Duo Security MCP server

Connect Duo Security to Claude, ChatGPT, Cursor, Claude Code, Codex, Gemini, GitHub Copilot and any other MCP client, for your whole team. Metorial adds security, governance, and tracing, and gives everyone one Magic MCP URL to connect.

Deploy Duo SecurityBook a demo

What you can do with the Duo Security MCP server

Ask your agent in plain language. Each of these maps to a real tool on the server.

  • Use the delete user tool in Duo Security
  • Use the delete group tool in Duo Security
  • Use the get authentication logs tool in Duo Security
  • Use the delete phone tool in Duo Security
  • Use the list phones tool in Duo Security
  • Use the create phone tool in Duo Security

Supported Tools

delete_user

Delete User

Permanently remove a Duo Security user without trash or restoration. Associated phones are not immediately deleted; retained devices and historical audit effects require separate reconciliation.

delete_group

Delete Group

Delete a Duo Security group. Users in the group will be disassociated but not deleted.

get_authentication_logs

Get Authentication Logs

Retrieve Duo authentication log events using the v2 API. Returns detailed records of authentication attempts including user, application, result, and device information. Events have a 2-minute delay before becoming available.

delete_phone

Delete Phone

Delete a phone from Duo Security. The phone will be disassociated from all users.

list_phones

List Phones

Retrieve a list of phones registered in Duo Security. Phones are MFA devices associated with users.

create_phone

Create Phone

Register a new phone in Duo Security for use as an MFA device.

create_bypass_codes

Create Bypass Codes

Generate one-time bypass codes for a Duo user. Bypass codes allow users to authenticate when they don't have access to their normal MFA device.

create_group

Create Group

Create a new Duo Security group for organizing users and applying access policies.

get_admin_logs

Get Administrator Logs

Retrieve Duo administrator action logs. Returns records of actions performed by administrators such as user creation, policy changes, and configuration updates.

get_account_summary

Get Account Summary

Retrieve a summary of the Duo account including user counts, integration counts, telephony credits, and current account settings.

get_user

Get User

Retrieve detailed information about a specific Duo user, including associated phones, tokens, and groups.

update_user

Update User

Update a Duo Security user's profile, status, group memberships, or phone associations. Supports modifying user fields, adding/removing groups, and associating/disassociating phones in a single operation.

list_integrations

List Integrations

Retrieve a list of Duo-protected applications (integrations). Each integration represents an application that uses Duo for authentication.

delete_admin

Delete Admin

Delete a Duo Security administrator account.

create_admin

Create Admin

Create a new Duo Security administrator account with a specified role.

update_admin

Update Admin

Update an existing Duo Security administrator's name, phone, or role.

get_telephony_logs

Get Telephony Logs

Retrieve Duo telephony log events. Returns records of phone calls and SMS messages sent for authentication purposes, including costs and outcomes.

list_users

List Users

Retrieve a list of Duo Security users. Supports filtering by username or email, and pagination for large result sets.

list_admins

List Admins

Retrieve a list of Duo Security administrator accounts with their roles and contact information.

create_user

Create User

Create a new Duo Security user. Optionally send an enrollment email to the user so they can set up their MFA device.

list_groups

List Groups

Retrieve a list of Duo Security groups. Groups are used to organize users and apply policies.

get_resource

Get Resource

Read exact Duo group, phone, administrator or protected application details using an ID from its list tool. Requires the corresponding Admin API read permission.

Connect Duo Security to your AI client

Every client uses the same Magic MCP URL, and so does any other MCP client. Add it once and sign in with SSO.

  1. Enable Duo Security in Metorial. In your Metorial portal, enable the Duo Security MCP server and sign in with the account that owns the data. Access stays governed by your team policies.
  2. Add a custom connector. Open Customize, then Connectors. Select Add, then Custom, then Web.
  3. Paste your Metorial MCP URL. Name it Metorial, paste your Magic MCP URL (<your-magic-mcp-url>) and continue.
  4. Sign in. Select Add and sign in to load Duo Security tools.

Run Duo Security through the Metorial gateway

One governed layer for every app your agents reach, not a separate connector per tool.

  • Give Duo Security and every other app to your whole team through one MCP gateway, behind your SSO.
  • Scope which teams and agents can use Duo Security tools with role-based access control, and trace every call.
  • Prefer to run it yourself? Metorial is open source and self-hostable.

More integrations teams use with Duo Security

Supabase

Manage PostgreSQL databases, authenticate users, store files, and run edge functions on Supabase. Perform CRUD operations on database tables via auto-generated REST and GraphQL APIs with row-level security. Create and manage user accounts with password, magic link, OTP, social login, and SSO authentication. Upload, download, list, and delete files organized in storage buckets. Deploy and invoke server-side TypeScript edge functions. Listen to realtime database changes, broadcast messages, and track user presence. Configure database webhooks for INSERT, UPDATE, and DELETE events. Programmatically manage Supabase organizations and projects, including creating/deleting projects, managing API keys, configuring auth settings, custom domains, network restrictions, and Edge Function secrets.

Datadog

Monitor infrastructure, applications, and services across cloud environments. Submit, discover, and query metrics; create and manage monitors and alerts; build and clean up dashboards; search and analyze logs; manage incidents; track SLOs; run synthetic tests; inspect users and hosts; and schedule or cancel monitor downtimes.

Firebase

Manage backend services for mobile and web applications. Create, read, update, and delete documents in Cloud Firestore and Realtime Database. Manage user accounts including creating, updating, deleting, and listing users with authentication support. Send push notifications and data messages to devices, topics, and device groups via Cloud Messaging (FCM). Upload, download, and delete files in Cloud Storage. Read and publish Remote Config templates to change app behavior remotely. Deploy and manage serverless Cloud Functions triggered by database events, authentication events, storage events, and HTTP requests. Stream real-time database changes via Server-Sent Events. Query databases with filters, ordering, and pagination. Perform batch writes and transactions in Firestore. Generate and verify custom tokens and ID tokens for user authentication.

Kibana

Manage Kibana resources and the Elastic Stack visualization layer programmatically. Create, import, export, and organize saved objects such as dashboards, visualizations, and data views across spaces. Configure alerting rules with threshold, query, and metric conditions, and connect them to actions via connectors (email, Slack, PagerDuty, webhook, Jira, ServiceNow, and more). Manage data views (index patterns) that define which Elasticsearch indices Kibana queries. Create and organize spaces to separate dashboards and objects into meaningful categories. Track incidents with cases, define and monitor Service Level Objectives (SLOs), manage Fleet agent policies and enrollments, configure security detection rules for SIEM, and control role-based access with Kibana feature privileges.

Kubernetes

Manage and orchestrate containerized applications on Kubernetes clusters. Create, update, scale, and delete workloads including Pods, Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs. Configure service discovery and load balancing through Services, Ingress, and Endpoints. Manage configuration and storage with ConfigMaps, Secrets, PersistentVolumes, and StorageClasses. Control access with Namespaces, RBAC roles and bindings, ServiceAccounts, and NetworkPolicies. Administer cluster infrastructure including Nodes, ResourceQuotas, LimitRanges, and PriorityClasses. Autoscale workloads with HorizontalPodAutoscaler and VerticalPodAutoscaler. Define and manage Custom Resource Definitions (CRDs) to extend cluster functionality. Watch resources in real time for create, modify, and delete events. Configure admission webhooks to validate or mutate resources before persistence.

Cloudflare

Manage internet infrastructure including DNS records, domains, and zone settings. Deploy and configure serverless Workers scripts, R2 object storage buckets, and Pages deployments. Configure security rules including WAF, firewall rules, rate limiting, DDoS protection, and IP access controls. Manage SSL/TLS certificates, load balancers, origin pools, and health monitors. Upload and deliver video content via Cloudflare Stream. Access traffic, DNS, and security analytics via GraphQL. Configure Zero Trust Access applications, Gateway policies, and Tunnel connections. Set up alerting and webhook notifications for security events, health checks, certificate status, and usage thresholds. Register and manage domains, account members, roles, and API tokens.

Technical notes for Duo Security

Read and manage Duo Admin API users, groups, phones and administrators; generate bypass codes, discover protected applications, and read account settings, utilization and authentication, administrator and telephony logs.

Frequently asked questions

Common questions about connecting Duo Security to AI agents with Metorial.

  1. How many tools does the Duo Security MCP server have?
    The Duo Security MCP server exposes 22 tools, including Delete User, Delete Group, Get Authentication Logs. Each one is governed and traced through Metorial.
  2. Duo Security exposes tools your agents call on demand; it does not publish event triggers yet. Everything still runs through one governed MCP URL.
  3. Any MCP client, including VS Code, Windsurf, Zed, OpenCode and Grok. Each one reaches the Duo Security MCP server through the same Metorial URL.
  4. Use role-based access control to decide which teams, users, and agents can use Duo Security and which of its tools they can call.
  5. Yes. Metorial is open source, so you can run the Duo Security MCP server yourself or use the hosted gateway.

Connect Duo Security to production AI agents

See how Metorial gives your team governed access to Duo Security, with tracing and security controls built in.

Book a demoDeploy Duo Security