# Frontegg MCP Server ### 96 tools — mobile-SDK audit/fix (47) + Frontegg Management API (49) [![MCP](https://img.shields.io/badge/MCP-1.0-8b5cf6?style=for-the-badge)](https://modelcontextprotocol.io) [![Node](https://img.shields.io/badge/Node-≥18-43853d?style=for-the-badge&logo=node.js&logoColor=white)](https://nodejs.org) [![SDKs](https://img.shields.io/badge/SDKs-5-f43f5e?style=for-the-badge)](#supported-sdks) [![Tools](https://img.shields.io/badge/Tools-96-10b981?style=for-the-badge)](#tools) [![Rules](https://img.shields.io/badge/Rules-135+-06b6d4?style=for-the-badge)](#what-it-checks) [![License: ISC](https://img.shields.io/badge/License-ISC-007acc?style=for-the-badge)](./LICENSE)
Frontegg MCP Server detecting React Native deep-link issues and emitting ready-to-apply diffs

Frontegg MCP Server detecting React Native deep-link issues and emitting ready-to-apply diffs

**Diagnose. Apply real diffs. Configure your tenant from chat.** _{Works with **Claude Desktop** · **Cursor** · **Claude Code** · any MCP-compatible client}

> **Companion repos:** > - 🧠 [**`frontegg/coding-agent-skills`**](https://github.com/frontegg/coding-agent-skills) — 27 trigger-activated skills that orchestrate these tools end-to-end > - 🚀 [**`frontegg/coding-agent-toolkit`**](https://github.com/frontegg/coding-agent-toolkit) — one-command installer that wires both into your AI client
--- ## Table of contents - [Highlights](#highlights) - [Supported SDKs](#supported-sdks) - [Install](#install) - [Development](#development) - [Quick start](#quick-start) - [What you can ask it](#what-you-can-ask-it) - [Examples](#examples) - [Tools](#tools) - [What it checks](#what-it-checks) - [Configuration](#configuration) - [FAQ & troubleshooting](#faq--troubleshooting) --- ## Highlights

### Live canonical knowledge Reads Frontegg SDK source from GitHub at runtime. Cache refreshes every 6 hours. Never stale.	### 5-SDK auto-detection Detects Android, iOS, Flutter, React Native, or Ionic. Runs the right detectors automatically.	### Ready-to-apply diffs Real unified diffs from official `example/` apps. `.bak` backups. `dry_run` preview.
### CIAM feature guides Setup steps and pitfalls for social login, passkeys, step-up auth, SSO, multi-tenancy, sessions, and more.	### Tenant configuration from chat Read and update MFA, sessions, SSO, identity, password policy, branding, audit logs, users, roles — direct via the Management API.	### Security-aware Flags `http://` base URLs, hardcoded credentials, `.env` outside `.gitignore`, iOS ATS exceptions — before you ship.

--- ## Supported SDKs

| Platform | Canonical repo | Coverage | |---|---|:---:| |

**Android (Kotlin)** | [`frontegg/frontegg-android-kotlin`](https://github.com/frontegg/frontegg-android-kotlin) | full | |

**iOS (Swift)** | [`frontegg/frontegg-ios-swift`](https://github.com/frontegg/frontegg-ios-swift) | full | |

**Flutter** | [`frontegg/frontegg-flutter`](https://github.com/frontegg/frontegg-flutter) | full | |

**React Native** | [`frontegg/frontegg-react-native`](https://github.com/frontegg/frontegg-react-native) | full | |

**Ionic / Capacitor** | [`frontegg/frontegg-ionic-capacitor`](https://github.com/frontegg/frontegg-ionic-capacitor) | full |

--- ## Install This server installs **standalone** — no other Frontegg tooling required. The package is published on npm as [`@frontegg/frontegg-mcp-server`](https://www.npmjs.com/package/@frontegg/frontegg-mcp-server). Wire it directly into any MCP-compatible client; `npx` fetches the latest version on first run. > ⚠️ **Version note.** This branch / PR is `2.0.0` (96 tools — mobile + platform). npm currently has the pre-merge `1.0.1` (49 platform tools only). Until PR #24 merges and `2.0.0` ships to npm, `npx --yes @frontegg/frontegg-mcp-server` will fetch `1.0.1`. To run the full 96-tool surface today, use the [Development](#development) clone-and-build flow below. > **Want the tenant configuration tools (MFA, SSO, users, branding, audit logs, etc.)?** Set the `FRONTEGG_CLIENT_ID` + `FRONTEGG_API_KEY` env vars in your client's MCP config. The diagnose / fix tools work without them. See [Configuration](#configuration) for where to find your Frontegg credentials.

Cursor

Edit `~/.cursor/mcp.json`: ```json { "mcpServers": { "frontegg": { "command": "npx", "args": ["--yes", "@frontegg/frontegg-mcp-server"], "env": { "FRONTEGG_CLIENT_ID": "your-client-id", "FRONTEGG_API_KEY": "your-api-secret" } } } } ``` Reload Cursor. Tools appear in the chat sidebar in Agent mode. > Drop the `env` block if you only need diagnose/fix tools (no tenant API).

Claude Desktop

Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows). Same JSON block as Cursor. Quit and relaunch.

Claude Code CLI

```bash claude mcp add frontegg \ -e FRONTEGG_CLIENT_ID=your-client-id \ -e FRONTEGG_API_KEY=your-api-secret \ -- npx --yes @frontegg/frontegg-mcp-server ``` Omit the `-e` flags if you only need diagnose/fix tools.

Any other MCP client

Speaks MCP over stdio. Launch with `npx --yes @frontegg/frontegg-mcp-server`. Set `FRONTEGG_CLIENT_ID` and `FRONTEGG_API_KEY` in the process environment if you need tenant API tools.

Want the combined stack (MCP + skills + auto-wiring + credential validation)?

That's what the [`coding-agent-toolkit`](https://github.com/frontegg/coding-agent-toolkit) does: ```bash npx @frontegg/coding-agent-toolkit init ``` It auto-detects your client, validates your Frontegg credentials against the Management API before saving them, wires the MCP entry, and installs the matching skills. Use it when you want both the MCP and skills in one go. MCP-only users don't need it — the per-client snippets above are sufficient.

--- ## Development To build from source (for contributing or running a fork): ```bash git clone https://github.com/frontegg/frontegg-mcp-server.git cd frontegg-mcp-server npm install npm run build # tsc → dist/ npm test # 215 jest + 89 vitest ``` Point your client at `node /absolute/path/to/frontegg-mcp-server/dist/index.js` to test local changes. > **Using `nvm`?** GUI apps don't inherit your shell PATH. Use the absolute path from `which node`. --- ## Quick start Open your mobile project. Ask your assistant: ```text Use frontegg_auto on this project and tell me what's wrong with my Frontegg setup. ``` The MCP will: 1. **Detect** your SDK (Android / iOS / Flutter / RN / Ionic) 2. **Fetch** the canonical Frontegg repo from GitHub 3. **Diagnose** the project — findings grouped by deep-link, init, auth, build, security 4. **Generate** unified diffs from the official `example/` app 5. **Apply** on request via `frontegg_apply_diff` Iterate until clean. --- ## What you can ask it No tool names required. Plain language works:

> _"Why isn't my React Native login redirect coming back?"_ Finds the missing intent-filter / URL scheme / Associated Domain. Returns a patch.	> _"Is my frontegg_flutter version up to date?"_ Compares `pubspec.yaml` against the latest release. Flags drift.
> _"How do I set up Apple Sign In with Frontegg?"_ Returns setup steps and pitfalls from the CIAM guides.	> _"Show me the current MFA policy."_ Reads your tenant's MFA config via the Management API.
> _"Force MFA for all users except SSO."_ Updates the MFA policy. No portal click.	> _"Security sanity check before shipping."_ Flags hardcoded credentials, HTTP URLs, `.env` issues, ATS exceptions.

--- ## Examples

① React Native deep links aren't working

> _Use `frontegg_auto` on `/Users/me/code/my-rn-app`. Login redirects to Safari and never returns._ Detects RN, fetches `frontegg-react-native`, identifies the missing `intent-filter` and `CFBundleURLTypes`, returns the exact diff from the example app.

Chat mockup: MCP detecting React Native deep-link issues

```bash npm run demo:rn ```

---

② Flutter SDK out of date

> _Run the Frontegg MCP on my Flutter app. Restrict to the flutter SDK._

Chat mockup: Flutter SDK version drift

Reads `pubspec.yaml`, compares against the current `frontegg-flutter` release. Returns a one-line bump diff.

Terminal demo: version drift detection for a Flutter project

```bash npm run demo:flutter ```

---

③ Ionic app opens Safari after login

> _My Ionic app opens Safari after login. Fix it — `~/code/ionic-store`._

Chat mockup: Ionic Capacitor fixes

One pass identifies: missing `FronteggNative` plugin block in `capacitor.config.ts`, absent `intent-filter` in the Android shell, missing `CFBundleURLTypes` in iOS. Diffs sourced from `frontegg-ionic-capacitor/example`.

Terminal demo: Ionic Capacitor integration fixes

```bash npm run demo:ionic ```

---

④ Security sanity check

> _Use `frontegg_auto` on this project. Security issues only._

Chat mockup: security sweep

Flags HTTP base URLs, `.env` outside `.gitignore`, hardcoded `clientId`s, iOS ATS exceptions. Each finding ships with a completion gate — won't mark work shipped until every item is verified.

Terminal demo: security sweep

```bash npm run demo:security ```

---

⑤ Configure MFA from chat

> _Show me the current MFA policy. Then force MFA for everyone except SSO._ ```text > frontegg_configure_mfa action=get enforceMFAType: DontForce allowRememberMyDevice: true mfaDeviceExpiration: 1209600 > frontegg_configure_mfa action=update enforceMFAType=ForceExceptSAML enforceMFAType: ForceExceptSAML ✓ ```

--- ## Tools **96 tools across two surfaces.** ### Two-surface model This server exposes two distinct tool surfaces, registered into a single MCP: - **Mobile / audit surface** (47 tools, snake_case names with `frontegg_` prefix) — diagnose/fix SDK integration issues, configure tenants, audit user activity. Originally `frontegg-mobile-mcp-server`. - **Platform surface** (49 tools, kebab-case names) — full CRUD over Frontegg roles, permissions, applications, users, tenants, vendor integrations, API tokens. Imported from [`frontegg/frontegg-mcp-server`](https://github.com/frontegg/frontegg-mcp-server). Both surfaces share the same `FRONTEGG_CLIENT_ID` + `FRONTEGG_API_KEY` (alias `FRONTEGG_SECRET_KEY`) credentials. Naming conventions differ for v1 to avoid breaking either upstream's existing integrations; a future v2 may unify. --- ### Mobile / audit surface (47 tools) ### Diagnosis & fix (10) | Tool | What it does | |---|---| | `frontegg_auto` | **Start here.** Full diagnosis + diffs in one pass. | | `frontegg_apply_diff` | Apply diffs to disk. `.bak` backups. `dry_run` support. | | `analyze_repo` | Run detectors. Return raw findings. | | `generate_diffs` | Generate diffs for specific finding IDs. | | `list_rules` | Browse the rule catalog. Auto-filtered to your SDK. | | `explain_finding` | Explain a rule with troubleshooting steps. | | `read_resource` | Read a project file or directory listing. | | `detect_android_issues` | Android detector only. | | `detect_ios_issues` | iOS detector only. | | `detect_common_issues` | Cross-platform checks (env, credentials, base URL). | ### CIAM feature guides (1) | Tool | What it does | |---|---| | `frontegg_feature_guide` | Setup steps and pitfalls for: social login, passkeys, step-up, sessions, tokens, security rules, hosted vs embedded, multi-tenancy, entitlements, SMS login, SSO, password policies. | ### Auth (1, optional) | Tool | What it does | |---|---| | `frontegg_login` | OAuth 2.0 PKCE login against your Frontegg tenant. Optional — the API tools below use `FRONTEGG_CLIENT_ID` + `FRONTEGG_SECRET` env vars directly. | ### Tenant configuration (10) Calls the **Frontegg Management API**. Requires `FRONTEGG_CLIENT_ID` + `FRONTEGG_SECRET` (see [Configuration](#configuration)). | Tool | What it does | |---|---| | `frontegg_configure_mfa` | MFA policy (enforcement, remember device, expiration). | | `frontegg_configure_sessions` | Session config. *(Vendor-token PATCH may silently no-op on some tenants.)* | | `frontegg_configure_sso` | List or create a social login provider (google, github, microsoft, facebook, linkedin, gitlab, slack, twitter, apple). | | `frontegg_configure_identity` | Auth config (strategy, token TTLs, signups, JWT claims, SameSite cookies). | | `frontegg_configure_password_policy` | Password complexity (min length, history). | | `frontegg_configure_lockout_policy` | Account lockout (threshold, duration). | | `frontegg_configure_security_rules` | Read CAPTCHA / threat-protection policy. *(Write needs real reCAPTCHA keys.)* | | `frontegg_email_templates_list` / `_update` | Tenant email templates. *(Vendor-token-blocked on some tenants.)* | | `frontegg_branding_get` / `_update` | Tenant branding (logo, primary color, theme). | ### Users, tenants, RBAC, audit (11) | Tool | What it does | |---|---| | `frontegg_users_list` | List users with filters. | | `frontegg_users_invite` | Send an invitation email. | | `frontegg_audit_logs` | Query auth events. | | `frontegg_tenants_list` | List tenants. | | `frontegg_roles_list` / `_create` | RBAC roles. | | `frontegg_user_sessions_list` | Active sessions for a user. | | `frontegg_user_session_revoke` | Kick one session. | | `frontegg_user_sessions_revoke_all` | Kick all sessions for a user (requires `confirm: true`). | | `frontegg_user_mfa_get` | Read a user's MFA factors. | | `frontegg_user_mfa_reset` | Admin-reset a user's MFA. | | `frontegg_user_mfa_enforce` | *(Vendor-token can't force MFA per-user; use `frontegg_configure_mfa` for tenant-wide.)* | ### Applications, webhooks, entitlements, API tokens (10) | Tool | What it does | |---|---| | `frontegg_applications_list` / `_get` / `_create` | Application records in the vendor environment. | | `frontegg_webhooks_list` / `_create` | Webhook subscriptions. | | `frontegg_features_list` / `_create` | Feature flags (entitlements). | | `frontegg_plans_list` | Subscription plans. | | `frontegg_plan_feature_attach` | Attach a feature to a plan. *(Write may no-op on vendor-token tenants.)* | | `frontegg_api_tokens_list` / `_create` / `_revoke` | Tenant- or user-scoped API tokens. Create returns the secret once. | Each API tool: `action="get"` (or `"list"`) reads, `action="update"` (or `"create"`) writes. ### Known limitations A few tools ship partial because the Frontegg vendor-token API doesn't expose the needed surface: - `frontegg_configure_sessions` write can silently no-op - `frontegg_configure_security_rules` write needs real reCAPTCHA keys - `frontegg_email_templates_*` 404 on vendor tokens (tenant-scoped admin required) - `frontegg_user_mfa_enforce` — per-user endpoint not exposed - `frontegg_plan_feature_attach` write may no-op - `frontegg_configure_sso` can list and create — cannot delete or disable Each affected tool's `description` field flags the limitation so the LLM picks an alternative when one exists. --- ### Platform surface (49 tools) Imported from [`frontegg/frontegg-mcp-server`](https://github.com/frontegg/frontegg-mcp-server) — full CRUD over Frontegg's management plane. Tool names are kebab-case to preserve compatibility with anyone already integrated against upstream. #### Roles (5) | Tool | What it does | |---|---| | `get-roles` | List all roles in your tenant. | | `create-role` | Create a new role with name + description. | | `update-role` | Rename or re-describe an existing role. | | `delete-role` | Delete a role. Irreversible. | | `set-permissions-to-role` | Replace a role's full permission set. | #### Permissions (10) | Tool | What it does | |---|---| | `get-permissions` | List all permissions. | | `create-permission` | Create a new permission (key + name + category). | | `update-permission` | Rename/rephrase a permission. | | `delete-permission` | Delete a permission. Cascades across roles. | | `set-permission-to-multiple-roles` | Attach one permission to N roles at once. | | `set-permissions-classification` | Classify permissions (PII/PHI/read-write). | | `get-permission-categories` | List permission categories. | | `create-permission-category` | Create a new category bucket. | | `update-permission-category` | Rename a category. | | `delete-permission-category` | Delete a category (only if empty). | #### Users (4) | Tool | What it does | |---|---| | `get-users` | Paginated list with filters (email, tenant, sort). | | `invite-user` | Create + invite a user. Optional `skipInviteEmail`. | | `update-user` | Edit user fields. | | `delete-user` | Delete a user. | #### Tenants (3) | Tool | What it does | |---|---| | `create-tenant` | Create a new tenant. | | `update-tenant` | Edit tenant fields. | | `delete-tenant` | Delete a tenant. Irreversible. | > Listing tenants is available via the mobile surface's `frontegg_tenants_list`. #### Applications (6) | Tool | What it does | |---|---| | `get-applications` | List standard applications. | | `get-users-for-application` | List users assigned to an app. | | `assign-users-to-application` | Assign users to an app. | | `get-agent-applications` | List agent (LLM-actor) applications. | | `create-agent-application` | Create a new agent application. | | `update-agent-application` | Edit an agent application. | #### API Tokens (7) | Tool | What it does | |---|---| | `create-token` | Create a vendor API token. | | `get-tokens` | List vendor API tokens. | | `delete-token` | Revoke a vendor API token. | | `create-client-credentials` | Create a client-credentials token pair. | | `get-client-credentials` | List client-credentials tokens. | | `update-client-credentials` | Edit a client-credentials token's metadata. | | `delete-client-credentials` | Revoke a client-credentials token. | #### Personal Tokens (6) | Tool | What it does | |---|---| | `get-user-access-tokens` | List a user's access tokens. | | `create-user-access-token` | Create a user access token. | | `delete-user-access-token` | Revoke a user access token. | | `get-user-api-tokens` | List a user's API tokens. | | `create-user-api-token` | Create a user API token. | | `delete-user-api-token` | Revoke a user API token. | #### Vendor Integrations (6) | Tool | What it does | |---|---| | `get-vendor-integrations` | List integrations your tenant publishes. | | `create-vendor-integration` | Publish a new vendor integration (app-to-app or behalf-of-user). | | `update-vendor-integration` | Edit a vendor integration. | | `delete-vendor-integration` | Delete a vendor integration. | | `assign-agents-to-vendor-integration` | Grant N agents access through the integration. | | `unassign-agents-from-vendor-integration` | Revoke agents' access. | #### Frontegg Integrations (2) | Tool | What it does | |---|---| | `get-frontegg-integrations` | List first-party connectors Frontegg ships (Slack, webhooks, etc.). | | `get-frontegg-integration` | Inspect one connector's config schema + activation state. | > Activating/configuring Frontegg integrations beyond reading their state requires the Frontegg portal — the API surface is read-only at v1. --- ## What it checks **135+ rules** across four layers: - **Detection** — missing intent-filter, CFBundleURLTypes, Associated Domains, init call, INTERNET permission, ATS exceptions, `.env` outside `.gitignore` - **Config flags** — `embeddedMode`, `lateInit`, `useAssetsLinks`, `useChromeCustomTabs`, `enableOfflineMode`, `enableSessionPerTenant`, `useLegacySocialLoginFlow`, and dozens more per SDK - **Advisory (real support cases)** — cold-start deep-link crashes, refresh-token fatals, Doze Mode, R8/ProGuard stripping, tenant permission bleed, WebView issues - **CIAM feature** — Apple/Google social login, passkeys (`webcredentials:` / asset links), step-up, SSO, sessions, tokens, SMS, password policies > Run `list_rules` inside your project — only relevant rules appear. Pass `all: true` for the full catalog. --- ## Configuration ### Optional (all tools) ```bash GITHUB_TOKEN=ghp_xxx # Lifts GitHub rate limits — recommended for heavy use LOG_LEVEL=info # error | warn | info | debug ``` ### Frontegg credentials (tenant configuration tools only) The `frontegg_configure_*`, `users`, `tenants`, `roles`, `audit_logs`, `branding`, `webhooks`, `applications`, `features`, `plans`, `api_tokens`, and `user_sessions` / `user_mfa` admin tools need vendor credentials: ```bash FRONTEGG_CLIENT_ID=your-client-id # UUID — your Frontegg environment's client ID FRONTEGG_SECRET=your-api-secret # UUID — your Frontegg environment's API key ``` **Where to find them in the Frontegg portal:** 1. Log into [https://portal.frontegg.com](https://portal.frontegg.com) 2. Pick the workspace and environment you want to manage 3. Navigate to **⚙️ Settings → Workspace Settings → Environment** (path may differ slightly by portal version — search "API Key" or "Client ID" if you can't find it) 4. Copy the **Client ID** and **API Key** values Both are UUIDs in the format `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`. **Without these:** diagnose / fix tools (`analyze_repo`, `apply_diff`, `feature_guide`, etc.) work normally. Only the tenant-API tools error. **Where to put them:** - **`.env` file** at the MCP server's directory (works for local development) - **Your MCP client's config** (Cursor `~/.cursor/mcp.json`, Claude Desktop `claude_desktop_config.json`, etc.) — recommended: ```json { "mcpServers": { "frontegg-mobile": { "command": "node", "args": ["/absolute/path/to/frontegg-mcp-server/dist/index.js"], "env": { "GITHUB_TOKEN": "ghp_xxx", "FRONTEGG_CLIENT_ID": "your-client-id", "FRONTEGG_SECRET": "your-api-secret" } } } } ``` **Verify your credentials work** — in your MCP client's chat, ask: ```text Use frontegg_configure_mfa with action=get to read my tenant's MFA policy. ``` A successful response returns the current MFA config. An error like *"FRONTEGG_CLIENT_ID and FRONTEGG_SECRET environment variables are required"* means the env vars didn't reach the MCP — double-check spelling and that you restarted the client after editing the config. --- ## FAQ & troubleshooting

Will it modify my files?

Only via frontegg_apply_diff, when you ask. Creates .bak backups. Use dry_run: true to preview.

Will the API tools change my Frontegg environment?

Only with action="update". Reading is safe.

Does it send my code anywhere?

No. Analysis is local. Outbound calls go to raw.githubusercontent.com (public SDK repos) and api.frontegg.com (only with credentials and the frontegg_configure_* tools).

Do I need a Frontegg account?

Not for diagnosis, diffs, or feature guides. The frontegg_configure_* tools need vendor credentials.

Server not showing up in my client?

- Verify the absolute path to `dist/index.js` - Run `npm run build` first - Test directly: `node /path/to/dist/index.js` — should print startup logs - Cursor: switch to Agent mode. Toggle the server off/on in Settings.

"No issues detected" but something's wrong?

- Point it at the project root, not a subdirectory - Pass `sdk` explicitly: `android-kotlin`, `ios-swift`, `flutter`, `react-native`, or `ionic-capacitor`

GitHub rate limits?

Set GITHUB_TOKEN — even a no-scope token helps. Knowledge cache holds for 6 hours.

Connection errors?

Usually node isn't on the GUI app PATH. Use the absolute path from which node or the bundled bin/mcp-launcher.sh.

Works offline?

Partially. Detectors run locally. Version-drift checks and API tools need network.

Can I run it in CI?

Yes. Standard Node 18+ over stdio. Set GITHUB_TOKEN to avoid rate limits.

---

**Built for developers integrating Frontegg into mobile apps.** Every answer cites a Frontegg SDK file. Every diff is ready to paste. Every claim is evidence-backed.