okta-mcp-server/CHANGELOG.md

Model Context Protocol (MCP) server for Okta API operations with support for bulk operations and caching

# Changelog

All notable changes to this project will be documented in this file.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [2.0.11] - 2025-01-29

### Fixed
- Fixed `createSignOnPolicy` settings structure - added missing `rememberDeviceByDefault` and `factorLifetime` fields
- Fixed `createMfaPolicy` settings structure - changed from `factors` object to `authenticators` array format
- Updated default session timeouts to valid values (maxSessionIdleMinutes: 120, maxSessionLifetimeMinutes: 720)
- Removed invalid `okta_password` from MFA factors (password is not an MFA factor)

## [2.0.10] - 2025-01-29

### Fixed
- Corrected policy creation to send `type` in request body (not query parameter) as expected by Okta API
- Added proper handling for `activate` query parameter when creating policies with ACTIVE status
- This properly fixes `createSignOnPolicy` and `createMfaPolicy` tools

## [2.0.9] - 2025-01-29

### Fixed
- **Critical**: Fixed policy creation by removing `type` from request body (only send as query parameter)
- This fixes the "invalid format/type field validation" errors for `createSignOnPolicy` and `createMfaPolicy`

## [2.0.8] - 2025-01-29

### Fixed
- **Critical**: Fixed policy creation tools (`createSignOnPolicy`, `createMfaPolicy`) by sending type as URL query parameter
- Fixed `createPolicyRule` by automatically detecting parent policy type and mapping to correct rule type
- Fixed `updatePolicy` to properly handle system policies with clear error messages
- Enhanced `deletePolicyRule` with system rule detection and user-friendly error messages
- Added proper default settings and conditions for sign-on and MFA policies

### Added
- Pre-validation for system resources (policies and rules) to prevent confusing API errors
- Comprehensive test coverage for policy operation edge cases

## [2.0.0] - 2025-01-28

### Changed
- **BREAKING**: Complete architectural refactor to align with MCP specification
- **BREAKING**: Removed OAuth client implementation (browser launching, token storage, session management)
- **BREAKING**: Simplified to API token authentication only
- **BREAKING**: Configuration now requires only `OKTA_DOMAIN` and `OKTA_API_TOKEN`
- Reduced codebase by ~80% for better maintainability
- Simplified dependencies and removed unnecessary packages

### Added
- Optional MCP OAuth protection (Claude handles the OAuth flow)
- MCP OAuth metadata endpoint (`oauth/metadata`)
- Simple bearer token validation for MCP server protection
- Migration guide from v1.x to v2.0

### Removed
- OAuth client functionality (browser authentication)
- Token storage implementations (file, SQLite)
- Session management
- Authentication factory complexity
- Performance optimizations (not needed for MCP)
- Complex OAuth configuration options
- Circuit breaker with OAuth integration
- Unnecessary dependencies (puppeteer, axios, winston, etc.)

### Fixed
- Proper alignment with MCP OAuth specification
- Configuration complexity issues
- Memory usage and performance overhead

## [1.1.0] - 2025-01-27

### Added
- OAuth 2.1 browser authentication flow (Phase 1 & 2)
- Enhanced OAuth 2.0 with circuit breaker integration
- Token refresh automation
- Session management

## [1.0.3] - 2025-07-28

### Fixed
- Fixed dotenv console output corrupting MCP stdio protocol
- Suppressed dotenv logging to prevent protocol interference

## [1.0.2] - 2025-07-28

### Fixed
- Fixed MCP tool discovery persistence issue by preventing stderr logging interference with stdio protocol
- Implemented protocol-safe logger that writes to files instead of stderr when in MCP mode
- Updated debug wrapper to use file logging to avoid protocol corruption
- Fixed environment variable configuration for proper MCP operation

### Changed
- Logger now automatically detects MCP server mode and switches to file-based logging
- Added MCP_SERVER_MODE and LOG_TO_FILE environment variables for better control

## [1.0.1] - 2025-07-27

### Fixed
- Moved @faker-js/faker from devDependencies to dependencies to fix missing package error

## [1.0.0] - 2025-07-27

### Added
- Initial release of enterprise-grade Okta MCP server
- Comprehensive user management tools (list, get, create, update, delete)
- Group management functionality with member operations
- Application management with assignment capabilities
- Policy management for various policy types
- Bulk operations for users (create, update, delete, export)
- Advanced audit logging with compliance reporting
- SQLite caching for improved performance
- OAuth 2.0 token refresh automation
- Rate limiting and pagination support
- Docker containerization support
- Comprehensive test suite with unit and integration tests

### Features
- TypeScript implementation with strict type safety
- MCP protocol compliance using official TypeScript SDK
- Streaming support for large datasets
- Multi-layer caching architecture
- Security-first design with input validation
- Extensive error handling and logging
- Support for multiple Okta environments
- Mock mode for development and testing