Use Authdog's MCP server

Authdog's MCP server is the control plane for the account you sign in with. A coding agent can list tenants, create projects, set redirect URIs, and inspect users. It is not the MCP server your product exposes to its own agents. That server is Build an MCP server.

The endpoint is https://api.authdog.com/mcp (streamable HTTP).

Connect a client

The CLI writes the URL into the client config. The client signs in when the server answers 401 with WWW-Authenticate. The CLI does not put a bearer token in that file.

authdog mcp install --client cursor
authdog mcp list
authdog doctor --mcp

authdog mcp uninstall removes the Authdog entry and leaves your other MCP servers in place. authdog doctor --mcp checks that the protected-resource metadata is reachable.

Sign in with the Authdog account that should own the changes. The tools run as that person.

How the agent should behave

The server instructions tell the agent to show options and wait. A few rules are worth knowing before you let it click through:

• It lists tenants, then projects, then fetches the project. It should not pick one for you, and it should not guess the project type from the name. Ask it whether you want web (OAuth app), m2m (machine-to-machine), or mcp (MCP server).
• Mutations send confirm=true only after you confirm. Deletes need the exact name you expect.
• After it creates a project, it should call get_sdk_config for the issuer, the client id, and the public key. The public key (pk_...) selects the identity host. It is not the OIDC client_id.
• create_client creates a public PKCE client. It does not hand back a client secret. Redirect URIs come from you, not from a guess.

Tools cover tenants, projects, environments, OIDC clients, redirect URIs, and end users. Two prompts are built in: provision_web_app for a web app wire-up, and explore_tenant to walk tenants and projects.

What this server is not

Related