Corbado MCP. Manage user accounts, tokens, and complex login flows from chat.

Corbado manages your entire identity layer. You connect your AI client here to handle every step of a user's lifecycle, from initial sign-up through session revocation. This server gives your agent direct access to core authentication logic, letting you audit and modify account state using natural language commands.

Managing User Accounts

You can control the full user lifecycle directly. Use create_user to build a brand-new Corbado account, or call get_user with an ID to pull all detailed records for any specific user. If you need to modify basic profile details—like changing a name or role—you'll use update_user. To clean up accounts, you can delete a full record using delete_user, or if the current agent is logged in and needs to log out, it uses logout_me or calls delete_connect_token.

Controlling Credentials and Identifiers

Managing what a user is requires multiple steps. To add a new login method—like an email address or phone number—you use create_identifier. If you need to change contact info, the agent uses update_identifier or, for specific cases, update_auth_identifier. You can list every identifier attached to the current user's profile with list_identifiers, and if a credential is stale or incorrect, you can remove it entirely using delete_identifier.

For managing hardware keys, tools like start_passkey_append allow you to add new passkeys; you'll confirm ownership later with finish_passkey_append, and list all existing ones via list_connect_passkeys.

Authentication Flows: Starting the Login

When a user needs access, your agent starts specific flows. For basic sign-ups, it calls init_signup. If you're starting from scratch with an unknown login method, use init_auth_process. To start the primary, foundational login process for an existing account, you run init_login, while the standardized Connect workflow kicks off with init_connect_login or start_connect_login.

For enterprise environments, Single Sign-On starts by calling start_sso, which redirects users through external identity providers. If a user has passkeys, they start the process using start_passkey_login, and if you need to verify ownership of an identifier first, use start_identifier_verify.

Authentication Flows: Completing and Securing Sessions

The server handles all state transitions after initial steps are taken. After providing credentials, the agent completes a standard login with complete_auth_process. If it's SSO, you finish the sequence using finish_sso once the identity provider confirms the user. When logging in with passkeys, the flow wraps up by executing finish_passkey_login, which relies on verifying signed data via verify_signed_data.

You can also complete a connection login using finish_connect_login or finalize an identifier verification with finish_identifier_verify. If an authentication process gets stuck or fails midway, you use reset_auth_process to clear the state and let the user start over.

Monitoring Activity and State

The system gives you granular visibility into who's logged in. Call get_me for basic details about the currently authenticated user. To see detailed information on any specific account, use get_user. For session control, running list_sessions outputs every active connection ID. If a session needs to end immediately, you can force it closed using revoke_session, or if the current agent logs out, it calls logout_me.

You'll also need refresh_me when you want to extend an existing session without forcing the user to re-enter their password.