Content
# SailPoint IAM MCP Server
An MCP (Model Context Protocol) server for interacting with SailPoint. Supports both **IdentityNow (IDN)** and **IdentityIQ (IIQ)**. This server allows LLMs to search for and retrieve identity details directly from your SailPoint environment.
## Features
- **Multi-Product Support**: Interacts with both SailPoint IdentityNow (SaaS) and SailPoint IdentityIQ (On-Premise).
- **Identity Search**:
- **IDN**: Uses the `/v3/search` API.
- **IIQ**: Uses a **Custom Plugin REST API** (configurable path).
- **Mock Mode**: Test the server without an active SailPoint connection using simulated data.
- **Modern Stack**: Built with Python and managed by `uv`.
## Prerequisites
### Dependencies & Environment
- **Python**: Version `3.10` or higher.
- **Packages**: `httpx` (HTTP client), `mcp` (Model Context Protocol APIs), and `python-dotenv` (ENV loading). These are managed automatically by `uv`.
- **System**: [uv](https://github.com/astral-sh/uv) installed on your system.
### SailPoint Target System
- SailPoint Credentials:
- **IdentityNow**: Personal Access Token (Client ID and Client Secret).
- **IdentityIQ**: Custom Plugin installed and service account credentials.
## Configuration
1. Create a `.env` file in the project root (use `.env.example` as a template).
2. Configure the following variables based on your product:
### For IdentityNow (IDN)
```env
SAILPOINT_PRODUCT=idn
SAILPOINT_TENANT=your-tenant.identitynow.com
SAILPOINT_CLIENT_ID=your-client-id
SAILPOINT_CLIENT_SECRET=your-client-secret
MOCK_MODE=false
```
### For IdentityIQ (IIQ)
```env
SAILPOINT_PRODUCT=iiq
IIQ_URL=https://your-iiq-host/identityiq
IIQ_USERNAME=admin
IIQ_PASSWORD=secret
IIQ_CUSTOM_API_PATH=plugin/rest/customPlugin/getIdentities
MOCK_MODE=false
```
## Running the Server
### For Local Testing
To test the server using the MCP Inspector:
```powershell
npx @modelcontextprotocol/inspector uv run server.py
```
### For Real-world Usage (Claude Desktop)
To use this server with Claude Desktop, add it to your configuration file:
**File Location**: `%APPDATA%\Claude\claude_desktop_config.json`
**Configuration**:
```json
{
"mcpServers": {
"sailpoint-iam": {
"command": "uv",
"args": [
"--directory",
"c:\\MyProjects\\SailPoint\\MCPIAM",
"run",
"server.py"
],
"env": {
"SAILPOINT_PRODUCT": "iiq",
"IIQ_URL": "http://localhost:8080/identityiq",
"IIQ_USERNAME": "spadmin",
"IIQ_PASSWORD": "admin",
"MOCK_MODE": "false"
}
}
}
}
```
> **Important**: If you already have existing configuration in this file (such as a `"preferences"` block), be careful **not to overwrite** it! You should merge your `"mcpServers"` block alongside your existing settings.
## Available Tools
### `get_identity_details`
- **Description**: Search for identity details by name, alias, or username.
- **Arguments**:
- `name` (string): The search term.
- **Returns**: A list of search results containing identity attributes.
## Personal Settings Backup
*Full Claude desktop configuration for safe keeping:*
```json
{
"mcpServers": {
"sailpoint-iam": {
"command": "uv",
"args": [
"--directory",
"c:\\MyProjects\\SailPoint\\MCPIAM",
"run",
"server.py"
],
"env": {
"SAILPOINT_PRODUCT": "iiq",
"IIQ_URL": "http://localhost:8080/identityiq",
"IIQ_USERNAME": "spadmin",
"IIQ_PASSWORD": "admin",
"MOCK_MODE": "false"
}
}
},
"preferences": {
"coworkScheduledTasksEnabled": true,
"ccdScheduledTasksEnabled": true,
"sidebarMode": "chat",
"coworkWebSearchEnabled": true
}
}
```
