Userfront MCP for AI. Control identity, roles, and tenants programmatically.

Userfront MCP Server: Identity and Access Management

Listen up. This server lets your AI agent manage an entire identity infrastructure for your applications. You don't gotta click through some dashboard just to make changes; you tell your agent what to do, and it handles the complex calls—everything from setting up a new tenant root to revoking a single API key.

Managing Users:
You can create brand-new user accounts with create_user, or update existing records using create_or_update_user. Need to clean house? You delete users permanently via delete_user. For bulk operations, you initiate the process by running create_user_import and then check the job status using get_user_import; once done, you can run process_user_import to handle the file.

To find specific accounts, use find_users, or pull a user's full profile details with get_user. If a key user needs their account reactivated, you change their status using mark_user_active; otherwise, if they need an invite sent out, run invite_user or grant them specific permissions through invite_role. To keep tabs on who's logged in, get_user_sessions reads all active security sessions for a user, and you can force everyone off the grid using logout_user.

Building Out Your Organization (Multi-Tenancy):
To structure complex systems, you start by creating an entirely new primary tenant account with create_tenant. If that parent needs sub-accounts, you establish them using create_child_tenant. You can search for available organizational boundaries and list them all using find_tenants, or grab the full metadata for a specific tenant via get_tenant.

Need to tweak a tenant's settings? Use update_tenant to modify its metadata. Remember, you can delete an entire tenant—and everything connected to it—with delete_tenant.

Controlling Permissions and Roles:
Access control is where this thing shines. You define global roles for the whole application using create_role, then retrieve every available definition with list_roles. If a role only applies to one specific client, you define it locally using create_tenant_role and view all those local rules with list_tenant_roles.

To assign permissions, you apply global roles across the platform via set_user_roles, or restrict access within a single tenant boundary by setting user roles with set_tenant_user_roles. You can also list what roles are available for a specific tenant using list_tenant_roles.

Handling Security and Credentials:
Security is everything, so we got tools for that. For API keys, you generate new ones with create_api_key, review all existing keys by running list_api_keys, or check if a key is still good using verify_api_key. If a key gets compromised, you delete it immediately with delete_api_key or instantly deactivate it with invalidate_api_key.

When dealing with JWT tokens, your agent can read the required format for token creation via get_jwt_format, see all available claims using get_jwt_available_claims, and fetch the public keys used by the platform with get_jwks or list_jwt_keys. To issue a custom access token for unique flows, you use create_custom_jwt; if your token rules change, you can update them with update_jwt_format.

Cleanup and Maintenance:
When you're done with old definitions, you remove global roles using delete_role, or wipe out user records with delete_user. Similarly, you clean up API keys by running the deletion functions. For tenant data, if a parent account is gone, you delete it with delete_tenant.

This suite gives your agent everything needed to manage users, structure multi-tenancies, and control every aspect of access—no manual clicking required.