Auth0 MCP Server

Name: Auth0 MCP Server
Author: Auth0

Manage an Auth0 tenant's applications, APIs, Actions, forms and logs from an MCP client

Official · Auth0 TypeScript Local · stdio Security Developer tools

GitHub npm Website

66 popularity score ★ 122 ↓ 12k/wk

Connect your client

Local (npm)

Add in one click

Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Opens the app, which asks before it adds the server.

Or add it by command or config

FirstTerminal

npx @auth0/auth0-mcp-server init

Claude CodeTerminal

claude mcp add auth0 -- npx -y @auth0/auth0-mcp-server run

Claude Desktopclaude_desktop_config.json

{
  "mcpServers": {
    "auth0": {
      "command": "npx",
      "args": [
        "-y",
        "@auth0/auth0-mcp-server",
        "run"
      ]
    }
  }
}

Cursor~/.cursor/mcp.json

{
  "mcpServers": {
    "auth0": {
      "command": "npx",
      "args": [
        "-y",
        "@auth0/auth0-mcp-server",
        "run"
      ]
    }
  }
}

VS Code.vscode/mcp.json

{
  "servers": {
    "auth0": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@auth0/auth0-mcp-server",
        "run"
      ]
    }
  }
}

Codex~/.codex/config.toml

[mcp_servers.auth0]
command = "npx"
args = ["-y", "@auth0/auth0-mcp-server", "run"]

Gemini CLITerminal

gemini mcp add --scope user auth0 npx -- -y @auth0/auth0-mcp-server run

Settings 4

`AUTH0_MCP_READ_ONLY`	Optional: Set to true to expose only list and get tools; same as --read-only.
`AUTH0_MCP_TOOLS`	Optional: Comma-separated glob of tools to expose, e.g. auth0_list_,auth0_get_; same as --tools (default *).
`AUTH0_MCP_ANALYTICS`	Optional: Set to false to stop usage events being sent to Heap Analytics.
`DEBUG`	Optional: Set to auth0-mcp for detailed logging.

What it does

Auth0's own MCP server runs on your machine and calls the Auth0 Management API for one tenant. Through it an assistant can list, inspect, create and update applications and resource servers (APIs), grant an application access to an API, write, update and deploy Actions, build and publish Forms, and read tenant logs to debug failed logins.

Two onboarding tools go further than the Management API: `auth0_onboarding` creates an application set up for a given web framework and writes its domain, client ID and secret into the project's env file (`.env.local` when none exists), and `auth0_get_quickstart_guide` returns code for adding the Auth0 SDK to a project. The server masks fields such as `client_secret` and tokens in tool responses.

Sign-in is a separate step: `npx @auth0/auth0-mcp-server init` runs the OAuth device flow in a browser, lets you pick a tenant and the Management API scopes to grant (none are selected by default), and stores the token in the system keychain; `init --client claude|claude-code|cursor|vscode|windsurf|gemini` also writes the client's config. The `run` command then starts the stdio server and checks the token first. Tool exposure can be narrowed with `--read-only` or a `--tools` glob such as `auth0_list_*,auth0_get_*`; `--read-only` wins when both are given.

Version 0.1.0-beta.19 registers 24 tools (src/tools/index.ts). Not in the README: each tool call is reported to Heap Analytics (heapanalytics.com) with the tool name, success flag, package version, OS, CPU architecture and Node version under a random per-session ID, unless `AUTH0_MCP_ANALYTICS=false` is set (src/utils/analytics.ts).

What it needs

Runtime	Node.js 18+

Node.js 18 or later (run through npx). An Auth0 account and tenant, signed in once with `npx @auth0/auth0-mcp-server init` (browser device flow) before the client starts the server; repeat it when the token expires or to switch tenant. An OS keychain to hold the token (on Linux a Secret Service over D-Bus; the Codex example sets DBUS_SESSION_BUS_ADDRESS). Private Cloud tenants cannot use the device flow and must run `init` with `--auth0-domain`, `--auth0-client-id` and `--auth0-client-secret` of a machine-to-machine app.

Limits

Its makers label it beta, provided as is, not recommended for production or critical workloads, with features that may change without notice. Calls count against the tenant's Management API rate limits for its subscription plan. Coverage is limited to applications, resource servers, client grants, Actions, Forms and logs: there are no tools for users, roles, connections or organizations, and no delete tools. One tenant per signed-in session. Usage analytics are on by default (see above). The MCP registry entry still points at 0.1.0-beta.10 while npm has 0.1.0-beta.19.

Who it suits

Suits developers who already use Auth0 and want to set up applications and APIs, edit and deploy Actions, or dig through login logs without opening the dashboard, and those onboarding a new web project who want credentials written straight into its env file. Because tools can create and deploy changes on a live tenant, point it at a development tenant or run it with `--read-only`; teams wanting a stable, supported tool for production tenants should wait for it to leave beta. It manages tenant configuration only, so it does not suit user administration.

Tools 24

auth0_list_applications: List the tenant's applications, optionally filtered by name
auth0_get_application: Show one application's settings
auth0_create_application: Create a new application of a chosen type
auth0_update_application: Change an application's settings, such as callback or logout URLs
auth0_save_credentials_to_file: Write an application's credentials into a project env file and add it to .gitignore
auth0_onboarding: Create an application set up for a framework and save its credentials to the project
auth0_get_quickstart_guide: Return framework setup code for the Auth0 SDK and fix callback URLs
auth0_list_resource_servers: List the tenant's APIs (resource servers)
auth0_get_resource_server: Show one API's settings and scopes
auth0_create_resource_server: Create a new API with its identifier and scopes
auth0_update_resource_server: Change an API's scopes, token lifetime or signing settings
auth0_create_application_grant: Authorize an application to call an API with given scopes
auth0_list_actions: List the tenant's Actions
auth0_get_action: Show one Action, including its code
auth0_create_action: Create a new Action
auth0_update_action: Change an Action's code or settings
auth0_deploy_action: Deploy an Action so it runs live
auth0_list_logs: List tenant log events, such as logins and failures
auth0_get_log: Show one log event by ID
auth0_list_forms: List the tenant's Forms
auth0_get_form: Show one Form's configuration
auth0_create_form: Create a new Form
auth0_update_form: Change a Form's content or styling
auth0_publish_form: Publish a Form so it goes live

Popularity

66 popularity score, on our list (the bar is 36)

★ 122 ↓ 12k/wk

GitHub stars	122	25.1 points
Stars in 30 days	+0	0 points
npm downloads, last week	12,293	32.7 points
Official server	Yes	8 points

Measured 2026-11-07. How the score works.

Where it is published

Code	auth0/auth0-mcp-server ★ 122
npm	@auth0/auth0-mcp-server 0.1.0-beta.19, 2026-08-13

What it can reach

Runs	On your machine
Reaches	Your account at a service, The internet, Files on your machine
Changes things	Yes: it can write, send, create or delete
Sign-in	OAuth sign-in
Licence	MIT (npm)
Last code change	2026-08-13

Runs locally over stdio and calls the Auth0 Management API with a token from the OAuth device flow, kept in the OS keychain; `logout` removes it. What it can change is bounded by the scopes granted at `init` (none preselected) and by `--read-only`/`--tools`. With write scopes it can create and update applications, APIs, client grants, Forms and Actions, and deploy Actions that run on every matching login. Two tools write client IDs and secrets into a project env file on local disk. Secrets are masked in tool responses. By default it sends tool names, success flags and OS/Node details to heapanalytics.com; `AUTH0_MCP_ANALYTICS=false` turns that off.

Over time

GitHub stars 122 +0

122121

8 Oct 20267 Nov 2026

npm downloads a week 12k +12k (+3614 %)

17k75

20 Oct 20257 Nov 2026

Before the site measured it, read from npm's daily download counts.

Popularity score 66 +9 (+15 %)

6757

8 Oct 20267 Nov 2026

What is rising across the directory

Sources

Page checked 2026-10-14.

Badge for your README

Shows this server's rank in its category, and stars for a server that runs on your machine. It updates every hour.

MarkdownREADME.md

[![Auth0 MCP Server on EveryMCPServer](https://everymcpserver.com/badge/auth0-mcp-server.svg)](https://everymcpserver.com/servers/auth0-mcp-server)

Connect your client

Add in one click

Or add it by command or config

Settings 4

What it does

What it needs

Limits

Who it suits

Tools 24

Similar servers

CodeQL Development MCP Server

1MCP

Knock MCP Server

Backstage MCP Actions

GitHub MCP Server

Appwrite MCP server