io.fusionauth/mcp-api

NPM · @FUSIONAUTH/MCP-API · SCANNED AUG 3

Preview release of FusionAuth API MCP server

Available components

+20 this week 66 66 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security88

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (110 of 111), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (Apache-2.0).Pass
Actively maintained (last published 118 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability60

AI-judged instruction clarity (fair).Partial
Tool/resource definitions use about 22835 tokens (~73/item across 310 items; 310 tools + 0 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage99

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
97% of tool parameters carry a description.Partial

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @fusionauth/mcp-api

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

# add to Codex CLI

codex mcp add io-fusionauth-mcp-api -- npx -y @fusionauth/mcp-api

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-fusionauth-mcp-api": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@fusionauth/mcp-api"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add io-fusionauth-mcp-api --command npx --arg -y --arg @fusionauth/mcp-api

# ~/.hermes/config.yaml

mcp_servers:
  io-fusionauth-mcp-api:
    command: "npx"
    args: ["-y", "@fusionauth/mcp-api"]

// mcp.json

{
  "mcpServers": {
    "io-fusionauth-mcp-api": {
      "command": "npx",
      "args": [
        "-y",
        "@fusionauth/mcp-api"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +30
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Security disclosure: fail → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- License: unverified → pass ▲ functional
- Schema quality: unverified → fair ▲ functional
- Licence: Apache-2.0 functional
1 Aug 26 +15
- Malware scan: unverified → pass ▲ security
31 Jul 26 −25
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
27 Jul 26 46

First indexed and scored.

Show 2 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@fusionauth/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 110 packages

110 packages in the resolved dependency tree · 109 deprecated · 32 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 310 exposed · ~22,835 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

searchLoginRecordsWithId ~34

Searches the login records with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

searchTenantsWithId ~33

Searches tenants with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for Tenants

No output schema declared.

No examples provided.

searchThemesWithId ~31

Searches themes with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for Themes.

No output schema declared.

No examples provided.

searchUserCommentsWithId ~34

Searches user comments with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for user comments

No output schema declared.

No examples provided.

searchUsersByIdsWithId ~45

Retrieves the users for the given Ids. If any Id is invalid, it is ignored.

Input Output Examples

Name	Type	Req	Description
ids	string	—	The user Ids to search for.

No output schema declared.

No examples provided.

searchUsersByQueryWithId ~34

Retrieves the users for the given search criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search API request.

No output schema declared.

No examples provided.

searchWebhookEventLogsWithId ~38

Searches the webhook event logs with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Webhook event log search request.

No output schema declared.

No examples provided.

searchWebhooksWithId ~34

Searches webhooks with the specified criteria and pagination.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Search request for webhooks

No output schema declared.

No examples provided.

sendEmailWithId ~67

Send an email using an email template Id. You can optionally provide <code>requestData</code> to access key value pairs in the email template.

Input Output Examples

Name	Type	Req	Description
emailTemplateId	string	yes	The Id for the template.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

sendFamilyRequestEmailWithId ~59

Sends out an email to a parent that they need to register and create a family or need to log in and add a child to their existing family.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	API request for sending out family requests to parent's.

No output schema declared.

No examples provided.

sendPasswordlessCodeWithId ~37

Send a passwordless authentication code in an email to complete login.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

sendTwoFactorCodeForEnableDisableWithId ~44

Send a Two Factor authentication code to assist in setting up Two Factor authentication or disabling.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

sendTwoFactorCodeForLoginUsingMethodWithId ~65

Send a Two Factor authentication code to allow the completion of Two Factor authentication.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.
twoFactorId	string	yes	The Id returned by the Login API necessary to complete Two Factor authentication.

No output schema declared.

No examples provided.

sendVerifyIdentityWithId ~39

Send a verification code using the appropriate transport for the identity type being verified.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Verify Send API request object.

No output schema declared.

No examples provided.

startIdentityProviderLoginWithId ~44

Begins a login request for a 3rd party login that requires user interaction such as HYPR.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

startPasswordlessLoginWithId ~78

Start a passwordless login request by generating a passwordless code. This code can be sent to the User using the Send Passwordless Code API or using a mechanism outside of FusionAuth. The passwordless login is completed by using the Passwordless Login API with this code.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

startTwoFactorLoginWithId ~156

Start a Two-Factor login request by generating a two-factor identifier. This code can then be sent to the Two Factor Send API (/api/two-factor/send)in order to send a one-time use code to a user. You can also use one-time use code returned to send the code out-of-band. The Two-Factor login is completed by making a request to the Two-Factor Login API (/api/two-factor/login). with the two-factor identifier and the one-time use code. This API is intended to allow you to begin a Two-Factor login outside a normal login that originated from the Login API (/api/login).

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

startVerifyIdentityWithId ~73

Start a verification of an identity by generating a code. This code can be sent to the User using the Verify Send API Verification Code API or using a mechanism outside of FusionAuth. The verification is completed by using the Verify Complete API with this code.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

startWebAuthnLoginWithId ~47

Start a WebAuthn authentication ceremony by generating a new challenge for the user

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	API request to start a WebAuthn authentication ceremony

No output schema declared.

No examples provided.

startWebAuthnRegistrationWithId ~47

Start a WebAuthn registration ceremony by generating a new challenge for the user

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	API request to start a WebAuthn registration ceremony

No output schema declared.

No examples provided.

twoFactorLoginWithId ~32

Complete login using a 2FA challenge

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

updateAPIKeyWithId ~48

Updates an API key with the given Id.

Input Output Examples

Name	Type	Req	Description
keyId	string	yes	The Id of the API key to update.
requestBody	object	—	Authentication key request object.

No output schema declared.

No examples provided.

updateApplicationRoleWithId ~113

Updates the application role with the given Id for the application.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application that the role belongs to.
requestBody	object	—	The Application API request object.
roleId	string	yes	The Id of the role to update.

No output schema declared.

No examples provided.

updateApplicationWithId ~109

Updates the application with the given Id. OR Reactivates the application with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application to update.
reactivate	string	—	—
requestBody	object	—	The Application API request object.

No output schema declared.

No examples provided.

updateConnectorWithId ~45

Updates the connector with the given Id.

Input Output Examples

Name	Type	Req	Description
connectorId	string	yes	The Id of the connector to update.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

updateConsentWithId ~91

Updates the consent with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
consentId	string	yes	The Id of the consent to update.
requestBody	object	—	API request for User consent types.

No output schema declared.

No examples provided.

updateEmailTemplateWithId ~92

Updates the email template with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
emailTemplateId	string	yes	The Id of the email template to update.
requestBody	object	—	Email template request.

No output schema declared.

No examples provided.

updateEntityTypePermissionWithId ~72

Updates the permission with the given Id for the entity type.

Input Output Examples

Name	Type	Req	Description
entityTypeId	string	yes	The Id of the entityType that the permission belongs to.
permissionId	string	yes	The Id of the permission to update.
requestBody	object	—	Entity Type API request object.

No output schema declared.

No examples provided.

updateEntityTypeWithId ~50

Updates the Entity Type with the given Id.

Input Output Examples

Name	Type	Req	Description
entityTypeId	string	yes	The Id of the Entity Type to update.
requestBody	object	—	Entity Type API request object.

No output schema declared.

No examples provided.

updateEntityWithId ~89

Updates the Entity with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
entityId	string	yes	The Id of the Entity to update.
requestBody	object	—	Entity API request object.

No output schema declared.

No examples provided.

updateFormFieldWithId ~50

Updates the form field with the given Id.

Input Output Examples

Name	Type	Req	Description
fieldId	string	yes	The Id of the form field to update.
requestBody	object	—	The FormField API request object.

No output schema declared.

No examples provided.

updateFormWithId ~43

Updates the form with the given Id.

Input Output Examples

Name	Type	Req	Description
formId	string	yes	The Id of the form to update.
requestBody	object	—	Form response.

No output schema declared.

No examples provided.

updateGroupMembersWithId ~29

Creates a member in a group.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Group Member Request

No output schema declared.

No examples provided.

updateGroupWithId ~89

Updates the group with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
groupId	string	yes	The Id of the group to update.
requestBody	object	—	Group API request object.

No output schema declared.

No examples provided.

updateIdentityProviderWithId ~49

Updates the identity provider with the given Id.

Input Output Examples

Name	Type	Req	Description
identityProviderId	string	yes	The Id of the identity provider to update.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

updateIntegrationsWithId ~27

Updates the available integrations.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	The Integration Request

No output schema declared.

No examples provided.

updateIPAccessControlListWithId ~56

Updates the IP Access Control List with the given Id.

Input Output Examples

Name	Type	Req	Description
accessControlListId	string	yes	The Id of the IP Access Control List to update.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

updateKeyWithId ~45

Updates the key with the given Id.

Input Output Examples

Name	Type	Req	Description
keyId	string	yes	The Id of the key to update.
requestBody	object	—	Key API request object.

No output schema declared.

No examples provided.

updateLambdaWithId ~45

Updates the lambda with the given Id.

Input Output Examples

Name	Type	Req	Description
lambdaId	string	yes	The Id of the lambda to update.
requestBody	object	—	Lambda API request object.

No output schema declared.

No examples provided.

updateMessageTemplateWithId ~52

Updates the message template with the given Id.

Input Output Examples

Name	Type	Req	Description
messageTemplateId	string	yes	The Id of the message template to update.
requestBody	object	—	A Message Template Request to the API

No output schema declared.

No examples provided.

updateMessengerWithId ~45

Updates the messenger with the given Id.

Input Output Examples

Name	Type	Req	Description
messengerId	string	yes	The Id of the messenger to update.
requestBody	object	—	The JSON request body.

No output schema declared.

No examples provided.

updateOAuthScopeWithId ~116

Updates the OAuth scope with the given Id for the application.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
applicationId	string	yes	The Id of the application that the OAuth scope belongs to.
requestBody	object	—	The Application Scope API request object.
scopeId	string	yes	The Id of the OAuth scope to update.

No output schema declared.

No examples provided.

updateRegistrationWithId ~104

Updates the registration for the user with the given Id and the application defined in the request.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	Registration API request object.
userId	string	yes	The Id of the user whose registration is going to be updated.

No output schema declared.

No examples provided.

updateSystemConfigurationWithId ~30

Updates the system configuration.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Request for the system configuration API.

No output schema declared.

No examples provided.

updateTenantWithId ~89

Updates the tenant with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
requestBody	object	—	The JSON request body.
tenantId	string	yes	The Id of the tenant to update.

No output schema declared.

No examples provided.

updateThemeWithId ~45

Updates the theme with the given Id.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	Theme API request object.
themeId	string	yes	The Id of the theme to update.

No output schema declared.

No examples provided.

updateUserActionReasonWithId ~55

Updates the user action reason with the given Id.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	User Action Reason API request object.
userActionReasonId	string	yes	The Id of the user action reason to update.

No output schema declared.

No examples provided.

updateUserActionWithId ~114

Updates the user action with the given Id. OR Reactivates the user action with the given Id.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
reactivate	string	—	—
requestBody	object	—	User Action API request object.
userActionId	string	yes	The Id of the user action to update.

No output schema declared.

No examples provided.

updateUserConsentWithId ~45

Updates a single User consent by Id.

Input Output Examples

Name	Type	Req	Description
requestBody	object	—	API response for User consent.
userConsentId	string	yes	The User Consent Id

No output schema declared.

No examples provided.

updateUserFamilyWithId ~109

Updates a family with a given Id. OR Adds a user to an existing family. The family Id must be specified.

Input Output Examples

Name	Type	Req	Description
X-FusionAuth-TenantId	string	—	The unique Id of the tenant used to scope this API request. Only required when there is more than one tenant and the API key is not tenant-scoped.
familyId	string	yes	The Id of the family to update.
requestBody	object	—	API request for managing families and members.

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug