# Logto MCP for AI Agents AI Agent Connect > Logto MCP lets you manage users, roles, and organizations in your Logto auth tenant directly from your AI agent. It handles identity management, RBAC, and security settings so you don't have to switch back to the dashboard. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_u6lgjC60ylv2DAB2TNiAX6cACbdDwEdBFrHQ2LmZ/ai-agent-connect - **Tags:** authentication, rbac, user-management, identity-provider, access-control, iam ## Description Logto lets you manage your identity infrastructure without jumping between your admin dashboard and your code editor. This Connector changes that by letting you handle your auth tenant directly through your agent. You can build out multi-tenant structures by creating organizations or setting up granular access rules without hunting for the right buttons in a web UI. If you need to troubleshoot a user's login issue, you can check their MFA status or update their profile details in seconds. It takes the friction out of routine identity tasks like provisioning new roles or auditing user permissions. Since Vinkius hosts this Connector, you can plug it into your existing workflow and let your agent handle the heavy lifting of user management while you stay focused on building your actual product. Instead of copy-pasting IDs or manually editing user metadata in a spreadsheet, you just tell your agent what needs to happen. Whether you are onboarding a new partner organization or revoking access for a departing employee, the process becomes a conversation rather than a series of tedious clicks. You get to keep your focus on the high-level architecture of your app while the agent handles the granular data entry of your identity provider. ## Tools ### verify_user_password Verify a specific user's password via the Management API. This is used for admin-level checks. ### create_resource Create a new API resource in your tenant. Use this to define specific access points for your app. ### create_role Create a new global role for your users. This helps you manage permissions at a high level. ### list_organization_users List all members of a specific organization. This helps you see who has access to a tenant. ### list_organizations List all organizations in your tenant. This gives you a bird's eye view of your multi-tenant setup. ### list_resources List all API resources in your tenant. This shows you what parts of your system are protected. ### create_organization Create a new organization for your multi-tenant app. This lets you group users and resources together. ### delete_user Delete a user from your Logto tenant. Use this to clean up accounts that are no longer needed. ### get_user Get the full details for a specific user. This is great for looking up metadata quickly. ### list_mfa_verifications List the MFA factors registered for a user. Use this to check security status without leaving your agent. ### get_my_account Get your own profile information from the Account API. It lets your agent see who you are. ### remove_mfa_verification Remove a specific MFA factor from a user. Use this when a user loses access to a security key. ### list_roles List all global roles in your tenant. Use this to see your current permission structure. ### send_verification_code Send an email or SMS code for verification. This helps you trigger account security checks. ### update_my_account Update your basic profile info like your name or avatar. This keeps your account details current. ### update_user Update an existing user's information in your tenant. This is useful for bulk updates or edits. ### list_user_roles List all roles assigned to a specific user. This helps you audit individual permissions. ### list_users List all users in your Logto tenant. Use this to get a quick count or overview of your user base. ### verify_password Verify a password to get a verification ID. Use this for secure authentication flows. ### bind_mfa_verification Bind a new MFA factor like TOTP or WebAuthn. This lets you set up multi-factor security quickly. ### update_my_account_primary_email Update or link a primary email for your account. Use this to change how you receive notifications. ### update_my_account_profile Update extended profile data like addresses. This lets you manage deeper user details. ### update_my_account_password Update your own account password. This lets you manage your security credentials via the agent. ## Prompt Examples **Prompt:** ``` List the first 10 users in my Logto tenant. ``` **Response:** ``` I've retrieved the user list for your Logto tenant. Here are the first 10 users: | User ID | Username | Status | | :--- | :--- | :--- | | `user_01` | `admin_main` | Active | | `user_02` | `dev_test_1` | Active | | `user_03` | `support_04` | Pending | | `user_04` | `qa_tester` | Active | | `user_05` | `billing_mgr` | Active | | `user_06` | `api_bot` | Active | | `user_07` | `guest_01` | Inactive | | `user_08` | `hr_portal` | Active | | `user_09` | `dev_test_2` | Active | | `user_10` | `ops_lead` | Active | Would you like to see the full details for any of these users? ``` **Prompt:** ``` Create a new User role called 'Support Agent' with a description. ``` **Response:** ``` I've created the new role for you. **Role Details:** - **Name:** Support Agent - **Description:** Provides access to user support tickets and basic profile management. - **Status:** Ready for assignment. You can now assign this role to any users in your tenant. ``` **Prompt:** ``` Show me all members of the organization with ID 'org_999'. ``` **Response:** ``` Fetching members for organization `org_999`... I found 3 members: - **Alice** (ID: `user_01`) - **Bob** (ID: `user_02`) - **Charlie** (ID: `user_03`) Would you like to see the specific permissions for any of these members? ``` ## Capabilities ### Create organizations Set up new multi-tenant structures for your users. ### Audit user roles See exactly what permissions are assigned to specific people. ### Update profile details Change names, avatars, and primary emails on the fly. ### Manage MFA factors Add or remove security verifications for your accounts. ### Provision API resources Define and list the resources your app can access. ## Use Cases ### Onboarding a new enterprise client A developer needs to set up a new multi-tenant structure for a partner. They ask the agent to use create_organization and create_role to establish the workspace. ### Auditing permissions for a security review A security engineer needs to verify who has access to what. They ask the agent to list_user_roles for a set of admin accounts to ensure least privilege. ### Troubleshooting a locked MFA account A support agent helps a user who lost their phone. They use the agent to list_mfa_verifications and then remove_mfa_verification to reset the user's access. ### Setting up a new multi-tenant organization An admin needs to group users for a specific department. They ask the agent to create_organization and then list_organization_users to verify the membership. ## Benefits - Audit permissions instantly by using list_user_roles to see exactly what a user can access. - Manage multi-tenant structures without the dashboard by creating organizations and listing_organizations. - Troubleshoot security issues quickly by using list_mfa_verifications to check active factors. - Update user profiles on the fly using update_user to keep your data accurate. - Automate onboarding by creating roles and resources using create_role and create_resource. ## How It Works The bottom line is you get full control over your identity management without leaving your AI client. 1. Subscribe to the Logto MCP on Vinkius. 2. Provide your Logto Management API credentials including your Endpoint, App ID, and App Secret. 3. Start managing your auth infrastructure from Claude, Cursor, or any MCP-compatible client. ## Frequently Asked Questions **Can I use Logto MCP to manage my users?** Yes, you can list, fetch, update, and delete users directly through your agent. This makes it much faster to handle account changes without logging into the dashboard. **How does Logto MCP help with RBAC?** It lets you create and list global roles and API resources. You can easily see which roles are assigned to specific users to maintain strict access control. **Can my agent update my Logto profile?** Yes, your agent can update your basic profile info like your name, avatar, and primary email. This keeps your account details current with a simple command. **Does Logto MCP support MFA management?** It does. You can list registered MFA factors, bind new factors like TOTP or WebAuthn, and remove old ones if a user loses access. **How do I set up organizations in Logto?** You can use the Connector to create new organizations and list their members. This is perfect for managing multi-tenant structures for your customers. **Can I audit permissions using Logto MCP?** Yes, you can list all global roles and resources in your tenant. You can also see the specific roles assigned to any individual user. **Can I see which roles are assigned to a specific user?** Yes! Use the `list_user_roles` tool with the target User ID to retrieve all global roles associated with that account. **Is it possible to manage multi-tenant organizations through this server?** Absolutely. You can use `list_organizations` to see existing ones, `create_organization` to add new ones, and `list_organization_users` to audit membership. **Can I update user profiles or suspend accounts?** Yes, the `update_user` tool allows you to modify the username, name, avatar, and the `isSuspended` status of any user.