Scope-based tool loading

Learn about the scope-based tool loading mechanism of the Okta Managed MCP Server.

Early Access release

Overview

The Okta Managed MCP Server uses scope-based tool loading to ensure that only the tools your app is authorized to use are exposed to the LLM.

How it works

Startup filtering: After authentication completes, the server reads the scopes in your access token. The server compares each tool's required scope against your access token's scopes. Tools whose required scope isn't present are silently removed from the tool registry and don't appear in the tools list.
Runtime enforcement: If you don't have the required scope, you can't perform the action. The tool execution response returns the INSUFFICIENT_SCOPE error code (-32003).

Scope-to-tool mapping

Each tool is categorized by type: Identity and Access Management (IAM) or Okta Identity Governance (OIG).

Tool name	Type	Available Okta scopes
`manage_user`	IAM	`okta.users.read` `okta.users.manage`
`manage_group`	IAM	`okta.groups.read` `okta.groups.manage`
`manage_application`	IAM	`okta.apps.read` `okta.apps.manage`
`manage_access`	IAM	`okta.policies.read` `okta.policies.manage`
`query_syslog`	IAM	`okta.logs.read`
`manage_device`	IAM	`okta.deviceAssurance.read` `okta.deviceAssurance.manage` `okta.devices.read` `okta.devices.manage`
`manage_customization`	IAM	`okta.brands.read` `okta.brands.manage` `okta.templates.read` `okta.templates.manage` `okta.domains.read` `okta.domains.manage` `okta.emailDomains.read` `okta.emailDomains.manage`
`manage_governance_access_request` (Access Requests)	OIG	`okta.governance.accessRequests.read` `okta.governance.accessRequests.manage` `okta.accessRequests.request.read` `okta.accessRequests.request.manage` `okta.accessRequests.catalog.read` `okta.accessRequests.condition.read` `okta.accessRequests.condition.manage`
`manage_governance_access_certification` (Access Certifications)	OIG	`okta.governance.accessCertifications.manage` `okta.governance.accessCertifications.read` `okta.governance.reviewer.read` `okta.governance.reviewer.manage`
`manage_governance_security_access_review`	OIG	`okta.governance.securityAccessReviews.admin.read` `okta.governance.securityAccessReviews.admin.manage` `okta.governance.securityAccessReviews.endUser.read` `okta.governance.securityAccessReviews.endUser.manage`
`manage_governance_entitlement` (Entitlement Management)	OIG	`okta.governance.entitlements.read` `okta.governance.entitlements.manage`
`manage_governance_collection` (Collections)	OIG	`okta.governance.collections.read` `okta.governance.collections.manage`
`manage_governance_resource` (Resources)	OIG	`okta.governance.resourceOwner.read` `okta.governance.resourceOwner.manage` `okta.governance.labels.read` `okta.governance.labels.manage`
`manage_governance_organization_setting` (Delegate Appointments)	OIG	`okta.governance.delegates.read` `okta.governance.delegates.manage` `okta.governance.principalSettings.manage`
`manage_governance_access_request` (My requests)	OIG	`okta.accessRequests.request.read` `okta.accessRequests.request.manage` `okta.accessRequests.catalog.read`
`manage_governance_organization_setting` (My Settings)	OIG	`okta.governance.principalSettings.read` `okta.governance.principalSettings.manage`