MCP server for Kanidm Identity Management using FastMCP
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-kanidm","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# Kanidm MCP Server (mcp-kanidm) A professional Model Context Protocol (MCP) server for managing an advanced Kanidm deployment. Built completely asynchronously leveraging `httpx` and `FastMCP`. This server is designed to work via the Kanidm REST v1 API using Service Accounts to keep your intelligent agents sandboxed and robust (eliminating standard CLI shell constraints). ## Features Provides the following MCP tools for Identity and Access Management in Kanidm: - `list_users`: Queries validated user identities with simple search filters. - `get_user_details`: Extends deep query capabilities into PII attributes and precise access windows (requires an appropriate service account assigned). - `reset_password_intent`: Generates a credential update intent token for help-desking scenarios securely (the AI agent will never directly reset nor touch user passwords directly). - `delete_user`: Manages robust termination via a **Human-in-the-Loop** (HITL) prompt (`ctx.elicit()`) guaranteeing a person grants affirmative consent ahead of any destructive REST operation. ## Installation and Usage To install or run this server dynamically within any compatible framework (Claude Desktop, etc.), you can run it via `uvx` dynamically or install via Python global packages using `uv`. ### Autenticación: Cómo obtener el KANIDM_TOKEN **Importante:** Nunca debes configurar el agente MCP utilizando tu cuenta principal de `admin`. Para mantener la seguridad, aislar los privilegios y garantizar un rastro de auditoría claro, debes usar una **Cuenta de Servicio** (Service Account). Sigue estos 3 pasos usando la CLI de Kanidm: 1. **Crear una cuenta de servicio** para esta integración (por ejemplo, llamada `mcp-agent`): ```bash kanidm service-account create mcp-agent "MCP Server Agent" ``` 2. **Asignarle los privilegios correctos**. Añade esta cuenta al grupo adecuado, como `idm_people_admins` (para gestión completa de usuarios) o `idm_service_desk` (para tareas de soporte): …
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.