/mcp-api"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add io-fusionauth-mcp-api --command npx --arg -y --arg @fusionauth/mcp-api

# ~/.hermes/config.yaml

mcp_servers:
  io-fusionauth-mcp-api:
    command: "npx"
    args: ["-y", "@fusionauth/mcp-api"]

// mcp.json

{
  "mcpServers": {
    "io-fusionauth-mcp-api": {
      "command": "npx",
      "args": [
        "-y",
        "@fusionauth/mcp-api"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +30
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Security disclosure: fail → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → fair ▲ functional
- Licence: Apache-2.0 functional
1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
31 Jul 26 −25
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 46

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@fusionauth/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 110 packages

110 packages in the resolved dependency tree · 109 deprecated · 32 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 310 exposed · ~22,835 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

retrieveReactorMetricsWithId ~19

Retrieves the FusionAuth Reactor metrics.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveRefreshTokenByIdWithId ~62

Retrieves a single refresh token by unique Id. This is not the same thing as the string value of the refresh token. If you have that, you already have what you need.

Input Output Examples

Name	Type	Req	Description
tokenId	string	yes	The Id of the token.

No output schema declared.

No examples provided.

retrieveRefreshTokensWithId ~38

Retrieves the refresh tokens that belong to the user with the given Id.

Input Output Examples

Name	Type	Req	Description
userId	string	—	The Id of the user.

No output schema declared.

No examples provided.

retrieveRegistrationReportWithId ~80

Retrieves the registration report between the two instants. If you specify an application Id, it will only return the registration counts for that application.

Input Output Examples

Name	Type	Req	Description
applicationId	string	—	The application Id.
end	string	—	The end instant as UTC milliseconds since Epoch.
start	string	—	The start instant as UTC milliseconds since Epoch.

No output schema declared.

No examples provided.

retrieveRegistrationWithId ~97

Retrieves the user registration for the user with the given Id and the given application Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application.
userId	string	yes	The Id of the user.

No output schema declared.

No examples provided.

retrieveReportLogin ~236

Retrieves the login report between the two instants for a particular user by login Id, using specific loginIdTypes. If you specify an application id, it will only return the login counts for that application. OR Retrieves the login report between the two instants for a particular user by login Id. If you specify an application Id, it will only return the login counts for that application. OR Retrieves the login report between the two instants for a particular user by Id. If you specify an application Id, it will only return the login counts for that application. OR Retrieves the login report between the two instants. If you specify an application Id, it will only return the login counts for that application.

Input Output Examples

Name	Type	Req	Description
applicationId	string	—	The application id.
end	string	—	The end instant as UTC milliseconds since Epoch.
loginId	string	—	The userId id.
loginIdTypes	array	—	the identity types that FusionAuth will compare the loginId to.
start	string	—	The start instant as UTC milliseconds since Epoch.
userId	string	—	The userId Id.

No output schema declared.

No examples provided.

retrieveStatus ~84

Retrieves the FusionAuth system status using an API key. Using an API key will cause the response to include the product version, health checks and various runtime metrics. OR Retrieves the FusionAuth system status. This request is anonymous and does not require an API key. When an API key is not provided the response will contain a single value in the JSON response indicating the current health check.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveSystemHealthWithId ~41

Retrieves the FusionAuth system health. This API will return 200 if the system is healthy, and 500 if the system is un-healthy.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveTenantWithId ~75

Retrieves the tenant for the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
tenantId	string	yes	The Id of the tenant.

No output schema declared.

No examples provided.

retrieveThemeWithId ~31

Retrieves the theme for the given Id.

Input Output Examples

Name	Type	Req	Description
themeId	string	yes	The Id of the theme.

No output schema declared.

No examples provided.

retrieveTotalReportWithId ~31

Retrieves the totals report. This contains all the total counts for each application and the global registration count.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveTwoFactorRecoveryCodesWithId ~41

Retrieve two-factor recovery codes for a user.

Input Output Examples

Name	Type	Req	Description
userId	string	yes	The Id of the user to retrieve Two Factor recovery codes.

No output schema declared.

No examples provided.

retrieveTwoFactorStatusWithId ~106

Retrieve a user's two-factor status. This can be used to see if a user will need to complete a two-factor challenge to complete a login, and optionally identify the state of the two-factor trust across various applications.

Input Output Examples

Name	Type	Req	Description
applicationId	string	—	The optional applicationId to verify.
twoFactorTrustId	string	yes	The optional two-factor trust Id to verify.
userId	string	—	The user Id to retrieve the Two-Factor status.

No output schema declared.

No examples provided.

retrieveUser ~321

Retrieves the user for the given Id. This method does not use an API key, instead it uses a JSON Web Token (JWT) for authentication. OR Retrieves the user by a verificationId. The intended use of this API is to retrieve a user after the forgot password workflow has been initiated and you may not know the user's email or username. OR Retrieves the user for the given username. OR Retrieves the user for the loginId, using specific loginIdTypes. OR Retrieves the user for the loginId. The loginId can be either the username or the email. OR Retrieves the user for the given email. OR Retrieves the user by a change password Id. The intended use of this API is to retrieve a user after the forgot password workflow has been initiated and you may not know the user's email or username.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
changePasswordId	string	—	The unique change password Id that was sent via email or returned by the Forgot Password API.
email	string	—	The email of the user.
loginId	string	—	The email or username of the user.
loginIdTypes	array	—	the identity types that FusionAuth will compare the loginId to.
username	string	—	The username of the user.
verificationId	string	—	The unique verification Id that has been set on the user object.

No output schema declared.

No examples provided.

retrieveUserAction ~97

Retrieves the user action for the given Id. If you pass in null for the Id, this will return all the user actions. OR Retrieves all the user actions that are currently inactive.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
inactive	string	—	—

No output schema declared.

No examples provided.

retrieveUserActioning ~175

Retrieves all the actions for the user with the given Id that are currently inactive. An inactive action means one that is time based and has been canceled or has expired, or is not time based. OR Retrieves all the actions for the user with the given Id that are currently active. An active action means one that is time based and has not been canceled, and has not ended. OR Retrieves all the actions for the user with the given Id that are currently preventing the User from logging in. OR Retrieves all the actions for the user with the given Id. This will return all time based actions that are active, and inactive as well as non-time based actions.

Input Output Examples

Name	Type	Req	Description
active	string	—	—
preventingLogin	string	—	—
userId	string	—	The Id of the user to fetch the actions for.

No output schema declared.

No examples provided.

retrieveUserActionReason ~38

Retrieves the user action reason for the given Id. If you pass in null for the Id, this will return all the user action reasons.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveUserActionReasonWithId ~57

Retrieves the user action reason for the given Id. If you pass in null for the Id, this will return all the user action reasons.

Input Output Examples

Name	Type	Req	Description
userActionReasonId	string	yes	The Id of the user action reason.

No output schema declared.

No examples provided.

retrieveUserActionWithId ~96

Retrieves the user action for the given Id. If you pass in null for the Id, this will return all the user actions.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
userActionId	string	yes	The Id of the user action.

No output schema declared.

No examples provided.

retrieveUserChangePassword ~228

Check to see if the user must obtain a Trust Request Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change your password, you must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication. An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API. OR Check to see if the user must obtain a Trust Token Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication. An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.

Input Output Examples

Name	Type	Req	Description
loginId	string	—	The loginId of the User that you intend to change the password for.

No output schema declared.

No examples provided.

retrieveUserCommentsWithId ~80

Retrieves all the comments for the user with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
userId	string	yes	The Id of the user.

No output schema declared.

No examples provided.

retrieveUserConsentsWithId ~33

Retrieves all the consents for a User.

Input Output Examples

Name	Type	Req	Description
userId	string	—	The User's Id

No output schema declared.

No examples provided.

retrieveUserConsentWithId ~32

Retrieve a single User consent by Id.

Input Output Examples

Name	Type	Req	Description
userConsentId	string	yes	The User consent Id

No output schema declared.

No examples provided.

retrieveUserInfoFromAccessTokenWithId ~32

Call the UserInfo endpoint to retrieve User Claims from the access token issued by FusionAuth.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveUserRecentLogin ~96

Retrieves the last number of login records for a user. OR Retrieves the last number of login records.

Input Output Examples

Name	Type	Req	Description
limit	string	—	(Optional, defaults to 10) The number of records to retrieve.
offset	string	—	The initial record. e.g. 0 is the last login, 100 will be the 100th most recent login.
userId	string	—	The Id of the user.

No output schema declared.

No examples provided.

retrieveUserWithId ~75

Retrieves the user for the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
userId	string	yes	The Id of the user.

No output schema declared.

No examples provided.

retrieveVersionWithId ~17

Retrieves the FusionAuth version string.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveWebAuthnCredentialsForUserWithId ~37

Retrieves all WebAuthn credentials for the given user.

Input Output Examples

Name	Type	Req	Description
userId	string	—	The user's ID.

No output schema declared.

No examples provided.

retrieveWebAuthnCredentialWithId ~39

Retrieves the WebAuthn credential for the given Id.

Input Output Examples

Name	Type	Req	Description
id	string	yes	The Id of the WebAuthn credential.

No output schema declared.

No examples provided.

retrieveWebhook ~33

Retrieves the webhook for the given Id. If you pass in null for the Id, this will return all the webhooks.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

retrieveWebhookAttemptLogWithId ~42

Retrieves a single webhook attempt log for the given Id.

Input Output Examples

Name	Type	Req	Description
webhookAttemptLogId	string	yes	The Id of the webhook attempt log to retrieve.

No output schema declared.

No examples provided.

retrieveWebhookEventLogWithId ~42

Retrieves a single webhook event log for the given Id.

Input Output Examples

Name	Type	Req	Description
webhookEventLogId	string	yes	The Id of the webhook event log to retrieve.

No output schema declared.

No examples provided.

retrieveWebhookWithId ~48

Retrieves the webhook for the given Id. If you pass in null for the Id, this will return all the webhooks.

Input Output Examples

Name	Type	Req	Description
webhookId	string	yes	The Id of the webhook.

No output schema declared.

No examples provided.

revokeRefreshTokenByIdWithId ~56

Revokes a single refresh token by the unique Id. The unique Id is not sensitive as it cannot be used to obtain another JWT.

Input Output Examples

Name	Type	Req	Description
tokenId	string	yes	The unique Id of the token to delete.

No output schema declared.

No examples provided.

revokeUserConsentWithId ~33

Revokes a single User consent by Id.

Input Output Examples

Name	Type	Req	Description
userConsentId	string	yes	The User Consent Id

No output schema declared.

No examples provided.

searchApplicationsWithId ~31

Searches applications with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for Applications

No output schema declared.

No examples provided.

searchAuditLogsWithId ~34

Searches the audit logs with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

searchConsentsWithId ~34

Searches consents with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for Consents

No output schema declared.

No examples provided.

searchEmailTemplatesWithId ~34

Searches email templates with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for email templates

No output schema declared.

No examples provided.

searchEntitiesByIdsWithId ~44

Retrieves the entities for the given Ids. If any Id is invalid, it is ignored.

Input Output Examples

Name	Type	Req	Description
ids	string	—	The entity ids to search for.

No output schema declared.

No examples provided.

searchEntitiesWithId ~31

Searches entities with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for entities

No output schema declared.

No examples provided.

searchEntityGrantsWithId ~35

Searches Entity Grants with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for entity grants.

No output schema declared.

No examples provided.

searchEntityTypesWithId ~35

Searches the entity types with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for entity types.

No output schema declared.

No examples provided.

searchEventLogsWithId ~34

Searches the event logs with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

searchGroupMembersWithId ~34

Searches group members with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for Group Members.

No output schema declared.

No examples provided.

searchGroupsWithId ~31

Searches groups with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for Groups.

No output schema declared.

No examples provided.

searchIdentityProvidersWithId ~34

Searches identity providers with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for Identity Providers

No output schema declared.

No examples provided.

searchIPAccessControlListsWithId ~40

Searches the IP Access Control Lists with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for IP ACLs .

No output schema declared.

No examples provided.

searchKeysWithId ~31

Searches keys with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for Keys

No output schema declared.

No examples provided.

searchLambdasWithId ~35

Searches lambdas with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for Lambdas

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug