MCP Channel
Ask your AI assistant about identity data in plain English. The MCP channel connects Cursor, Claude Desktop, VS Code, and other MCP-compatible tools directly to your directory.
Quick start
Section titled “Quick start”Enable the MCP channels:
export SCRIBE_MCP_ENABLED=true # Data MCP at /mcpexport SCRIBE_MONITORING_MCP_ENABLED=true # Observe MCP at /observe/mcp (optional)| Endpoint | Purpose | Tools |
|---|---|---|
/mcp | Schema discovery, entry search, history, docs | describe, search, lookup, changes, hotChanges, help, ref |
/observe/mcp | System health, status, diagnostics | observe |
Connect your IDE
Section titled “Connect your IDE”One-click installs
Section titled “One-click installs”What you can ask
Section titled “What you can ask”Once connected, ask in plain English:
Find and explore data
"What entry types are in the directory?"
"Find users with @acme.com email addresses"
"Get the user with ID dXNlcjo5aXg"
"What did user 12345 look like yesterday?"
Track changes
"What changed in the last 24 hours?"
"Show me the history for user dXNlcjo5aXg"
"Which users changed the most this week?"
"Show modify events that touched the mail attribute in the last 7 days"
Check system health
"Is the system healthy?"
"Show me the error rates"
"What does error SCRIBE-1001 mean?"
Available resources
Section titled “Available resources”| URI | Description |
|---|---|
scribe://openapi | OpenAPI 3.1 specification |
scribe://graphql-schema | GraphQL schema (SDL) |
scribe://ref-index | Reference documentation index |
Query defaults
Section titled “Query defaults”Search and lookup return data attributes (*) when fields is omitted. Search uses channels.mcp.default-limit,
channels.mcp.default-fields, channels.mcp.default-sort, and channels.mcp.default-count; these inherit the shared
query.* defaults unless the MCP channel overrides them.
Change history
Section titled “Change history”Two MCP tools cover change feeds. They accept the same filters as REST and GraphQL change-history queries.
Change feed (changes)
Section titled “Change feed (changes)”Use changes for a global event timeline or for one entry when you pass id.
| Parameter | Description |
|---|---|
id | Entry identifier (GlobalId, UUID, numeric ID, or DN). Omit for the global feed. |
entryType | Filter by entry type(s), comma-separated. Global scope only. |
type | Event types: add, modify, move, delete |
affects | Changed attributes on modify events, comma-separated |
range | Time window (24h, 2024-01-01/2024-02-01, yesterday, …) or all for unbounded history |
since / until | Alternative to range (mutually exclusive) |
sort | timestamp (oldest first) or -timestamp (newest first) |
cursor / before | Forward or backward pagination |
limit | Page size |
count | none, estimated, or exact. Omit to use channels.mcp.default-count. |
Ask in plain English, for example: "Show User changes from the last 24 hours, newest first" or "What modify events affected mail this week?"
Hot entries (hotChanges)
Section titled “Hot entries (hotChanges)”Use hotChanges to rank entries by how many matching change events they received in a time window.
| Parameter | Description |
|---|---|
entryType | Filter by entry type(s), comma-separated |
type | Event types: add, modify, move, delete |
affects | Changed attributes on modify events, comma-separated |
range | Time window or all for unbounded history |
since / until | Alternative to range (mutually exclusive) |
sort | samples, -samples (default), lastTimestamp, -lastTimestamp, firstTimestamp, -firstTimestamp |
minSamples | Minimum matching events per entry |
cursor / before | Forward or backward pagination |
limit | Page size (default 25, maximum 100) |
Ask in plain English, for example: "Which users changed the most in the last 24 hours?" or "Show the 10 busiest groups this week, sorted by most recent activity."
Authentication
Section titled “Authentication”OAuth first. MCP prefers bearer tokens: clients obtain a JWT from your IdP and send it in the Authorization: Bearer header. Most MCP clients (Cursor, Claude Desktop, VS Code) handle OAuth flows automatically — register an OAuth client in your IdP, configure credentials in the client, and it manages the token flow.
Fallbacks when OAuth is unavailable. If clients cannot obtain tokens, use HTTP Basic auth. Scribe validates Authorization: Basic via ROPC (exchanges credentials with the IdP for a JWT) or LDAP bind (direct directory validation). Bearer is always checked first; Basic is used only when no Bearer token is present.
See Authentication for server-side setup, MCP Cursor callback issues for OAuth callback troubleshooting, and Configuration Reference for all MCP settings.