io.fusionauth/mcp-api
NPM · @FUSIONAUTH/MCP-API · SCANNED SEP 24
Preview release of FusionAuth API MCP server
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 34 of 111 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 170 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability67
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 22835 tokens (~73/item across 310 items; 310 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management83
- Stability observed for 25 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage99
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 97% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 44 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "deleteAPIKeyWithId" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 310 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.fusionauth/mcp-api server?
io.fusionauth/mcp-api runs locally as an npm package, launched with npx -y @fusionauth/mcp-api. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @fusionauth/mcp-api
claude mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api
{
"mcpServers": {
"io-fusionauth-mcp-api": {
"command": "npx",
"args": [
"-y",
"@fusionauth/mcp-api"
]
}
}
} {
"servers": {
"io-fusionauth-mcp-api": {
"command": "npx",
"args": [
"-y",
"@fusionauth/mcp-api"
]
}
}
} codex mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"io-fusionauth-mcp-api": {
"type": "local",
"command": [
"npx",
"-y",
"@fusionauth/mcp-api"
],
"enabled": true
}
}
} openclaw mcp add io-fusionauth-mcp-api --command npx --arg -y --arg @fusionauth/mcp-api
mcp_servers:
io-fusionauth-mcp-api:
command: "npx"
args: ["-y", "@fusionauth/mcp-api"] {
"McpServers": {
"io-fusionauth-mcp-api": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@fusionauth/mcp-api"
]
}
}
} assistant mcp add io-fusionauth-mcp-api -t stdio -c npx -a -y @fusionauth/mcp-api
{
"mcpServers": {
"io-fusionauth-mcp-api": {
"command": "npx",
"args": [
"-y",
"@fusionauth/mcp-api"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 24 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 23 Sept 26 −3
- Stability: pass → 0.80 functional
- 22 Sept 26 +1
- Stability: 0.97 → pass security
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 −3
- Stability: pass → 0.80 functional
- 15 Sept 26 +1
- Stability: 0.97 → pass security
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 90 to 93. That category is still filling its 30-day observation window: 27 days of observed history at the previous scan, 28 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 24 Sept 2026 · Analysed npm/@fusionauth/mcp-api@0.1.14
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 111 packages
| Packages resolved | 111 |
|---|---|
| Stale | 34 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
retrieveReactorMetricsWithId ~19
Retrieves the FusionAuth Reactor metrics.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
retrieveRefreshTokenByIdWithId ~62
Retrieves a single refresh token by unique Id. This is not the same thing as the string value of the refresh token. If you have that, you already have what you need.
| Name | Type | Req | Description |
|---|---|---|---|
| tokenId | string | yes | The Id of the token. |
No output schema declared.
No examples provided.
retrieveRefreshTokensWithId ~38
Retrieves the refresh tokens that belong to the user with the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| userId | string | – | The Id of the user. |
No output schema declared.
No examples provided.
retrieveRegistrationReportWithId ~80
Retrieves the registration report between the two instants. If you specify an application Id, it will only return the registration counts for that application.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | – | The application Id. |
| end | string | – | The end instant as UTC milliseconds since Epoch. |
| start | string | – | The start instant as UTC milliseconds since Epoch. |
No output schema declared.
No examples provided.
retrieveRegistrationWithId ~97
Retrieves the user registration for the user with the given Id and the given application Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| applicationId | string | yes | The Id of the application. |
| userId | string | yes | The Id of the user. |
No output schema declared.
No examples provided.
retrieveReportLogin ~236
Retrieves the login report between the two instants for a particular user by login Id, using specific loginIdTypes. If you specify an application id, it will only return the login counts for that application. OR Retrieves the login report between the two instants for a particular user by login Id. If you specify an application Id, it will only return the login counts for that application. OR Retrieves the login report between the two instants for a particular user by Id. If you specify an application Id, it will only return the login counts for that application. OR Retrieves the login report between the two instants. If you specify an application Id, it will only return the login counts for that application.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | – | The application id. |
| end | string | – | The end instant as UTC milliseconds since Epoch. |
| loginId | string | – | The userId id. |
| loginIdTypes | array | – | the identity types that FusionAuth will compare the loginId to. |
| start | string | – | The start instant as UTC milliseconds since Epoch. |
| userId | string | – | The userId Id. |
No output schema declared.
No examples provided.
retrieveStatus ~84
Retrieves the FusionAuth system status using an API key. Using an API key will cause the response to include the product version, health checks and various runtime metrics. OR Retrieves the FusionAuth system status. This request is anonymous and does not require an API key. When an API key is not provided the response will contain a single value in the JSON response indicating the current health check.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
retrieveSystemHealthWithId ~41
Retrieves the FusionAuth system health. This API will return 200 if the system is healthy, and 500 if the system is un-healthy.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
retrieveTenantWithId ~75
Retrieves the tenant for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| tenantId | string | yes | The Id of the tenant. |
No output schema declared.
No examples provided.
retrieveThemeWithId ~31
Retrieves the theme for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| themeId | string | yes | The Id of the theme. |
No output schema declared.
No examples provided.
retrieveTotalReportWithId ~31
Retrieves the totals report. This contains all the total counts for each application and the global registration count.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
retrieveTwoFactorRecoveryCodesWithId ~41
Retrieve two-factor recovery codes for a user.
| Name | Type | Req | Description |
|---|---|---|---|
| userId | string | yes | The Id of the user to retrieve Two Factor recovery codes. |
No output schema declared.
No examples provided.
retrieveTwoFactorStatusWithId ~106
Retrieve a user's two-factor status. This can be used to see if a user will need to complete a two-factor challenge to complete a login, and optionally identify the state of the two-factor trust across various applications.
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | – | The optional applicationId to verify. |
| twoFactorTrustId | string | yes | The optional two-factor trust Id to verify. |
| userId | string | – | The user Id to retrieve the Two-Factor status. |
No output schema declared.
No examples provided.
retrieveUser ~321
Retrieves the user for the given Id. This method does not use an API key, instead it uses a JSON Web Token (JWT) for authentication. OR Retrieves the user by a verificationId. The intended use of this API is to retrieve a user after the forgot password workflow has been initiated and you may not know the user's email or username. OR Retrieves the user for the given username. OR Retrieves the user for the loginId, using specific loginIdTypes. OR Retrieves the user for the loginId. The loginId can be either the username or the email. OR Retrieves the user for the given email. OR Retrieves the user by a change password Id. The intended use of this API is to retrieve a user after the forgot password workflow has been initiated and you may not know the user's email or username.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| changePasswordId | string | – | The unique change password Id that was sent via email or returned by the Forgot Password API. |
| string | – | The email of the user. | |
| loginId | string | – | The email or username of the user. |
| loginIdTypes | array | – | the identity types that FusionAuth will compare the loginId to. |
| username | string | – | The username of the user. |
| verificationId | string | – | The unique verification Id that has been set on the user object. |
No output schema declared.
No examples provided.
retrieveUserAction ~97
Retrieves the user action for the given Id. If you pass in null for the Id, this will return all the user actions. OR Retrieves all the user actions that are currently inactive.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| inactive | string | – | – |
No output schema declared.
No examples provided.
retrieveUserActioning ~175
Retrieves all the actions for the user with the given Id that are currently inactive. An inactive action means one that is time based and has been canceled or has expired, or is not time based. OR Retrieves all the actions for the user with the given Id that are currently active. An active action means one that is time based and has not been canceled, and has not ended. OR Retrieves all the actions for the user with the given Id that are currently preventing the User from logging in. OR Retrieves all the actions for the user with the given Id. This will return all time based actions that are active, and inactive as well as non-time based actions.
| Name | Type | Req | Description |
|---|---|---|---|
| active | string | – | – |
| preventingLogin | string | – | – |
| userId | string | – | The Id of the user to fetch the actions for. |
No output schema declared.
No examples provided.
retrieveUserActionReason ~38
Retrieves the user action reason for the given Id. If you pass in null for the Id, this will return all the user action reasons.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
retrieveUserActionReasonWithId ~57
Retrieves the user action reason for the given Id. If you pass in null for the Id, this will return all the user action reasons.
| Name | Type | Req | Description |
|---|---|---|---|
| userActionReasonId | string | yes | The Id of the user action reason. |
No output schema declared.
No examples provided.
retrieveUserActionWithId ~96
Retrieves the user action for the given Id. If you pass in null for the Id, this will return all the user actions.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| userActionId | string | yes | The Id of the user action. |
No output schema declared.
No examples provided.
retrieveUserChangePassword ~228
Check to see if the user must obtain a Trust Request Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change your password, you must obtain a Trust Request Id by completing a Two-Factor Step-Up authentication. An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API. OR Check to see if the user must obtain a Trust Token Id in order to complete a change password request. When a user has enabled Two-Factor authentication, before you are allowed to use the Change Password API to change your password, you must obtain a Trust Token by completing a Two-Factor Step-Up authentication. An HTTP status code of 400 with a general error code of [TrustTokenRequired] indicates that a Trust Token is required to make a POST request to this API.
| Name | Type | Req | Description |
|---|---|---|---|
| loginId | string | – | The loginId of the User that you intend to change the password for. |
No output schema declared.
No examples provided.
retrieveUserCommentsWithId ~80
Retrieves all the comments for the user with the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| userId | string | yes | The Id of the user. |
No output schema declared.
No examples provided.
retrieveUserConsentsWithId ~33
Retrieves all the consents for a User.
| Name | Type | Req | Description |
|---|---|---|---|
| userId | string | – | The User's Id |
No output schema declared.
No examples provided.
retrieveUserConsentWithId ~32
Retrieve a single User consent by Id.
| Name | Type | Req | Description |
|---|---|---|---|
| userConsentId | string | yes | The User consent Id |
No output schema declared.
No examples provided.
retrieveUserInfoFromAccessTokenWithId ~32
Call the UserInfo endpoint to retrieve User Claims from the access token issued by FusionAuth.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
retrieveUserRecentLogin ~96
Retrieves the last number of login records for a user. OR Retrieves the last number of login records.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | string | – | (Optional, defaults to 10) The number of records to retrieve. |
| offset | string | – | The initial record. e.g. 0 is the last login, 100 will be the 100th most recent login. |
| userId | string | – | The Id of the user. |
No output schema declared.
No examples provided.
retrieveUserWithId ~75
Retrieves the user for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| X-FusionAuth-TenantId | string | – | The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped. |
| userId | string | yes | The Id of the user. |
No output schema declared.
No examples provided.
retrieveVersionWithId ~17
Retrieves the FusionAuth version string.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
retrieveWebAuthnCredentialsForUserWithId ~37
Retrieves all WebAuthn credentials for the given user.
| Name | Type | Req | Description |
|---|---|---|---|
| userId | string | – | The user's ID. |
No output schema declared.
No examples provided.
retrieveWebAuthnCredentialWithId ~39
Retrieves the WebAuthn credential for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| id | string | yes | The Id of the WebAuthn credential. |
No output schema declared.
No examples provided.
retrieveWebhook ~33
Retrieves the webhook for the given Id. If you pass in null for the Id, this will return all the webhooks.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
retrieveWebhookAttemptLogWithId ~42
Retrieves a single webhook attempt log for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| webhookAttemptLogId | string | yes | The Id of the webhook attempt log to retrieve. |
No output schema declared.
No examples provided.
retrieveWebhookEventLogWithId ~42
Retrieves a single webhook event log for the given Id.
| Name | Type | Req | Description |
|---|---|---|---|
| webhookEventLogId | string | yes | The Id of the webhook event log to retrieve. |
No output schema declared.
No examples provided.
retrieveWebhookWithId ~48
Retrieves the webhook for the given Id. If you pass in null for the Id, this will return all the webhooks.
| Name | Type | Req | Description |
|---|---|---|---|
| webhookId | string | yes | The Id of the webhook. |
No output schema declared.
No examples provided.
revokeRefreshTokenByIdWithId ~56
Revokes a single refresh token by the unique Id. The unique Id is not sensitive as it cannot be used to obtain another JWT.
| Name | Type | Req | Description |
|---|---|---|---|
| tokenId | string | yes | The unique Id of the token to delete. |
No output schema declared.
No examples provided.
revokeUserConsentWithId ~33
Revokes a single User consent by Id.
| Name | Type | Req | Description |
|---|---|---|---|
| userConsentId | string | yes | The User Consent Id |
No output schema declared.
No examples provided.
searchApplicationsWithId ~31
Searches applications with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for Applications |
No output schema declared.
No examples provided.
searchAuditLogsWithId ~34
Searches the audit logs with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | The JSON request body. |
No output schema declared.
No examples provided.
searchConsentsWithId ~34
Searches consents with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for Consents |
No output schema declared.
No examples provided.
searchEmailTemplatesWithId ~34
Searches email templates with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for email templates |
No output schema declared.
No examples provided.
searchEntitiesByIdsWithId ~44
Retrieves the entities for the given Ids. If any Id is invalid, it is ignored.
| Name | Type | Req | Description |
|---|---|---|---|
| ids | string | – | The entity ids to search for. |
No output schema declared.
No examples provided.
searchEntitiesWithId ~31
Searches entities with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for entities |
No output schema declared.
No examples provided.
searchEntityGrantsWithId ~35
Searches Entity Grants with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for entity grants. |
No output schema declared.
No examples provided.
searchEntityTypesWithId ~35
Searches the entity types with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for entity types. |
No output schema declared.
No examples provided.
searchEventLogsWithId ~34
Searches the event logs with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | The JSON request body. |
No output schema declared.
No examples provided.
searchGroupMembersWithId ~34
Searches group members with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for Group Members. |
No output schema declared.
No examples provided.
searchGroupsWithId ~31
Searches groups with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for Groups. |
No output schema declared.
No examples provided.
searchIdentityProvidersWithId ~34
Searches identity providers with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for Identity Providers |
No output schema declared.
No examples provided.
searchIPAccessControlListsWithId ~40
Searches the IP Access Control Lists with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for IP ACLs . |
No output schema declared.
No examples provided.
searchKeysWithId ~31
Searches keys with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for Keys |
No output schema declared.
No examples provided.
searchLambdasWithId ~35
Searches lambdas with the specified criteria and pagination.
| Name | Type | Req | Description |
|---|---|---|---|
| requestBody | object | – | Search request for Lambdas |
No output schema declared.
No examples provided.
What is the io.fusionauth/mcp-api server?
io.fusionauth/mcp-api is listed in the public MCP registry as io.fusionauth/mcp-api. Preview release of FusionAuth API MCP server. This page covers its npm package (@fusionauth/mcp-api).
Is the io.fusionauth/mcp-api server safe to use?
io.fusionauth/mcp-api scores 79 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 24 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.fusionauth/mcp-api server expose?
io.fusionauth/mcp-api exposes 310 tools: retrieveJsonWebKeySetWithId, retrieveOpenIdConfigurationWithId, createAPIKey, retrieveAPIKeyWithId, updateAPIKeyWithId, and 305 more. Their descriptions and schemas cost roughly 22,835 tokens of context every time the server is loaded.
Is the io.fusionauth/mcp-api server still maintained?
io.fusionauth/mcp-api is still listed as active in the MCP registry. We last reached this channel on 24 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.fusionauth/mcp-api server under?
io.fusionauth/mcp-api declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.