SuperTokens MCP. Manage roles, sessions, and accounts via conversation.

Listen up. This server handles your application's whole identity layer—everything from sign-up to session termination and permissions. You run this through your AI client, and it gives you tools for managing user lifecycles, securing sessions, and handling Role-Based Access Control (RBAC) without ever having to write manual backend code yourself.

When you're setting up a new user identity, you can register someone completely fresh using signup_user. If the person already exists but you need their full profile details, you just call get_user and grab everything. You don't wanna do it one by one though; if you got a bunch of accounts to onboard, you use bulk_import_users to dump them into the system using provided data sets.

If a user account is active but you need to wipe out some specific, non-core tracking info—say, old preferences or temporary flags—you can run delete_user_metadata. Conversely, if you gotta write new custom key/value metadata for a profile, you use update_user_metadata, and if you just wanna peek at what's stored there without touching the core user data, you call get_user_metadata.

Keeping users logged in is all about sessions. When they first log in with their credentials, you run signin_user to authenticate them and start a brand new session token. If they're still browsing but haven't done anything that requires re-login, you extend the lifespan of their current access using refresh_session.

But if things go sideways, or they just logged out, you immediately invalidate all access by calling remove_session on their specific user ID. To start them from scratch, you can also manually create a brand new authenticated session token for any given user ID with create_session.

Permissions—that's where the real power is. You define what people are allowed to do using roles. First, you check out all available roles by calling list_roles. If you need to build a whole new permission tier or tweak an existing one, you use create_or_update_role to set those rules and permissions.

Once the role is solid, you assign it directly to any user using assign_role_to_user. To see what permissions are currently assigned to a specific person, you check their list by running list_user_roles. The whole system works so you can manage who has access without touching database queries.

For account integrity, sometimes users have multiple IDs tied together. You connect two separate accounts that used to be floating around using link_accounts to tie them into one primary identity. If the user needs to break up those connections—maybe they started a new profile or something—you run unlink_accounts and restore them to independent profiles.

This server also handles isolated environments, so if you're dealing with multiple clients or tenants, you can get the full configuration and details of an existing tenant environment by calling get_tenant, or you can set up a whole new sandboxed area for a client using create_or_update_tenant.

It’s seriously comprehensive. You manage everything from user creation (signup_user), to fetching core data (get_user), to managing complex permissions and account linkages, all through simple prompts given to your AI agent.