Onelogin MCP server

Connect Onelogin to Claude, ChatGPT, Cursor, Claude Code, Codex, Gemini, GitHub Copilot and any other MCP client, for your whole team. Metorial adds security, governance, and tracing, and gives everyone one Magic MCP URL to connect.

What you can do with the Onelogin MCP server

Ask your agent in plain language. Each of these maps to a real tool on the server.

  • Use the create user tool in Onelogin
  • Use the list apps tool in Onelogin
  • Use the update user tool in Onelogin
  • Use the get mfa factors tool in Onelogin
  • Use the manage user roles tool in Onelogin
  • Use the verify mfa factor tool in Onelogin

Supported Tools

create_user

Create User

Create a new user in the OneLogin directory. At minimum, an email or username is required. Optionally set name, department, title, phone, status, group, roles, and custom attributes.

list_apps

List Apps

List SSO-connected applications in OneLogin. Filter by name (wildcards supported), connector ID, or authentication method. Returns app metadata including auth method, visibility, and timestamps.

update_user

Update User

Update an existing user's profile in OneLogin. Supports updating name, email, username, department, title, phone, status, state, group, roles, manager, and custom attributes. Only provided fields are sent. OneLogin mappings and provisioning can run asynchronously; the returned user is an acknowledgment, not proof those workflows have completed.

get_mfa_factors

Get MFA Factors

Retrieve MFA information for a user including both available (unenrolled) factors and enrolled devices. The two reads are not an atomic snapshot and available factors are limited by the user's policy and API support.

manage_user_roles

Manage User Roles

Assign or remove roles from a OneLogin user. Roles control which applications a user can access. You can assign multiple roles at once or remove specific roles. Removal does not remove roles assigned through mapping or provisioning. Successful acknowledgment does not prove all indirect access is removed.

verify_mfa_factor

Verify MFA Factor

Verify an MFA factor enrollment by submitting the OTP code. Use this after enrolling a factor to complete the registration. For push-based factors like OneLogin Protect and Voice, use the poll option to check completion status.

get_app

Get App

Retrieve detailed information about a specific OneLogin application by its ID. Returns full configuration including SSO settings, provisioning config, parameters, and role associations.

list_events

List Events

Query historical events from your OneLogin account for audit logging, compliance, and reporting. Filter by event type, user, date range, and other attributes. Returns events with actor, target, app, and risk information.

manage_app

Manage App

Create, update, or delete an SSO-connected application in OneLogin. When creating, a connector ID and name are required. When updating, provide the app ID and any fields to change. When deleting, provide the app ID.

list_users

List Users

Search and list users in the OneLogin directory. Supports filtering by name, email, username, directory, external ID, app, and date ranges. Use wildcards (*) in filter values for partial matching.

list_roles

List Roles

List roles in OneLogin. Roles control user access to applications. Filter by name, app ID, or app name. Optionally include associated apps, users, and admins.

enroll_mfa_factor

Enroll MFA Factor

Enroll a new MFA factor for a OneLogin user. Supports SMS, Email, Voice, Google Authenticator, OneLogin Protect, and other TOTP authenticators. After enrollment, use the registration ID to verify the factor with an OTP code.

manage_role

Manage Role

Create, update, or delete a role in OneLogin. Roles control which applications users have access to. When creating, provide a name and optionally associate apps, users, and admins. Updates support name only; legacy apps/users/admins update inputs are refused before any change. Use the dedicated role association APIs or admin console for those changes. When deleting, provide the role ID and set action to "delete".

get_user

Get User

Retrieve detailed information about a specific OneLogin user by their ID. Returns the full user profile including name, email, status, roles, group, custom attributes, and activity timestamps.

get_event_types

Get Event Types

Retrieve all available event types from OneLogin. Each event type has an ID, name, and description. Use these IDs to filter events when querying the events API. Results should be cached as this endpoint is rate-limited.

delete_user

Delete User

Permanently delete a user from the OneLogin directory. This action cannot be undone.

list_groups

List Groups

List one native page of groups in OneLogin. Groups function as security boundaries to apply specific security policies to sets of users.

get_group

Get Group

Read one exact OneLogin group with its native policy, users and administrators. Requires Read All or Manage All API credentials; the API account is not a person identity.

get_role

Get Role

Read the native base role by its exact numeric ID. This response contains its ID and name; role users, apps and administrators require separate OneLogin association endpoints.

Connect Onelogin to your AI client

Every client uses the same Magic MCP URL, and so does any other MCP client. Add it once and sign in with SSO.

  1. Enable Onelogin in Metorial. In your Metorial portal, enable the Onelogin MCP server and sign in with the account that owns the data. Access stays governed by your team policies.
  2. Add a custom connector. Open Customize, then Connectors. Select Add, then Custom, then Web.
  3. Paste your Metorial MCP URL. Name it Metorial, paste your Magic MCP URL (<your-magic-mcp-url>) and continue.
  4. Sign in. Select Add and sign in to load Onelogin tools.

Run Onelogin through the Metorial gateway

One governed layer for every app your agents reach, not a separate connector per tool.

  • Give Onelogin and every other app to your whole team through one MCP gateway, behind your SSO.
  • Scope which teams and agents can use Onelogin tools with role-based access control, and trace every call.
  • Prefer to run it yourself? Metorial is open source and self-hostable.

More integrations teams use with Onelogin

Supabase

Manage PostgreSQL databases, authenticate users, store files, and run edge functions on Supabase. Perform CRUD operations on database tables via auto-generated REST and GraphQL APIs with row-level security. Create and manage user accounts with password, magic link, OTP, social login, and SSO authentication. Upload, download, list, and delete files organized in storage buckets. Deploy and invoke server-side TypeScript edge functions. Listen to realtime database changes, broadcast messages, and track user presence. Configure database webhooks for INSERT, UPDATE, and DELETE events. Programmatically manage Supabase organizations and projects, including creating/deleting projects, managing API keys, configuring auth settings, custom domains, network restrictions, and Edge Function secrets.

Datadog

Monitor infrastructure, applications, and services across cloud environments. Submit, discover, and query metrics; create and manage monitors and alerts; build and clean up dashboards; search and analyze logs; manage incidents; track SLOs; run synthetic tests; inspect users and hosts; and schedule or cancel monitor downtimes.

Firebase

Manage backend services for mobile and web applications. Create, read, update, and delete documents in Cloud Firestore and Realtime Database. Manage user accounts including creating, updating, deleting, and listing users with authentication support. Send push notifications and data messages to devices, topics, and device groups via Cloud Messaging (FCM). Upload, download, and delete files in Cloud Storage. Read and publish Remote Config templates to change app behavior remotely. Deploy and manage serverless Cloud Functions triggered by database events, authentication events, storage events, and HTTP requests. Stream real-time database changes via Server-Sent Events. Query databases with filters, ordering, and pagination. Perform batch writes and transactions in Firestore. Generate and verify custom tokens and ID tokens for user authentication.

Kibana

Manage Kibana resources and the Elastic Stack visualization layer programmatically. Create, import, export, and organize saved objects such as dashboards, visualizations, and data views across spaces. Configure alerting rules with threshold, query, and metric conditions, and connect them to actions via connectors (email, Slack, PagerDuty, webhook, Jira, ServiceNow, and more). Manage data views (index patterns) that define which Elasticsearch indices Kibana queries. Create and organize spaces to separate dashboards and objects into meaningful categories. Track incidents with cases, define and monitor Service Level Objectives (SLOs), manage Fleet agent policies and enrollments, configure security detection rules for SIEM, and control role-based access with Kibana feature privileges.

Kubernetes

Manage and orchestrate containerized applications on Kubernetes clusters. Create, update, scale, and delete workloads including Pods, Deployments, StatefulSets, DaemonSets, Jobs, and CronJobs. Configure service discovery and load balancing through Services, Ingress, and Endpoints. Manage configuration and storage with ConfigMaps, Secrets, PersistentVolumes, and StorageClasses. Control access with Namespaces, RBAC roles and bindings, ServiceAccounts, and NetworkPolicies. Administer cluster infrastructure including Nodes, ResourceQuotas, LimitRanges, and PriorityClasses. Autoscale workloads with HorizontalPodAutoscaler and VerticalPodAutoscaler. Define and manage Custom Resource Definitions (CRDs) to extend cluster functionality. Watch resources in real time for create, modify, and delete events. Configure admission webhooks to validate or mutate resources before persistence.

Cloudflare

Manage internet infrastructure including DNS records, domains, and zone settings. Deploy and configure serverless Workers scripts, R2 object storage buckets, and Pages deployments. Configure security rules including WAF, firewall rules, rate limiting, DDoS protection, and IP access controls. Manage SSL/TLS certificates, load balancers, origin pools, and health monitors. Upload and deliver video content via Cloudflare Stream. Access traffic, DNS, and security analytics via GraphQL. Configure Zero Trust Access applications, Gateway policies, and Tunnel connections. Set up alerting and webhook notifications for security events, health checks, certificate status, and usage thresholds. Register and manage domains, account members, roles, and API tokens.

Technical notes for Onelogin

Read and manage OneLogin users, roles and SSO applications, inspect native groups and audit events, and enroll or verify supported MFA factors using tenant-bound API credentials. API scopes control access; administrative operations can retain audit, notification and provisioning effects.

Frequently asked questions

Common questions about connecting Onelogin to AI agents with Metorial.

  1. How many tools does the Onelogin MCP server have?
    The Onelogin MCP server exposes 19 tools, including Create User, List Apps, Update User. Each one is governed and traced through Metorial.
  2. Onelogin exposes tools your agents call on demand; it does not publish event triggers yet. Everything still runs through one governed MCP URL.
  3. Any MCP client, including VS Code, Windsurf, Zed, OpenCode and Grok. Each one reaches the Onelogin MCP server through the same Metorial URL.
  4. Use role-based access control to decide which teams, users, and agents can use Onelogin and which of its tools they can call.
  5. Yes. Metorial is open source, so you can run the Onelogin MCP server yourself or use the hosted gateway.

Connect Onelogin to production AI agents

See how Metorial gives your team governed access to Onelogin, with tracing and security controls built in.