IBM Verify MCP server overview

The IBM Verify Model Context Protocol (MCP) server enables AI assistants to interact with IBM Verify's Identity and Access Management (IAM) capabilities. The server requests information directly from your IBM Verify tenant so that your AI model can formulate intelligent responses and perform IAM operations.

Introduction

MCP standardizes how AI models can discover and interact with external tools, applications, and data sources. You can configure MCP clients, such as Claude Desktop or IBM Bob, to send requests through an MCP server. As a result, the model can generate responses to prompts and perform actions it is not specifically trained to perform. See MCP documentation for details about how MCP works.

You can configure your AI model to connect to the IBM Verify MCP server so that it can perform Identity and Access Management operations through the IBM Verify APIs.

How It Works

The IBM Verify MCP server acts as a bridge between your AI assistant and IBM Verify:

┌─────────────────┐         ┌──────────────────┐         ┌─────────────────┐
│   AI Assistant  │ ◄─────► │  IBM Verify MCP  │ ◄─────► │  IBM Verify     │
│ (Claude/Bob)    │   MCP   │     Server       │   API   │    Tenant       │
└─────────────────┘         └──────────────────┘         └─────────────────┘

AI Assistant sends natural language requests through MCP protocol
MCP Server translates requests into IBM Verify API calls on behalf of the authenticated user
IBM Verify processes the requests and returns data
MCP Server formats responses for the AI assistant
AI Assistant presents results in natural language

Key Features

Secure Authentication

OAuth 2.0 Authorization Code Flow — the default mode; users authenticate via browser sign-in to IBM Verify
Direct Access Token — for agents and automated pipelines that supply an existing token, bypassing the browser flow
User-delegated access with proper authorization
No hardcoded credentials in AI clients
Session-based authentication with automatic token refresh

Comprehensive IAM Operations

User Management: Create, read, update, and delete users; self-service password flows
Group Management: Manage groups and memberships
Application Management: List, create, update, and delete applications
MFA Management: View and manage multi-factor authentication enrollments
Access Requests: Request, approve, reject, and cancel access requests
Directory Attributes: Browse tenant-level custom attributes

Enterprise-Ready

Kubernetes and Docker deployment options
Comprehensive logging and monitoring

Workflow

Setup IBM Verify Tenant - Configure OAuth applications and STS client
Deploy MCP Server - Install on Kubernetes or Docker
Configure AI Client - Connect Claude Desktop or IBM Bob to the server
Use Natural Language - Interact with IBM Verify through your AI assistant

Available Tools

The IBM Verify MCP server exposes 34 tools organized into six categories. Each tool maps to one or more IBM Verify REST API endpoints and is invoked automatically by the AI model based on the user's natural language request.

Persona controls which tools are exposed to a connected client. Setting persona: admin in the client configuration loads the full administrative toolset; persona: end_user loads only end-user self-service tools. This keeps the AI model's context lean — each audience sees only the tools relevant to them. IBM Verify enforces entitlements at the token level regardless of persona, so a user without the required permissions receives a 403 Forbidden response even if they connect with the admin persona. See Configuring MCP Clients for full configuration details.

Admin requires administrator entitlements; User is available to end users via self-service.

User Management (8 tools)

Tool name	Description	Persona
`ibm_verify_get_user_count`	Return the total count of users in the tenant — a fast count with no data payload	Admin
`ibm_verify_list_users`	List and search users with SCIM-compliant filtering, sorting, and pagination	Admin
`ibm_verify_get_user`	Retrieve full profile and group memberships for a specific user	Admin
`ibm_verify_create_user`	Create a new user in IBM Verify Cloud Directory	Admin
`ibm_verify_update_user`	Update one or more user attributes without touching the rest of their profile	Admin
`ibm_verify_delete_user`	Permanently delete a user account from the directory	Admin
`ibm_verify_reset_user_password`	Admin-driven password reset — auto-generates a secure password and emails it to the user	Admin
`ibm_verify_initiate_my_password_reset`	Initiate a self-service forgot-password flow for an unauthenticated user	User

Group Management (5 tools)

Tool name	Description	Persona
`ibm_verify_get_group_count`	Return the total count of groups in the tenant (useful before bulk operations)	Admin
`ibm_verify_list_groups`	List all groups with filtering, sorting, and pagination; includes total count	Admin
`ibm_verify_create_group`	Create a new group, optionally pre-populated with initial members	Admin
`ibm_verify_update_group`	Add or remove specific members from a group, or rename and reconfigure it	Admin
`ibm_verify_delete_group`	Permanently delete a group (requires explicit confirmation)	Admin

Application Management (7 tools)

Tool name	Description	Persona
`ibm_verify_list_applications`	List or search applications with pagination and sorting	Admin
`ibm_verify_get_application`	Retrieve detailed configuration for a specific application (OIDC, SAML, Bookmark)	Admin
`ibm_verify_list_application_types`	Discover all supported application types available for creation	Admin
`ibm_verify_get_application_requirements`	Get required and optional fields for a given application type before creation	Admin
`ibm_verify_create_application`	Create a new application by using a template-driven workflow	Admin
`ibm_verify_update_application`	Partially update an existing application's configuration	Admin
`ibm_verify_delete_application`	Permanently delete an application (requires explicit confirmation)	Admin

MFA Management (4 tools)

Tool name	Description	Persona
`ibm_verify_list_user_mfa_enrollments`	List all MFA enrollments for a specific user across all factor types	Admin / User
`ibm_verify_list_all_mfa_enrollments`	List all MFA enrollments across the entire tenant with filtering and pagination	Admin
`ibm_verify_delete_mfa_enrollment`	Delete a specific MFA enrollment; supports both admin and end-user self-service	Admin / User
`ibm_verify_list_mfa_factors`	Discover which MFA methods are enabled and configured in the tenant	Admin

Access Requests (9 tools)

Tool name	Description	Persona
`ibm_verify_get_my_access_assignments`	Retrieve all active access assignments (roles, permissions, entitlements) for the current user	User
`ibm_verify_list_requestable_applications`	Browse the app catalog — applications the current user can request access to	User
`ibm_verify_get_application_entitlements`	List available roles and permissions for a specific application	User
`ibm_verify_create_access_request`	Submit an access request for one or more entitlements on an application	User
`ibm_verify_list_my_access_requests`	View access requests previously submitted by the current user	User
`ibm_verify_remind_access_approvers`	Send a reminder notification to pending approvers for an access request	User
`ibm_verify_cancel_access_requests`	Cancel one or more pending access requests (requires user confirmation)	User
`ibm_verify_list_access_requests_pending_my_approval`	List access requests awaiting the current user's approval decision	User
`ibm_verify_review_access_request`	Approve or reject pending access requests in bulk (requires confirmation and justification)	User

Directory Attributes (1 tool)

Tool name	Description	Persona
`ibm_verify_list_directory_attributes`	List or search tenant directory attributes (SCIM extension, custom, provisioning) with pagination	Admin

Use Cases

IT Administrators

"Onboard a new hire — Jane Smith, [email protected], joining the Engineering department on Monday"
"Add [email protected] to the Finance Approvers group"
"The contractor [email protected] just left — suspend their account and remove them from all project groups"
"Show all pending access requests waiting for my approval"

Security Teams

"John Doe reported his phone was stolen — what MFA enrollments does he have? Remove them all so he can re-enroll"
"Show all groups that [email protected] belongs to"
"Pull up the full profile for [email protected] — I need to verify his access before the audit"

Help Desk

"John Doe is locked out — reset his password and email him a temporary one"
"A user says SMS OTP isn't showing up as an option — is it enabled in the tenant?"
"Check what MFA methods [email protected] has enrolled and whether any are active"

Compliance Officers

"Give a full list of all MFA enrollments in the tenant for our quarterly audit"
"Show all access requests pending approval for the Salesforce application"
"List all groups that have 'Admin' in the name so I can review privileged group membership"

Architecture

Components

MCP Server Container
- Python-based FastMCP application
- Implements MCP protocol (Streamable HTTP transport)
- Handles OAuth authentication and token exchange
- Communicates with IBM Verify APIs
IBM Verify Tenant
- OAuth applications (Actor and Subject)
- STS (Security Token Service) client
- User directory and IAM policies
MCP Client
- Claude Desktop, IBM Bob, or other MCP-compatible clients
- Uses fastmcp-remote to connect to the remote MCP Server and handle OAuth authentication
- Presents tools to AI model

Security Model

User Authentication: Users authenticate directly with IBM Verify
Token Exchange: Actor token exchanged for user-delegated token
Least Privilege: STS client configured with minimal required entitlements
Audit Trail: All operations logged in IBM Verify audit logs

Deployment Options

Docker (Local Development)

Quick setup for testing and development
Runs on localhost with HTTP
Automated deployment script included
Suitable for single-user scenarios

Kubernetes (Production)

Scalable deployment for enterprise use
HTTPS with TLS certificates
Suitable for team and organization-wide use

OpenShift (Enterprise)

Full enterprise features
Route-based ingress
Integration with OpenShift security policies
Suitable for regulated environments

Prerequisites

Before deploying the IBM Verify MCP server, you need:

IBM Verify Tenant: Active IBM Verify SaaS tenant
API Client: With manageAppAccessAdmin (Manage application lifecycle) and manageSTSClients (Manage STS clients and token types) entitlements
Deployment Platform: Docker or Kubernetes/OpenShift cluster
MCP Client: Claude Desktop, IBM Bob, or compatible MCP client along with fastmcp-remote

Getting Started

Follow these steps to get started with IBM Verify MCP Server:

Setup IBM Verify Tenant - Configure OAuth applications and STS client
Install MCP Server - Deploy on Docker or Kubernetes
Configure MCP Client - Connect your AI assistant
Use MCP Tools - Start managing IAM with natural language
Troubleshooting - Resolve common issues

Version Information

Current Version: 26.07.20
MCP Protocol: 1.0
Transport: Streamable HTTP
Authentication: OAuth 2.0 with Token Exchange (RFC 8693)

Support and Resources

Documentation: Complete guides for setup, deployment, and usage
IBM Verify Documentation: https://www.ibm.com/docs/en/security-verify
MCP Protocol: https://modelcontextprotocol.io/
IBM Support: https://www.ibm.com/mysupport

Changelog

Version 26.07.20

Initial release of IBM Verify MCP Server
34 tools across 6 categories
OAuth 2.0 Token Exchange authentication
Docker and Kubernetes deployment support
Claude Desktop and IBM Bob client support

Next Steps

Begin by setting up your IBM Verify tenant with the required OAuth applications and STS client.

Last Updated: 2026-08-03
Version: 1.0.0
Maintained By: IBM Verify Team