HomeUse CasesConceptsConfig GuidesDeveloper GuidesAPI Reference
Content

Using MCP Tools

IBM Verify MCP Server - Using MCP Tools

Prerequisites

Before using the MCP tools, ensure you have:

Important: If you haven't configured your MCP client yet, follow the Configuring MCP Clients guide first.

💡 Troubleshooting: If you encounter any issues while using the tools, see the Troubleshooting Guide for common problems and solutions.

Available Tools

The IBM Verify MCP Server provides 34 tools organized into six categories. Just describe what you want to do in plain language — your AI assistant picks the right tool automatically.

Tools are gated by persona. The persona header you set in your MCP client configuration determines which tools your AI assistant can see and invoke:

  • end_user — only self-service tools are exposed (access requests, MFA self-management, password reset). Administrative tools are hidden entirely.
  • admin — only administrative tools are exposed (user/group/application management, tenant-wide MFA, directory attributes). End-user self-service tools are hidden.

This separation keeps the AI model's context focused on what's relevant to you. If you need to switch between personas, update the persona header in your MCP client configuration and reload the client.

Note on security: Even if you configure your client with the admin persona, IBM Verify enforces entitlements at the token level. Any tool invocation that exceeds your token's entitlements returns a 403 Forbidden error — the persona controls visibility, IBM Verify controls access.

#CategoryTools
1User Management8 tools
2Group Management5 tools
3Application Management7 tools
4MFA Management4 tools
5Access Requests9 tools
6Directory Attributes1 tool

1. User Management

Manage user accounts in your IBM Verify tenant — create, search, update, and delete users, or trigger password resets.

ibm_verify_get_user_count

Persona: admin

Return the total number of users in the tenant — a fast count with no data payload.

Try asking:

  • "How many users do we have in the tenant right now?"
  • "I need to plan our next licence tier — how many active users are there?"

ibm_verify_list_users

Persona: admin

List and search users with filtering, sorting, and pagination.

Try asking:

  • "Find all users with an @acme.com email address"
  • "Show me all users in the Engineering department"
  • "Is there already an account for someone named Marcus Webb?"

ibm_verify_get_user

Persona: admin

Retrieve the full profile and group memberships for a specific user.

Try asking:

ibm_verify_create_user

Persona: admin

Create a new user in IBM Verify Cloud Directory.

Try asking:

  • "Onboard a new hire — Jane Smith, [email protected], joining the Finance department on Monday"
  • "Create an account for our new contractor Bob Jones, [email protected] — no welcome email needed"
  • "Set up a user for Maria Garcia in Sales with her work phone +1-415-555-0192"

ibm_verify_update_user

Persona: admin

Update one or more user attributes — change a job title, add a phone number, disable an account, set custom fields, and more. Other profile fields are left untouched.

Try asking:

  • "Sarah Johnson just got promoted — update her title to Senior Engineer"
  • "Add a mobile number +1-555-9876 to [email protected]'s profile"
  • "Suspend the account for the contractor who left last Friday — their email is [email protected]"

ibm_verify_delete_user

Persona: admin

Permanently delete a user account from the directory.

Try asking:

  • "The contractor [email protected] has finished their engagement — remove their account"
  • "Delete the duplicate account for Bob Jones that was created by mistake"

ibm_verify_reset_user_password

Persona: admin

Admin-driven password reset — generates a secure temporary password and emails it to the user. The user is prompted to change it on next login.

Try asking:

  • "John Doe is locked out and can't get in — reset his password and send him a temporary one"
  • "Initiate a password reset for the new hire [email protected]"

ibm_verify_initiate_my_password_reset

Persona: end_user

Start the self-service forgot-password flow — sends a reset link to the user's registered email address.

Try asking:

2. Group Management

Create and manage groups, control membership, and keep your group inventory organized.

ibm_verify_get_group_count

Persona: admin

Return the total number of groups in the tenant — a fast count with no data payload.

Try asking:

  • "How many groups do we have in the system?"
  • "Quick — what's the total group count before I start the audit?"

ibm_verify_list_groups

Persona: admin

List all groups with filtering, sorting, and pagination.

Try asking:

  • "Show me all groups in the tenant"
  • "Find all groups with 'Admin' in the name"
  • "Are there any groups set up for the Finance department?"

ibm_verify_create_group

Persona: admin

Create a new group, optionally seeding it with initial members.

Try asking:

  • "Create a new group called 'Q4 Launch Team' for the product release"
  • "Set up a group called 'Data Science Pod' and add [email protected] and [email protected] to it right away"
  • "Create a temporary group for our external auditors — no notifications needed"

ibm_verify_update_group

Persona: admin

Add or remove specific members from a group, rename it, or update its description — without affecting anything else.

Try asking:

ibm_verify_delete_group

Persona: admin

Permanently delete a group. The AI asks for your confirmation before proceeding.

Try asking:

  • "The 'Temp Contractors Q2 2024' group is no longer needed — delete it"
  • "Clean up all the old project groups from last year, starting with 'Project Falcon'"

3. Application Management

Browse, configure, create, and remove applications registered in your IBM Verify tenant.

ibm_verify_list_applications

Persona: admin

List or search applications registered in the tenant.

Try asking:

  • "Show me all the applications registered in IBM Verify"
  • "Is there a Salesforce application already configured in the tenant?"

ibm_verify_get_application

Persona: admin

Retrieve the full configuration for a specific application — OIDC, SAML, or Bookmark.

Try asking:

  • "Show me the full configuration for the Salesforce application"
  • "What redirect URIs are registered for the Customer Portal app?"
  • "Pull up the SAML settings for our HR system — I need to share the metadata with the vendor"
  • "Is the Customer Portal app currently active or disabled?"

ibm_verify_list_application_types

Persona: admin

Discover all supported application types that can be created in this tenant.

Try asking:

  • "What types of applications can I register in IBM Verify?"
  • "We're onboarding a new SaaS tool — what integration options are available?"

ibm_verify_get_application_requirements

Persona: admin

Get the exact fields required to create a specific application type before you start.

Try asking:

  • "What do I need to provide to set up a new OIDC web application?"
  • "Walk me through the required fields for creating a SAML app"
  • "What's mandatory for registering a backend service application?"

ibm_verify_create_application

Persona: admin

Register a new application by using a guided.

Try asking:

  • "Register a new OIDC web app called 'Customer Portal' — the redirect URI is https://portal.acme.com/callback"
  • "Set up a SAML application for our new HR system
  • "Create a service application called 'Billing API' for machine-to-machine authentication"
  • "Register a new OIDC mobile app for our iOS client with the redirect URI myapp://callback"

ibm_verify_update_application

Persona: admin

Modify specific fields of an existing application without changing the rest of its configuration.

Try asking:

  • "We deployed to staging — add https://staging.acme.com/callback to the Customer Portal's redirect URIs"
  • "The mobile team is complaining about token expiry — increase the access token lifetime for the Mobile App to 2 hours"
  • "Enable refresh tokens for the Customer Portal application"
  • "Our HR system vendor changed their ACS URL — update the SAML endpoint for the HR Portal app"

ibm_verify_delete_application

Persona: admin

Permanently delete an application. The AI asks for your confirmation before proceeding.

Try asking:

  • "We decommissioned the Legacy CRM — remove it from IBM Verify"
  • "Delete the test application I created last week called 'Sandbox App'"

4. MFA Management

View and manage multi-factor authentication enrollments for users across the tenant. End users can also list and delete their own enrollments through self-service.

ibm_verify_list_user_mfa_enrollments

Persona: admin / end_user

List all MFA enrollments for a specific user, with an option to include device details.

Try asking:

  • "What MFA methods does [email protected] have set up?"
  • "John Doe says he can't log in — check what MFA enrollments he has and whether any are active"
  • "Show me all MFA devices enrolled for [email protected], including device names"
  • "Show me my own MFA enrollments"

ibm_verify_list_all_mfa_enrollments

Persona: admin

List all MFA enrollments across the entire tenant — useful for audits and compliance reports.

Try asking:

  • "Give me a full list of all MFA enrollments in the tenant"
  • "How many total MFA enrollments do we have across the organization?"

ibm_verify_delete_mfa_enrollment

Persona: admin / end_user

Delete a specific MFA enrollment. Admins can remove any enrollment; end users can remove their own.

Try asking:

  • "John lost his phone — remove his TOTP enrollment so he can re-enroll on his new device"
  • "Delete my FIDO2 key enrollment — I got a new security key and need to register it fresh"
  • "Remove the email OTP enrollment for [email protected] — she's switching to TOTP"

ibm_verify_list_mfa_factors

Persona: admin

Discover which MFA methods are enabled and configured in the tenant.

Try asking:

  • "Which MFA methods are available for our users to enroll in?"
  • "Is SMS OTP enabled in our tenant? A user says they don't see it as an option"
  • "Show me the full MFA configuration for the tenant — I need it for the security review"

5. Access Requests

Browse requestable applications, submit access requests, track their status, and make approval decisions — all through conversation.

ibm_verify_get_my_access_assignments

Persona: end_user

Retrieve all active access assignments — roles, permissions, and entitlements — for the currently signed-in user.

Try asking:

  • "What do I currently have access to?"
  • "Do I already have access to Salesforce, or do I need to request it?"
  • "List all the roles and permissions I hold right now"

ibm_verify_list_requestable_applications

Persona: end_user

Browse the applications catalog that the current user is eligible to request access to.

Try asking:

  • "What applications can I request access to?"
  • "Is Confluence in my app catalog?"
  • "I just joined the team — show me everything I can request access to"

ibm_verify_get_application_entitlements

Persona: end_user

List the specific roles and permission levels available to request for a given application.

Try asking:

  • "What access levels can I request for Salesforce?"
  • "Show me all the roles available in the HR Portal — I need to pick the right one"
  • "What permission options exist for Confluence before I submit my request?"

ibm_verify_create_access_request

Persona: end_user

Submit an access request for one or more roles or permissions on an application.

Try asking:

  • "Request Developer access to Jira — I need it to track work for the Q3 project"
  • "Submit an access request for the Sales Rep role in Salesforce — I'm taking over the EMEA accounts"
  • "Apply for Admin access to Confluence — I'm the new team lead and need to manage our space"

ibm_verify_list_my_access_requests

Persona: end_user

View the status of access requests you have previously submitted.

Try asking:

  • "What's the status of my pending access requests?"
  • "Has my Salesforce access request been approved yet?"
  • "Show me all my rejected access requests so I can resubmit them"

ibm_verify_remind_access_approvers

Persona: end_user

Send a reminder notification to the approvers on a pending access request.

Try asking:

  • "My Jira access request has been sitting for 3 days — remind the approver"
  • "Nudge the approvers on my Salesforce request, I'm blocked without it"

ibm_verify_cancel_access_requests

Persona: end_user

Cancel one or more pending access requests. The AI confirms before cancelling.

Try asking:

  • "Cancel my pending Confluence access request — I found another way to get what I needed"
  • "Withdraw the Salesforce Admin request I submitted — I no longer need that level of access"

ibm_verify_list_access_requests_pending_my_approval

Persona: end_user

List access requests that are waiting for your approval decision.

Try asking:

  • "Show me everything waiting for my approval"
  • "Do I have any pending access requests I need to act on today?"
  • "What requests are pending my review for the Salesforce application?"

ibm_verify_review_access_request

Persona: end_user

Approve or reject pending access requests. The AI asks for your justification and confirmation before acting.

Try asking:

  • "Approve Tony Stark's request for Salesforce Admin — he's the new CRM lead"
  • "Reject the Confluence Admin request from contractor-123 — contractors shouldn't have admin rights"

6. Directory Attributes

Explore and search the custom and SCIM extension attributes defined in your tenant.

ibm_verify_list_directory_attributes

Persona: admin

List or search tenant directory attributes — SCIM extension fields, custom attributes, and provisioning attributes — with pagination and sorting.

Try asking:

  • "What custom attributes are defined in this tenant?"
  • "I want to set an employee number on a user — is there a custom attribute for that?"
  • "Show me all attributes tagged with 'SSO' — I need them for a provisioning integration"
  • "Find all attributes related to 'department' before I update a user's profile"

Common Use Cases

The following examples show how tools work together as a natural conversation — no commands, no IDs to memorize.

For Administrators

Onboarding a new employee

Tools at work: ibm_verify_create_user → ibm_verify_update_group → ibm_verify_reset_user_password

You: Onboard a new hire — Sarah Williams, [email protected], joining the Engineering department on Monday.

You: Add Sarah to the "Engineering All" and "All Employees" groups.

You: Generate a temporary password for Sarah and email it to her.

Responding to a security incident

Tools at work: ibm_verify_list_user_mfa_enrollments → ibm_verify_delete_mfa_enrollment → ibm_verify_reset_user_password

You: John Doe reported his phone was stolen — what MFA enrollments does [email protected] have?

You: Remove all his TOTP and FIDO2 enrollments.

You: Reset his password and send him a temporary one so he can get back in securely.

For End Users

Requesting application access

Tools at work: ibm_verify_list_requestable_applications → ibm_verify_get_application_entitlements → ibm_verify_create_access_request

You: I just joined the sales team — what applications can I request access to?

You: What permission levels are available for Salesforce?

You: Request "Sales Rep" access to Salesforce — I need it to manage the Q3 pipeline accounts.

Tracking and managing your requests

Tools at work: ibm_verify_list_my_access_requests → ibm_verify_remind_access_approvers → ibm_verify_cancel_access_requests

You: What's the status of my pending access requests?

You: My Salesforce request has been waiting 3 days — remind the approver.

You: Actually, cancel my Confluence request — I no longer need it.

Approving your team's requests

Tools at work: ibm_verify_list_access_requests_pending_my_approval → ibm_verify_review_access_request

You: Show me everything waiting for my approval.

You: Approve Tony Stark's Salesforce request — he needs it for the new CRM rollout.

You: Reject the Confluence Admin request from the intern — they should have read-only access instead.

Next Steps

You're now equipped to manage IBM Verify through natural language. If something doesn't behave as expected:

👉 Troubleshooting Guide - Diagnose and resolve common issues with authentication, tool invocation, and connectivity.

Key findings:

  • Common error messages and their causes
  • Authentication and token exchange issues
  • MCP client connectivity problems
  • Tool-level debugging tips

Additional Resources

You're all set! Start managing your IBM Verify tenant with natural language through your AI assistant.

Updated about 3 hours ago

Did this page help you?