# BoxyHQ (Enterprise SSO) MCP for AI Agents AI Agent Connect

> BoxyHQ (Enterprise SSO) lets you manage SAML and OIDC connections and automate user provisioning via SCIM. Connect your BoxyHQ instance to your AI agent to handle enterprise auth workflows, audit existing connections, and manage directory syncs without jumping between different dashboards. It gives you a way to handle complex identity tasks using natural language.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_mklve50aPp8ZWYnoHIPytmbMOI56yquxuMIE9WQ1/ai-agent-connect
- **Tags:** sso, saml, oidc, scim, user-provisioning, enterprise-auth, audit-logs

## Description

Imagine you're trying to onboard a new enterprise client. Usually, that means jumping into a dashboard, copying XML metadata, setting up SAML attributes, and then figuring out how to get the user provisioning right via SCIM. It's a lot of context switching. With this Connector, you just tell your AI agent what needs to happen. You can ask it to spin up a new connection for a specific product, grab the directory groups for a tenant, or audit what's currently live. It handles the heavy lifting of interacting with the platform so you don't have to. It's one of the many specialized tools you can find in the Vinkius catalog to get your identity stack under control. Instead of manual copy-pasting, you're just describing the desired state of your SSO environment and letting the agent execute the changes. You get to stop being a copy-paste monkey and start being an engineer who actually solves problems.

## Tools

### get_directory_groups
Lists every group within a specific tenant or product directory. This helps you see exactly who has access to what.

### get_connections
Fetches a list of all SSO connections currently active. It's great for auditing your entire setup in one go.

### health_check
Verifies that the BoxyHQ service is running correctly. It's the quickest way to see if your connection to the platform is active.

### create_directory
Sets up a new SCIM 2.0 directory for automated user syncing. This is the primary tool for onboarding new enterprise customers.

### delete_connection
Removes an SSO connection from your environment. Use it to clean up old connections and maintain a tight security posture.

### get_directory_users
Pulls a list of all users assigned to a directory. Use this to verify that user syncing is working correctly.

### update_connection
Modifies the settings of an existing SSO connection. Use this to change metadata or update security configurations on the fly.

### add_connection
Creates a new SAML or OIDC connection for a product. You can provide a metadata URL or raw XML to get it running fast.

## Prompt Examples

**Prompt:** 
```
Add a new SAML connection for the 'Acme Corp' tenant using this URL: https://idp.example.com/metadata.xml
```

**Response:** 
```
I've successfully created the SAML connection for Acme Corp. The Client ID is `conn_abc123`. You can now use this for SSO authentication.
```

**Prompt:** 
```
List all the SSO connections we have for the 'HR-Portal' product.
```

**Response:** 
```
I found 3 connections for 'HR-Portal':

| Connection Name | Type | Status |
| :--- | :--- | :--- |
| Globex Corp | SAML | Active |
| Initech | OIDC | Active |
| Umbrella | SAML | Active |

Which one would you like to inspect?
```

**Prompt:** 
```
Create a new SCIM directory for 'Client-Alpha' and tell me the base URL for their Okta sync.
```

**Response:** 
```
The Okta SCIM directory for Client-Alpha has been created. 

**SCIM Base URL:** `https://sso.boxyhq.com/api/scim/v2.0/client-alpha` 

Please provide this to the customer to start syncing users.
```

## Capabilities

### Create new SAML or OIDC connections
Ask your agent to add a new connection for a specific product or tenant.

### Automate user provisioning with SCIM 2.0
Set up SCIM directories to sync users automatically from your identity provider.

### Audit connection metadata across tenants
Retrieve detailed connection info using tenant IDs or product IDs.

### Update existing SSO security settings
Modify existing connections to update metadata or security configurations.

### List all users in a directory
Get a full list of users assigned to a specific tenant or product directory.

### Check the health of the BoxyHQ service
Verify that your connection to the platform is active and running correctly.

### Remove stale or unnecessary connections
Delete old SSO connections to keep your security posture clean.

## Use Cases

### Onboarding a new client
A DevOps lead asks the agent to create a new SAML connection for a specific app and then set up a SCIM directory for user syncing.

### Security Audit
A security engineer asks the agent to list all SSO connections and find any that are missing updated metadata.

### Troubleshooting
A product manager asks the agent to check the health of the BoxyHQ service and list all users in a specific directory to see if a sync failed.

### Cleanup
An admin asks the agent to find and delete stale OIDC connections that are no longer being used by any products.

## Benefits

- Stop manual data entry by using add_connection to spin up SAML and OIDC links instantly.
- Automate onboarding with create_directory to set up SCIM 2.0 sync for new customers.
- Audit your security posture quickly by using get_connections to see every active SSO link.
- Keep your environment clean by using delete_connection to prune old or unused auth methods.
- Verify integration health on demand with health_check to ensure your enterprise users aren't locked out.
- Get instant visibility into tenant data using get_directory_users and get_directory_groups.

## How It Works

The bottom line is you get a natural language interface for your enterprise identity management.

1. Subscribe to this Connector and grab your BoxyHQ Instance URL and API Key.
2. Plug those credentials into your AI client.
3. Start asking your agent to manage your SSO connections and SCIM directories.

## Frequently Asked Questions

**Can the BoxyHQ (Enterprise SSO) MCP help with SAML setup?**
Yes, it allows you to create and manage SAML connections using natural language. You can provide a metadata URL or raw XML, and the Connector will handle the configuration for you.

**How does BoxyHQ (Enterprise SSO) handle user provisioning?**
It automates user provisioning by creating and managing SCIM 2.0 directories. This connects your identity provider to your products for automated syncing.

**Can I use BoxyHQ (Enterprise SSO) to audit my existing connections?**
Yes, you can ask your agent to list all active SSO connections or retrieve specific metadata for any tenant to ensure your security posture is up to date.

**Does BoxyHQ (Enterprise SSO) support OIDC?**
Yes, the Connector supports both SAML and OIDC connections, allowing you to manage various types of enterprise authentication in one place.

**How do I check if my BoxyHQ instance is online using this Connector?**
You can simply ask your agent to check the service health. It will verify that the BoxyHQ platform is running correctly and reachable.

**Can I delete old SSO connections with BoxyHQ (Enterprise SSO)?**
Yes, you can use the Connector to remove stale or unnecessary connections. This helps keep your environment clean and reduces your security surface area.

**Can I configure a SAML connection using just the metadata URL?**
Yes! Use the `add_connection` tool and provide the `metadataUrl`. The server will fetch and process the IdP configuration automatically.

**How do I find the clientID for an existing connection?**
You can use the `get_connections` tool by providing the `tenant` and `product` IDs. It will return all matching connections including their unique clientIDs.

**Does this support SCIM for automated user provisioning?**
Absolutely. Use the `create_directory` tool to set up a SCIM 2.0 directory for providers like Okta, Azure AD, or Google, including webhook support for events.