RapidID MCP Server

The RapidID MCP Server enables AI applications that support the Model Context Protocol (MCP) — such as Claude Desktop — to interact with RapidID identity management systems. It exposes tools for searching users, managing entitlements, querying groups, reviewing audit logs, and working with Connect action sets.

Getting Started

Using Claude Desktop Extensions

1. Download mcpb package (file extension is .mcpb) for your OS from the assets in releases
2. Open Claude Desktop and go to Settings ➡️ Extensions ➡️ Advanced Settings ➡️ Install Extension
3. Choose mcpb package from step 1
4. Enter Hostname and Username/Password OR Service Identity

Claude.Desktop.Install.mov

Using Binary

Download the binary for your OS from the assets in releases and follow the Usage with Model Context Protocol instructions.

Usage with Model Context Protocol

To integrate this server with apps that support MCP using your RapidID username and password. Set MCP_RAPIDID_TELEMETRY to false or remove it completely to opt out of providing usage data.

{
  "mcpServers": {
    "mcp-rapidid": {
      "command": "<path to downloaded binary>",
      "env": {
        "MCP_RAPIDID_TELEMETRY": "true",
        "RI_USER": "kclarkson",
        "RI_PASSWORD": "notarealpassword123",
        "RI_HOST": "portal.us006-rapididentity.com",
        "RI_LOG_LEVEL": "error"
      }
    }
  }
}

To integrate this server with apps that support MCP using RapidID service identities. Set MCP_RAPIDID_TELEMETRY to false or remove it completely to opt out of providing usage data. Keep in mind that Service Identities do not have access to all tools even with the Tenant Admin role. See tools section for available tools.

{
  "mcpServers": {
    "mcp-rapidid": {
      "command": "<path to downloaded binary>",
      "env": {
        "MCP_RAPIDID_TELEMETRY": "true"
        "RI_SERVICE_IDENTITY_SECRET_KEY": "1jdie203i4jjf9",
        "RI_HOST": "portal.us006-rapididentity.com",
        "RI_LOG_LEVEL": "error"
      }
    }
  }
}

Tools

The "Service ID Compatible" column indicates whether a RapidID Service Identity can call the underlying API endpoint.

Tool	Description	Service ID Compatible
search-users	Performs a simple user search — across the caller's delegations for username/password, or via the reporting endpoint for service identities	Yes
search-entitlements-for-user	Performs a search of entitlements for the given user based on their idautoID	Yes
start-entitlement-request	Initiates an entitlement request for a particular user and entitlement based on idautoID and resourceId respectively	Yes
get-my-delegations	Gets delegations that are accessible to the authenticated user	Yes
get-user-info-in-delegation	Does an advanced search of a RapidID delegation	No
search-groups	Does a simple search of a RapidID group	Yes
get-group-members	Gets group members for a specified RapidID group	Yes
get-user-activity-from-audit-log	Returns audit log activity for a specific RapidID user over a given date range	Yes
get-connect-projects	Returns all RapidID Connect projects	Yes
get-connect-actions	Returns Connect action sets within a project, or across all projects	Yes
get-connect-action	Returns a single RapidID Connect action set by ID	Yes
save-connect-action	Saves (creates or updates) a RapidID Connect action set	Yes
delete-connect-action	Deletes a RapidID Connect action set by ID	Yes
get-password-policies-for	Retrieves the password policy for specified users	Yes
set-password	Sets the RapidID password for one or more users via delegations	Yes
run-connect-action	Runs a RapidID Connect action set and returns the HTML log	Yes
get-connect-files	Returns metadata for files and directories within the RapidID Connect files module	Yes
get-connect-file-content	Returns the text content of a file from the RapidID Connect files module	Yes

Skills

• RapidID Role Mining: Process for identifying dynamic filters for static RapidID groups.
• Connect Action Sets: Knowledge on how to work with RapidID Connect action sets.

Troubleshooting

• On authentication failures ensure RI_HOST, RI_USER / RI_PASSWORD, or RI_SERVICE_IDENTITY_SECRET_KEY are set correctly
• If you receive an unexpected empty array [] when using get-user-info-in-delegation, this is most likely due to utilizing service identities and switching to username and password will resolve the issue.
• Service identities do not have access to all endpoints, even with the Tenant Administrator role, and this typically shows as receiving an empty response such as an empty array [] or empty object {}
• The get-user-info-in-delegation does not support pagination, which can cause tool response size errors. A workaround for this is to use a combination of the search-groups and the get-group-members tools to chunk out users into multiple tool calls as the get-group-members tool supports pagination.
• If you receive a save error when using the save-connect-actions tool this is most likely due to not iterating the version number. Ensure that the most recent version of the action set is retrieved first using get-connect-action so that you iterate the version number properly
• The get-user-info-in-delegation takes a raw LDAP filter input. In circumstances where no results are returned this could be caused by a malformed LDAP filter.

Telemetry

Telemetry is off by default. Opt in by setting MCP_RAPIDID_TELEMETRY=true.

When enabled, the following anonymous usage data is sent to TelemetryDeck:

What is collected:

• Tool name and call duration
• Error type and status code (no error messages or stack traces)
• OS, CPU architecture, and MCP server version
• MCP client name and version (e.g. claude-ai)
• An anonymized Licensee ID derived from your RapidIdentity tenant (hashed by TelemetryDeck before storage — the raw ID is never stored)
• A session ID scoped to a single MCP session

What is never collected:

• RapidIdentity credentials or host
• Tool input arguments or API response data
• User names, email addresses, or any personally identifiable information

To opt in via the MCP config:

{
  "mcpServers": {
    "mcp-rapidid": {
      "command": "<path to downloaded binary>",
      "env": {
        "MCP_RAPIDID_TELEMETRY": "true",
        "RI_HOST": "portal.us006-rapididentity.com",
        "RI_USER": "kclarkson",
        "RI_PASSWORD": "notarealpassword123",
        "RI_LOG_LEVEL": "error"

      }
    }
  }
}

Getting Help

Open an issue at https://github.com/Jamf-Concepts/mcp-rapidid/issues