Authentik Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Authentik Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for Authentik identity provider.
{
"mcpServers": {
"authentik": {
"command": "uvx",
"args": ["--refresh", "--extra-index-url", "https://nikitatsym.github.io/authentik-mcp/simple", "authentik-mcp"],
"env": {
"AUTHENTIK_URL": "https://auth.example.com",
"AUTHENTIK_TOKEN": "your-api-token"
}
}
}
}Where to paste:
~/Library/Application Support/Claude/claude_desktop_config.json.cursor/mcp.json in your project~/.claude.json top-level mcpServersOr use the setup wizard to generate the config.
Authentik admin panel → Directory → Tokens and App passwords → Create with API scope.
| Tool | Description |
|---|---|
authentik_read | Users, groups, apps, tokens, providers, outposts, crypto, RBAC (read-only) |
authentik_write | Create/update core resources (non-destructive) |
authentik_delete | Delete operations across all domains (destructive) |
authentik_flows_read | Flows, stages, policies, sources, events (read-only) |
authentik_flows_write | Create/update auth pipeline config (non-destructive) |
authentik_admin | Admin settings, system info, lifecycle |
Call any group with operation="help" to list available operations.
Apps are open to all authenticated users until gated. Restrict an app to a group/user by binding it: CreatePolicyBinding(target=<app pk>, group=<group pk>) (or user=) in authentik_flows_write; inspect gates with ListPolicyBindings / ShowPolicyBinding in authentik_flows_read. Policy bindings live under the authentik_flows_* groups, not the core ones.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.