@indranilokg/okta-mcp-server/mcpServer.js

Okta MCP (Model Context Protocol) server for managing Okta applications, users, and groups

#!/usr/bin/env node

import dotenv from "dotenv";
import express from "express";
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
import {
  CallToolRequestSchema,
  ErrorCode,
  ListToolsRequestSchema,
  McpError,
} from "@modelcontextprotocol/sdk/types.js";
import { discoverTools } from "./lib/tools.js";

import path from "path";
import { fileURLToPath } from "url";
import { 
  storeCredentials, 
  getCredentials, 
  getSessionInfo, 
  clearCredentials, 
  validateCredentials,
  isKeychainAvailable,
  getStorageInfo
} from "./lib/credentials.js";

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

dotenv.config({ path: path.resolve(__dirname, ".env") });

const SERVER_NAME = "okta-mcp-server";

// CLI argument parsing
const args = process.argv.slice(2);
const isSSE = args.includes("--sse");
const runCommand = args.includes("run") || (!args.includes("init") && !args.includes("session") && !args.includes("logout"));
const toolsFilter = args.includes("--tools") ? args[args.indexOf("--tools") + 1] : "*";

// Handle different commands
if (args.includes("init")) {
  await initCommand();
  process.exit(0);
} else if (args.includes("session")) {
  await sessionCommand();
  process.exit(0);
} else if (args.includes("logout")) {
  await logoutCommand();
  process.exit(0);
} else if (args.includes("--help") || args.includes("-h")) {
  console.log(`
Okta MCP Server

Usage:
  oktamcp <command> [options]

Commands:
  init               Initialize authentication with Okta
  run                Start the MCP server (default)
  session            Show current authentication status
  logout             Clear stored credentials

Options:
  --sse              Start in SSE mode instead of stdio
  --tools <filter>   Tool filter pattern (default: "*" for all tools)
  --help, -h         Show this help message

Setup:
  1. Run 'oktamcp init' to authenticate
  2. Add to your mcp.json without any credentials:
     {
       "mcpServers": {
         "okta-admin": {
           "command": "npx",
           "args": ["-y", "oktamcp", "run"]
         }
       }
     }

Examples:
  oktamcp init
  oktamcp run
  oktamcp session
  oktamcp logout
`);
  process.exit(0);
}

// Initialize authentication
async function initCommand() {
  console.log('🔐 Okta MCP Server Authentication Setup\n');
  
  // Check available storage methods
  const storageInfo = await getStorageInfo();
  console.log('📋 Available credential storage methods:');
  console.log(`   🔑 Keychain: ${storageInfo.keychain ? '✅ Available' : '❌ Not available'}`);
  console.log(`   📁 File: ${storageInfo.file ? '✅ Available' : '❌ Not available'}`);
  console.log(`   🌍 Environment: ${storageInfo.environment ? '✅ Available' : '❌ Not available'}`);
  console.log(`\n🎯 Will use: ${storageInfo.preferred} storage\n`);
  
  // Check for existing credentials
  const existingCredentials = await getCredentials();
  if (existingCredentials) {
    console.log('📋 Found existing credentials for:', existingCredentials.domain);
    process.stdout.write('Do you want to update them? (y/N): ');
    const answer = await getUserInput();
    if (answer.toLowerCase() !== 'y' && answer.toLowerCase() !== 'yes') {
      console.log('✨ Using existing credentials. Run: okta-mcp-server run');
      return;
    }
  }
  
  // Prompt for Okta domain
  console.log('\nPlease provide your Okta configuration:');
  process.stdout.write('Okta Domain (e.g., dev-123456.okta.com): ');
  
  const domain = await getUserInput();
  if (!domain) {
    console.error('❌ Domain is required');
    process.exit(1);
  }
  
  // Prompt for API token
  process.stdout.write('Okta API Token: ');
  const apiToken = await getUserInput();
  if (!apiToken) {
    console.error('❌ API token is required');
    process.exit(1);
  }
  
  // Test the credentials
  console.log('\n🔍 Testing credentials...');
  try {
    const response = await fetch(`https://${domain}/api/v1/apps?limit=1`, {
      headers: {
        'Authorization': `SSWS ${apiToken}`,
        'Accept': 'application/json'
      }
    });
    
    if (!response.ok) {
      throw new Error(`HTTP ${response.status}: ${response.statusText}`);
    }
    
    console.log('✅ Credentials validated successfully!');
    
    // Store credentials securely in keychain
    await storeCredentials(domain, apiToken);
    console.log('\n✨ Setup complete! You can now run: okta-mcp-server run');
    
  } catch (error) {
    console.error('❌ Failed to validate/store credentials:', error.message);
    process.exit(1);
  }
}

// Show session information
async function sessionCommand() {
  try {
    const sessionInfo = await getSessionInfo();
    
    if (!sessionInfo) {
      console.log('❌ No active session. Run: okta-mcp-server init');
      process.exit(1);
    }
    
    console.log('✅ Active Okta MCP Session');
    console.log(`📋 Domain: ${sessionInfo.domain}`);
    console.log(`🕐 Created: ${new Date(sessionInfo.createdAt).toLocaleString()}`);
    console.log(`📦 Version: ${sessionInfo.version}`);
    
    // Show actual storage method
    const storageDisplay = {
      'keychain': '🔑 System Keychain',
      'file': '📁 Secure File',
      'environment': '🌍 Environment Variables'
    };
    console.log(`💾 Storage: ${storageDisplay[sessionInfo.storage] || sessionInfo.storage}`);
    
    // Test if token is still valid
    console.log('\n🔍 Testing token validity...');
    const isValid = await validateCredentials();
    
    if (isValid) {
      console.log('🟢 Token Status: Valid');
    } else {
      console.log('🔴 Token Status: Invalid (run init to re-authenticate)');
    }
    
  } catch (error) {
    console.error('❌ Error checking session:', error.message);
    process.exit(1);
  }
}

// Logout and clear credentials
async function logoutCommand() {
  try {
    const hadCredentials = await clearCredentials();
    
    if (hadCredentials) {
      console.log('✅ Logged out successfully. Credentials cleared from all storage locations.');
    } else {
      console.log('ℹ️ No active session to logout from.');
    }
  } catch (error) {
    console.error('❌ Error clearing credentials:', error.message);
    process.exit(1);
  }
}

// Helper function to get user input
async function getUserInput() {
  return new Promise((resolve) => {
    process.stdin.resume();
    process.stdin.setEncoding('utf8');
    process.stdin.once('data', (data) => {
      process.stdin.pause();
      resolve(data.toString().trim());
    });
  });
}

// Load credentials from keychain or environment variables
async function loadCredentials() {
  const credentials = await getCredentials();
  
  if (!credentials) {
    console.error('❌ No credentials found. Run: okta-mcp-server init');
    process.exit(1);
  }
  
  return credentials;
}

async function transformTools(tools) {
  const transformed = tools
    .map((tool) => {
      const definitionFunction = tool.definition?.function;
      if (!definitionFunction) {
        console.log('[MCP] Skipping tool without function definition');
        return;
      }
      console.log(`[MCP] Transforming tool: ${definitionFunction.name}`);
      console.log(`[MCP] Tool parameters:`, JSON.stringify(definitionFunction.parameters, null, 2));
      const transformedTool = {
        name: definitionFunction.name,
        description: definitionFunction.description,
        inputSchema: definitionFunction.parameters,
      };
      console.log(`[MCP] Transformed tool:`, JSON.stringify(transformedTool, null, 2));
      return transformedTool;
    })
    .filter(Boolean);
  
  console.log('[MCP] Available tools after transform:', transformed.map(t => t.name));
  return transformed;
}

async function setupServerHandlers(server, tools) {
  console.log('[MCP] Setting up server handlers with tools:', tools.map(t => t.definition?.function?.name));
  
  server.setRequestHandler(ListToolsRequestSchema, async () => {
    console.log('[MCP] Listing available tools:', tools.map(t => t.definition?.function?.name));
    return {
      tools: await transformTools(tools),
    };
  });

  server.setRequestHandler(CallToolRequestSchema, async (request) => {
    console.log('[MCP] Received tool call request:', JSON.stringify(request, null, 2));
    
    const toolName = request.params.name;
    console.log(`[MCP] Looking for tool: ${toolName}`);
    
    const tool = tools.find((t) => t.definition?.function?.name === toolName);
    if (!tool) {
      console.error(`[MCP] Tool not found: ${toolName}. Available tools:`, tools.map(t => t.definition?.function?.name));
      throw new McpError(ErrorCode.MethodNotFound, `Unknown tool: ${toolName}`);
    }

    const args = request.params.arguments || {};
    console.log(`[MCP] Tool found: ${toolName}, executing with args:`, args);

    const requiredParameters = tool.definition?.function?.parameters?.required || [];
    for (const requiredParameter of requiredParameters) {
      if (!(requiredParameter in args)) {
        console.error(`[MCP] Missing required parameter: ${requiredParameter}`);
        throw new McpError(
          ErrorCode.InvalidParams,
          `Missing required parameter: ${requiredParameter}`
        );
      }
    }

    try {
      console.log(`[MCP] Executing ${toolName}`);
      const result = await tool.function(args);
      console.log(`[MCP] ${toolName} execution completed with result:`, result);
      return {
        content: [
          {
            type: "text",
            text: JSON.stringify(result, null, 2),
          },
        ],
      };
    } catch (error) {
      console.error(`[MCP] Error executing ${toolName}:`, error);
      throw new McpError(
        ErrorCode.InternalError,
        `API error: ${error.message}`
      );
    }
  });
}

async function run() {
  console.log('[MCP] Starting server in', isSSE ? 'SSE' : 'stdio', 'mode');
  
  // Load credentials
  const credentials = await loadCredentials();
  console.log(`[MCP] Connected to Okta domain: ${credentials.domain}`);
  
  const tools = await discoverTools();
  console.log('[MCP] Loaded tools:', tools.map(t => t.definition?.function?.name));

  if (isSSE) {
    const app = express();
    const transports = {};
    const servers = {};

    // Add body-parser middleware
    app.use(express.json());

    // Add CORS middleware
    app.use((req, res, next) => {
      res.setHeader('Access-Control-Allow-Origin', '*');
      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
      res.setHeader('Access-Control-Allow-Credentials', 'true');
      
      // Handle preflight requests
      if (req.method === 'OPTIONS') {
        res.sendStatus(200);
        return;
      }
      next();
    });

    app.get("/sse", async (req, res) => {
      // Create a new Server instance for each session
      const server = new Server(
        {
          name: SERVER_NAME,
          version: "0.1.0",
        },
        {
          capabilities: {
            tools: {},
          },
        }
      );
      server.onerror = (error) => {
        console.error("[Error]", error);
        transport?.send({ type: 'error', error: error.message });
      };
      await setupServerHandlers(server, tools);

      const transport = new SSEServerTransport("/messages", res);
      const sessionId = transport.sessionId;
      console.log(`[SSE] New connection established: ${sessionId}`);

      transports[sessionId] = transport;
      servers[sessionId] = server;

      res.on("close", async () => {
        console.log(`[SSE] Client disconnected: ${sessionId}`);
        delete transports[sessionId];
        await server.close();
        delete servers[sessionId];
      });

      // Connect first
      await server.connect(transport);
      
      // Then send connection confirmation
      transport.send({ 
        type: 'connection', 
        sessionId,
        server: {
          name: SERVER_NAME,
          version: "0.1.0"
        }
      });
    });

    app.post("/messages", async (req, res) => {
      const sessionId = req.query.sessionId;
      console.log(`[SSE] Received message for session: ${sessionId}`);
      
      const transport = transports[sessionId];
      const server = servers[sessionId];

      if (!transport || !server) {
        console.warn(`[SSE] No transport/server found for session: ${sessionId}`);
        return res.status(400).json({ 
          jsonrpc: "2.0",
          error: {
            code: -32602,
            message: "Invalid session",
            data: "No transport/server found for sessionId"
          },
          id: req.body?.id || null
        });
      }

      try {
        // Create a response wrapper that implements all required methods
        const responseWrapper = {
          writeHead: (statusCode, headers) => {
            res.status(statusCode);
            if (headers) {
              Object.entries(headers).forEach(([key, value]) => {
                res.setHeader(key, value);
              });
            }
            return responseWrapper;
          },
          end: (data) => {
            if (data === 'Accepted') {
              // Convert "Accepted" to proper JSON-RPC response
              res.json({
                jsonrpc: "2.0",
                result: { status: "accepted" },
                id: req.body?.id || null
              });
            } else if (data) {
              res.send(data);
            } else {
              res.end();
            }
          },
          write: (data) => {
            res.write(data);
          }
        };

        // Handle the message with the wrapper
        await transport.handlePostMessage(req, responseWrapper, req.body);
      } catch (error) {
        console.error(`[SSE] Error handling message:`, error);
        if (!res.headersSent) {
          res.status(500).json({ 
            jsonrpc: "2.0",
            error: {
              code: -32000,
              message: "Internal server error",
              data: error.message
            },
            id: req.body?.id || null
          });
        }
      }
    });

    const port = process.env.PORT || 3001;
    app.listen(port, () => {
      console.log(`[SSE Server] running on port ${port}`);
    });
  } else {
    // stdio mode: single server instance
    const server = new Server(
      {
        name: SERVER_NAME,
        version: "0.1.0",
      },
      {
        capabilities: {
          tools: {},
        },
      }
    );
    server.onerror = (error) => console.error("[Error]", error);
    await setupServerHandlers(server, tools);

    process.on("SIGINT", async () => {
      await server.close();
      process.exit(0);
    });

    const transport = new StdioServerTransport();
    await server.connect(transport);
  }
}

run().catch(console.error);