Skip to content
actionlake
Start free

Connectors · Identity & security

Clerk MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Clerk and the rest of your systems. It gives your agent 252 Clerk actions (87 reads, 105 writes and 60 that wait for a confirmation) and holds the Clerk credential itself, so the agent never does. It paces Clerk's limits and records every call.

Connect Clerk freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "clerk.users.list",  intent: "check which Clerk account is connected"}# List all users · read · 1 upstream call
  • 252actionsin one signed file
  • 87readlook, never change
  • 105writecreate and update
  • 60wait for a yesdestructive, confirmed first

Set up

Connect Clerk in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect Clerk.

    Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.

    • secret_keyClerk secret key
    account { op: "connections.requirements", service: "clerk" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "clerk.users.list" }# list all users · read · 1 upstream callcheck { action: "clerk.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Clerk at a glance

Sign-in
Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide
secret_key
Limits we pace to
1,000 calls per 10 seconds, per connection
API covered
Clerk Backend API v1, Clerk-API-Version 2026-08-20 (OpenAPI 3.0.3)api.clerk.com/v1
Built from
Clerk's documentation, read 23 October 2026OpenAPI spec (GitHub)clerk.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
73 of 87 reads, for up to 5 minutes; a write clears what it affects
Shared entities
5, so ask can line Clerk up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Clerk.

252 actions in 87 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 87readlook, never change
  • 105writecreate and update
  • 60destructivewait for a confirmation

  1. Users

    15

    5 read · 7 write · 3 destructive

    List all users · Create a new user · Retrieve a user · Update a user

  2. API keys

    7

    3 read · 2 write · 2 destructive

    Create an API Key · Get API Keys · Get an API Key by ID · Delete an API Key

  3. Oauth applications

    7

    2 read · 2 write · 3 destructive

    Get a list of OAuth applications for an instance · Create an OAuth application · Retrieve an OAuth application by ID · Update an OAuth application

  4. Organization invitations

    7

    4 read · 2 write · 1 destructive

    Create and send an organization invitation · Bulk create and send organization invitations · Get a list of organization invitations · Get a list of organization invitations for the current instance

  5. Directories

    6

    2 read · 2 write · 2 destructive

    Create a directory · List all directories · Retrieve a directory · Rotate a directory's API key

  6. Email addresses

    6

    1 read · 4 write · 1 destructive

    Create an email address · Send a verification code to an email address · Verify a code sent to an email address · Retrieve an email address

  7. Organization domains

    6

    2 read · 3 write · 1 destructive

    Create a new organization domain. · Get a list of all domains of an organization. · List all organization domains · Update an organization domain.

  8. Phone numbers

    6

    1 read · 4 write · 1 destructive

    Create a phone number · Send a verification code to a phone number · Verify a code sent to a phone number · Retrieve a phone number

79 more areas · 192 actions
  • Scim directories 6
  • Templates 6
  • Waitlist entries 6
  • Enterprise connections 5
  • Invitations 5
  • JWT templates 5
  • Machines 5
  • Organization memberships 5
  • Organization permissions 5
  • Organization roles 5
  • Organizations 5
  • Role sets 5
  • Saml connections 5
  • Sessions 5
  • Billing subscription items 4
  • Directory group role mappings 4
  • Domains 4
  • M2M tokens 4
  • Redirect urls 4
  • Scim directory group role mappings 4
  • Allowlist identifiers 3
  • Blocklist identifiers 3
  • Clients 3
  • SSO bypass allowlist users 3
  • Actor tokens 2
  • Admin portal link tokens 2
  • Agent tasks 2
  • Billing prices 2
  • Billing statements 2
  • Billing subscription item discounts 2
  • Enterprise connection test runs 2
  • Instance 2
  • Instance communication 2
  • Instance domain 2
  • Instance oauth application settings 2
  • Instance organization settings 2
  • Instance protect 2
  • Machine scopes 2
  • Machine secret key 2
  • Organization billing credits 2
  • Organization metadata 2
  • Organization role permissions 2
  • Role set roles 2
  • Session tokens 2
  • Sign in tokens 2
  • Sign ups 2
  • Svix app 2
  • User billing credits 2
  • User biometric credentials 2
  • User metadata 2
  • User password 2
  • User trusted devices 2
  • API key secret 1
  • Billing plans 1
  • Billing statement payment attempts 1
  • Instance auth config 1
  • Instance restrictions 1
  • JWKS 1
  • Oauth access tokens 1
  • Organization billing subscription 1
  • Organization logo 1
  • Organization membership metadata 1
  • Proxy checks 1
  • Session reverifications 1
  • Svix dashboard URL 1
  • Testing tokens 1
  • User backup codes 1
  • User billing subscription 1
  • User email address 1
  • User external accounts 1
  • User mfa 1
  • User oauth access tokens 1
  • User organization invitations 1
  • User organization memberships 1
  • User passkeys 1
  • User phone number 1
  • User profile image 1
  • User totp 1
  • User web3 wallets 1

Top actions

The Clerk API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 59 of Clerk's 59 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
clerk.users.listList all usersList all users.readidentity.user.list474 connectors
clerk.organizations.listGet a list of organizations for an instanceGet a list of organizations for an instance.readidentity.group.list262 connectors
clerk.organization_memberships.listGet a list of all members of an organizationGet a list of all members of an organization.readidentity.group_member.list103 connectors
clerk.users.createCreate a new userCreate a new user.writeidentity.user.create262 connectors
clerk.organizations.createCreate an organizationCreate an organization.writeidentity.group.create205 connectors
clerk.organization_roles.listGet a list of organization rolesGet a list of organization roles.readidentity.role.list184 connectors
clerk.users.deleteDelete a userDelete a user.destructiveidentity.user.delete253 connectors
clerk.oauth_applications.listGet a list of OAuth applications for an instanceGet a list of OAuth applications for an instance.readidentity.application.list37 connectors
clerk.organization_roles.createCreate an organization roleCreate an organization role.writeidentity.role.create105 connectors
clerk.organization_memberships.updateUpdate an organization membershipUpdate an organization membership.writeidentity.group_member.update34 connectors
clerk.oauth_applications.createCreate an OAuth applicationCreate an OAuth application.writeidentity.application.create27 connectors
clerk.invitations.createCreate an invitationCreate an invitation.writeidentity.invitation.create41 connectors

Try it

Prompts to paste into Claude.

Each one names the Clerk actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    Who has access in Clerk? List every user and their role.

    callsclerk.users.list

  2. Writewrite

    Create a new user in Clerk. Show me exactly what you will send before you save it.

    callsclerk.users.create

Governance for Clerk

Destructive actions wait for a yes.

60 Clerk actions are destructive. The first 10:

  • Delete a userclerk.users.delete
  • Delete an organizationclerk.organizations.delete
  • Remove a member from an organizationclerk.organization_memberships.delete
  • Delete an organization roleclerk.organization_roles.delete
  • Delete an OAuth applicationclerk.oauth_applications.delete
  • Delete an invitationclerk.invitations.delete
  • Delete an API Keyclerk.api_keys.delete
  • Revoke a sessionclerk.sessions.revoke
  • Revokes an invitationclerk.invitations.revoke
  • Delete a machineclerk.machines.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

doclerk.users.deleteconfirm_policy: human

Delete a user?

intent: the user asked me to delete a user

run suspended · waiting for a named person · key clerk-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "clerk-agent",  allowed_actions: ["clerk.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "clerk.users.delete", approver: "[email protected]" },    { match: "clerk.organizations.delete", approver: "[email protected]" },    { match: "clerk.organization_memberships.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to Clerk only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Clerk costs on actionlake.

Every Clerk action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Clerk refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 252 Clerk actions
  • 252actions pageeach page of a long list is one call
  • 73reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Clerk action.

252 actions by area: the id your agent calls, what it does, and its effect.

Users15
  • clerk.users.banBan a userdestructive
  • clerk.users.ban_manyBan multiple usersdestructive
  • clerk.users.countCount usersread
  • clerk.users.createCreate a new userwrite
  • clerk.users.deleteDelete a userdestructive
  • clerk.users.getRetrieve a userread
  • clerk.users.listList all usersread
  • clerk.users.lockLock a userwrite
  • clerk.users.remove_passwordRemove a user's passwordwrite
  • clerk.users.unbanUnban a userwrite
  • clerk.users.unban_manyUnban multiple userswrite
  • clerk.users.unlockUnlock a userwrite
  • clerk.users.updateUpdate a userwrite
  • clerk.users.verify_passwordVerify the password of a userread
  • clerk.users.verify_totpVerify a TOTP or backup code for a userread
API keys7
  • clerk.api_keys.createCreate an API Keywrite
  • clerk.api_keys.deleteDelete an API Keydestructive
  • clerk.api_keys.getGet an API Key by IDread
  • clerk.api_keys.listGet API Keysread
  • clerk.api_keys.revokeRevoke an API Keydestructive
  • clerk.api_keys.updateUpdate an API Keywrite
  • clerk.api_keys.verifyVerify an API Keyread
Oauth applications7
  • clerk.oauth_applications.createCreate an OAuth applicationwrite
  • clerk.oauth_applications.deleteDelete an OAuth applicationdestructive
  • clerk.oauth_applications.getRetrieve an OAuth application by IDread
  • clerk.oauth_applications.listGet a list of OAuth applications for an instanceread
  • clerk.oauth_applications.revoke_tokenRevoke an OAuth application tokendestructive
  • clerk.oauth_applications.rotate_secretRotate the client secret of the given OAuth applicationdestructive
  • clerk.oauth_applications.updateUpdate an OAuth applicationwrite
Organization invitations7
  • clerk.organization_invitations.createCreate and send an organization invitationwrite
  • clerk.organization_invitations.create_manyBulk create and send organization invitationswrite
  • clerk.organization_invitations.getRetrieve an organization invitation by IDread
  • clerk.organization_invitations.listGet a list of organization invitationsread
  • clerk.organization_invitations.list_allGet a list of organization invitations for the current instanceread
  • clerk.organization_invitations.list_pendingGet a list of pending organization invitationsread
  • clerk.organization_invitations.revokeRevoke a pending organization invitationdestructive
Directories6
  • clerk.directories.createCreate a directorywrite
  • clerk.directories.deleteDelete a directorydestructive
  • clerk.directories.getRetrieve a directoryread
  • clerk.directories.listList all directoriesread
  • clerk.directories.rotate_api_keyRotate a directory's API keydestructive
  • clerk.directories.updateUpdate a directorywrite
Email addresses6
  • clerk.email_addresses.attempt_verificationVerify a code sent to an email addresswrite
  • clerk.email_addresses.createCreate an email addresswrite
  • clerk.email_addresses.deleteDelete an email addressdestructive
  • clerk.email_addresses.getRetrieve an email addressread
  • clerk.email_addresses.prepare_verificationSend a verification code to an email addresswrite
  • clerk.email_addresses.updateUpdate an email addresswrite
Organization domains6
  • clerk.organization_domains.createCreate a new organization domain.write
  • clerk.organization_domains.deleteRemove a domain from an organization.destructive
  • clerk.organization_domains.listGet a list of all domains of an organization.read
  • clerk.organization_domains.list_allList all organization domainsread
  • clerk.organization_domains.updateUpdate an organization domain.write
  • clerk.organization_domains.verify_ownershipMark an organization domain's ownership as verifiedwrite
Phone numbers6
  • clerk.phone_numbers.attempt_verificationVerify a code sent to a phone numberwrite
  • clerk.phone_numbers.createCreate a phone numberwrite
  • clerk.phone_numbers.deleteDelete a phone numberdestructive
  • clerk.phone_numbers.getRetrieve a phone numberread
  • clerk.phone_numbers.prepare_verificationSend a verification code to a phone numberwrite
  • clerk.phone_numbers.updateUpdate a phone numberwrite
Scim directories6
  • clerk.scim_directories.createCreate a directorywrite
  • clerk.scim_directories.deleteDelete a directorydestructive
  • clerk.scim_directories.getRetrieve a directoryread
  • clerk.scim_directories.listList all directoriesread
  • clerk.scim_directories.rotate_api_keyRotate a directory's API keydestructive
  • clerk.scim_directories.updateUpdate a directorywrite
Templates6
  • clerk.templates.getRetrieve a templateread
  • clerk.templates.listList all templatesread
  • clerk.templates.previewPreview changes to a templateread
  • clerk.templates.revertRevert a templatewrite
  • clerk.templates.toggle_deliveryToggle the delivery by Clerk for a template of a given type and slugwrite
  • clerk.templates.upsertUpdate a template for a given type and slugwrite
Waitlist entries6
  • clerk.waitlist_entries.createCreate a waitlist entrywrite
  • clerk.waitlist_entries.create_manyCreate multiple waitlist entrieswrite
  • clerk.waitlist_entries.deleteDelete a pending waitlist entrydestructive
  • clerk.waitlist_entries.inviteInvite a waitlist entrywrite
  • clerk.waitlist_entries.listList all waitlist entriesread
  • clerk.waitlist_entries.rejectReject a waitlist entrywrite
Enterprise connections5
  • clerk.enterprise_connections.createCreate an enterprise connectionwrite
  • clerk.enterprise_connections.deleteDelete an enterprise connectiondestructive
  • clerk.enterprise_connections.getRetrieve an enterprise connectionread
  • clerk.enterprise_connections.listList enterprise connectionsread
  • clerk.enterprise_connections.updateUpdate an enterprise connectionwrite
Invitations5
  • clerk.invitations.createCreate an invitationwrite
  • clerk.invitations.create_manyCreate multiple invitationswrite
  • clerk.invitations.deleteDelete an invitationdestructive
  • clerk.invitations.listList all invitationsread
  • clerk.invitations.revokeRevokes an invitationdestructive
JWT templates5
  • clerk.jwt_templates.createCreate a JWT templatewrite
  • clerk.jwt_templates.deleteDelete a Templatedestructive
  • clerk.jwt_templates.getRetrieve a templateread
  • clerk.jwt_templates.listList all templatesread
  • clerk.jwt_templates.updateUpdate a JWT templatewrite
Machines5
  • clerk.machines.createCreate a machinewrite
  • clerk.machines.deleteDelete a machinedestructive
  • clerk.machines.getRetrieve a machineread
  • clerk.machines.listGet a list of machines for an instanceread
  • clerk.machines.updateUpdate a machinewrite
Organization memberships5
  • clerk.organization_memberships.createCreate a new organization membershipwrite
  • clerk.organization_memberships.deleteRemove a member from an organizationdestructive
  • clerk.organization_memberships.listGet a list of all members of an organizationread
  • clerk.organization_memberships.list_allGet a list of all organization memberships within an instance.read
  • clerk.organization_memberships.updateUpdate an organization membershipwrite
Organization permissions5
  • clerk.organization_permissions.createCreate a new organization permissionwrite
  • clerk.organization_permissions.deleteDelete an organization permissiondestructive
  • clerk.organization_permissions.getGet an organization permissionread
  • clerk.organization_permissions.listGet a list of all organization permissionsread
  • clerk.organization_permissions.updateUpdate an organization permissionwrite
Organization roles5
  • clerk.organization_roles.createCreate an organization rolewrite
  • clerk.organization_roles.deleteDelete an organization roledestructive
  • clerk.organization_roles.getRetrieve an organization roleread
  • clerk.organization_roles.listGet a list of organization rolesread
  • clerk.organization_roles.updateUpdate an organization rolewrite
Organizations5
  • clerk.organizations.createCreate an organizationwrite
  • clerk.organizations.deleteDelete an organizationdestructive
  • clerk.organizations.getRetrieve an organization by ID or slugread
  • clerk.organizations.listGet a list of organizations for an instanceread
  • clerk.organizations.updateUpdate an organizationwrite
Role sets5
  • clerk.role_sets.createCreate a role setwrite
  • clerk.role_sets.getRetrieve a role setread
  • clerk.role_sets.listGet a list of role setsread
  • clerk.role_sets.replaceReplace a role setwrite
  • clerk.role_sets.updateUpdate a role setwrite
Saml connections5
  • clerk.saml_connections.createCreate a SAML Connectionwrite
  • clerk.saml_connections.deleteDelete a SAML Connectiondestructive
  • clerk.saml_connections.getRetrieve a SAML Connection by IDread
  • clerk.saml_connections.listGet a list of SAML Connections for an instanceread
  • clerk.saml_connections.updateUpdate a SAML Connectionwrite
Sessions5
  • clerk.sessions.createCreate a new active sessionwrite
  • clerk.sessions.getRetrieve a sessionread
  • clerk.sessions.listList all sessionsread
  • clerk.sessions.refreshRefresh a sessionwrite
  • clerk.sessions.revokeRevoke a sessiondestructive
Billing subscription items4
  • clerk.billing_subscription_items.cancelCancel a subscription itemdestructive
  • clerk.billing_subscription_items.extend_free_trialExtend free trial for a subscription itemwrite
  • clerk.billing_subscription_items.listList all subscription itemsread
  • clerk.billing_subscription_items.transition_priceCreate a price transition for a subscription itemwrite
Directory group role mappings4
  • clerk.directory_group_role_mappings.createCreate a directory group role mappingdestructive
  • clerk.directory_group_role_mappings.deleteDelete a directory group role mappingdestructive
  • clerk.directory_group_role_mappings.listList directory group role mappingsread
  • clerk.directory_group_role_mappings.replaceReplace directory group role mappingswrite
Domains4
  • clerk.domains.createAdd a domainwrite
  • clerk.domains.deleteDelete a domaindestructive
  • clerk.domains.listList all instance domainsread
  • clerk.domains.updateUpdate a domainwrite
M2M tokens4
  • clerk.m2m_tokens.createCreate a M2M Tokenwrite
  • clerk.m2m_tokens.listGet M2M Tokensread
  • clerk.m2m_tokens.revokeRevoke a M2M Tokendestructive
  • clerk.m2m_tokens.verifyVerify a M2M Tokenread
Redirect urls4
  • clerk.redirect_urls.createCreate a redirect URLwrite
  • clerk.redirect_urls.deleteDelete a redirect URLdestructive
  • clerk.redirect_urls.getRetrieve a redirect URLread
  • clerk.redirect_urls.listList all redirect URLsread
Scim directory group role mappings4
  • clerk.scim_directory_group_role_mappings.createCreate a SCIM group role mappingdestructive
  • clerk.scim_directory_group_role_mappings.deleteDelete a SCIM group role mappingdestructive
  • clerk.scim_directory_group_role_mappings.listList SCIM group role mappingsread
  • clerk.scim_directory_group_role_mappings.replaceReplace SCIM group role mappingswrite
Allowlist identifiers3
  • clerk.allowlist_identifiers.createAdd identifier to the allow-listwrite
  • clerk.allowlist_identifiers.deleteDelete identifier from allow-listdestructive
  • clerk.allowlist_identifiers.listList all identifiers on the allow-listread
Blocklist identifiers3
  • clerk.blocklist_identifiers.createAdd identifier to the block-listwrite
  • clerk.blocklist_identifiers.deleteDelete identifier from block-listdestructive
  • clerk.blocklist_identifiers.listList all identifiers on the block-listread
Clients3
  • clerk.clients.getGet a clientread
  • clerk.clients.listList all clientsread
  • clerk.clients.verifyVerify a clientread
SSO bypass allowlist users3
  • clerk.sso_bypass_allowlist_users.createAdd a user to the SSO bypass allowlistwrite
  • clerk.sso_bypass_allowlist_users.deleteRemove a user from the SSO bypass allowlistdestructive
  • clerk.sso_bypass_allowlist_users.listList the SSO bypass allowlistread
Actor tokens2
  • clerk.actor_tokens.createCreate actor tokenwrite
  • clerk.actor_tokens.revokeRevoke actor tokendestructive
Admin portal link tokens2
  • clerk.admin_portal_link_tokens.createCreate an Admin Portal Link Tokenwrite
  • clerk.admin_portal_link_tokens.revokeRevoke an Admin Portal Link Tokendestructive
Agent tasks2
  • clerk.agent_tasks.createCreate agent taskwrite
  • clerk.agent_tasks.revokeRevoke agent taskdestructive
Billing prices2
  • clerk.billing_prices.createCreate a custom billing pricewrite
  • clerk.billing_prices.listList all billing pricesread
Billing statements2
  • clerk.billing_statements.getRetrieve a billing statementread
  • clerk.billing_statements.listList all billing statementsread
Billing subscription item discounts2
  • clerk.billing_subscription_item_discounts.createApply a discount to a subscription itemwrite
  • clerk.billing_subscription_item_discounts.deleteRemove a discount from a subscription itemdestructive
Enterprise connection test runs2
  • clerk.enterprise_connection_test_runs.createCreate an enterprise connection test runwrite
  • clerk.enterprise_connection_test_runs.listList enterprise connection test runsread
Instance2
  • clerk.instance.getFetch the current instanceread
  • clerk.instance.updateUpdate instance settingswrite
Instance communication2
  • clerk.instance_communication.getGet instance communication settingsread
  • clerk.instance_communication.updateUpdate instance communication settingswrite
Instance domain2
  • clerk.instance_domain.changeUpdate production instance domainwrite
  • clerk.instance_domain.update_betaUpdate production instance domainwrite
Instance oauth application settings2
  • clerk.instance_oauth_application_settings.getGet OAuth application settingsread
  • clerk.instance_oauth_application_settings.updateUpdate OAuth application settingswrite
Instance organization settings2
  • clerk.instance_organization_settings.getGet instance organization settingsread
  • clerk.instance_organization_settings.updateUpdate instance organization settingswrite
Instance protect2
  • clerk.instance_protect.getGet instance protect settingsread
  • clerk.instance_protect.updateUpdate instance protect settingswrite
Machine scopes2
  • clerk.machine_scopes.createCreate a machine scopewrite
  • clerk.machine_scopes.deleteDelete a machine scopedestructive
Machine secret key2
  • clerk.machine_secret_key.getRetrieve a machine secret keyread
  • clerk.machine_secret_key.rotateRotate a machine's secret keydestructive
Organization billing credits2
  • clerk.organization_billing_credits.adjustAdjust an organization's credit balancewrite
  • clerk.organization_billing_credits.getRetrieve an organization's credit balanceread
Organization metadata2
  • clerk.organization_metadata.mergeMerge and update metadata for an organizationwrite
  • clerk.organization_metadata.replaceReplace metadata for an organizationwrite
Organization role permissions2
  • clerk.organization_role_permissions.assignAssign a permission to an organization roledestructive
  • clerk.organization_role_permissions.removeRemove a permission from an organization roledestructive
Role set roles2
  • clerk.role_set_roles.addAdd roles to a role setdestructive
  • clerk.role_set_roles.replaceReplace a role in a role setwrite
Session tokens2
  • clerk.session_tokens.createCreate a session tokenwrite
  • clerk.session_tokens.create_from_templateCreate a session token from a JWT templatewrite
Sign in tokens2
  • clerk.sign_in_tokens.createCreate sign-in tokenwrite
  • clerk.sign_in_tokens.revokeRevoke the given sign-in tokendestructive
Sign ups2
  • clerk.sign_ups.getRetrieve a sign-up by IDread
  • clerk.sign_ups.updateUpdate a sign-upwrite
Svix app2
  • clerk.svix_app.createCreate a Svix appwrite
  • clerk.svix_app.deleteDelete a Svix appdestructive
User billing credits2
  • clerk.user_billing_credits.adjustAdjust a user's credit balancewrite
  • clerk.user_billing_credits.getRetrieve a user's credit balanceread
User biometric credentials2
  • clerk.user_biometric_credentials.listList a user's biometric credentialsread
  • clerk.user_biometric_credentials.revokeRevoke a user's biometric credentialdestructive
User metadata2
  • clerk.user_metadata.mergeMerge and update a user's metadatawrite
  • clerk.user_metadata.replaceReplace a user's metadatawrite
User password2
  • clerk.user_password.set_compromisedSet a user's password as compromisedwrite
  • clerk.user_password.unset_compromisedUnset a user's password as compromisedwrite
User trusted devices2
  • clerk.user_trusted_devices.listList a user's trusted devicesread
  • clerk.user_trusted_devices.revokeRevoke a user's trusted devicedestructive
API key secret1
  • clerk.api_key_secret.getGet an API Key Secretread
Billing plans1
  • clerk.billing_plans.listList all billing plansread
Billing statement payment attempts1
  • clerk.billing_statement_payment_attempts.listList payment attempts for a billing statementread
Instance auth config1
  • clerk.instance_auth_config.updateUpdate instance settingswrite
Instance restrictions1
  • clerk.instance_restrictions.updateUpdate instance restrictionswrite
JWKS1
  • clerk.jwks.getRetrieve the JSON Web Key Set of the instanceread
Oauth access tokens1
  • clerk.oauth_access_tokens.verifyVerify an OAuth Access Tokenread
Organization billing subscription1
  • clerk.organization_billing_subscription.getRetrieve an organization's billing subscriptionread
Organization logo1
  • clerk.organization_logo.deleteDelete the organization's logo.destructive
Organization membership metadata1
  • clerk.organization_membership_metadata.mergeMerge and update organization membership metadatawrite
Proxy checks1
  • clerk.proxy_checks.createVerify the proxy configuration for your domainwrite
Session reverifications1
  • clerk.session_reverifications.getRetrieve a reverificationread
Svix dashboard URL1
  • clerk.svix_dashboard_url.createCreate a Svix Dashboard URLwrite
Testing tokens1
  • clerk.testing_tokens.createRetrieve a new testing tokenwrite
User backup codes1
  • clerk.user_backup_codes.deleteDisable all user's Backup codesdestructive
User billing subscription1
  • clerk.user_billing_subscription.getRetrieve a user's billing subscriptionread
User email address1
  • clerk.user_email_address.replaceReplace a user's email addresswrite
User external accounts1
  • clerk.user_external_accounts.deleteDelete External Accountdestructive
User mfa1
  • clerk.user_mfa.disableDisable a user's MFA methodsdestructive
User oauth access tokens1
  • clerk.user_oauth_access_tokens.listRetrieve the OAuth access token of a userread
User organization invitations1
  • clerk.user_organization_invitations.listRetrieve all invitations for a userread
User organization memberships1
  • clerk.user_organization_memberships.listRetrieve all memberships for a userread
User passkeys1
  • clerk.user_passkeys.deleteDelete a user passkeydestructive
User phone number1
  • clerk.user_phone_number.replaceReplace a user's phone numberwrite
User profile image1
  • clerk.user_profile_image.deleteDelete user profile imagedestructive
User totp1
  • clerk.user_totp.deleteDelete all the user's TOTPsdestructive
User web3 wallets1
  • clerk.user_web3_wallets.deleteDelete a user web3 walletdestructive

Questions

The Clerk MCP server, answered.

Is there a Clerk MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 252 Clerk actions across users, API keys, oauth applications and organization invitations, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Clerk.

What do I need to connect Clerk?

Clerk secret key. The free call account { op: "connections.requirements", service: "clerk" } lists exactly what to paste.

Can an AI agent delete or change things in Clerk?

Only if its key allows it, and only with an explicit confirmation. 60 Clerk actions are destructive, including delete a user, delete an organization and remove a member from an organization. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Clerk API limit?

actionlake paces every call to the limits in the Clerk service file: 1,000 calls per 10 seconds per connection. Repeated reads are answered from cache (73 Clerk actions can be), which never reaches Clerk.

What does a Clerk action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (252 Clerk actions page). Cache hits, searches, dry runs and calls Clerk refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Clerk API does it cover?

The Clerk Backend API v1, Clerk-API-Version 2026-08-20 (OpenAPI 3.0.3) at api.clerk.com/v1. It is built from Clerk's documentation as read on 23 October 2026. 252 actions in 87 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Clerk data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Clerk credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like Clerk

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by Clerk; the name is the vendor's own. Counts are from the Clerk service file, version 1.0.0.

Give your agent Clerk today.

Connect Clerk freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.