---
title: "Clerk MCP server for AI agents - actionlake"
description: "Give Claude 252 Clerk actions through one MCP server: users, API keys, oauth applications. Your agent never holds the credential. 100,000 calls a month free."
canonical: https://actionlake.com/connectors/clerk
updated: 2026-10-23
---

Connectors · Identity & security

# Clerk MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Clerk and the rest of your systems. It gives your agent 252 Clerk actions (87 reads, 105 writes and 60 that wait for a confirmation) and holds the Clerk credential itself, so the agent never does. It paces Clerk's limits and records every call.

[Connect Clerk free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

`claude mcp add --transport http actionlake https://connect.actionlake.com/mcp`

the first call

```
do {
  action: "clerk.users.list",
  intent: "check which Clerk account is connected"
}
# List all users · read · 1 upstream call
```

- 252 actions in one signed file
- 87 read look, never change
- 105 write create and update
- 60 wait for a yes destructive, confirmed first

Set up

## Connect Clerk in three steps.

1. 01
   ### Add actionlake to Claude.
   Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
   `https://connect.actionlake.com/mcp`
2. 02
   ### Connect Clerk.
   Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
   - `secret_key` Clerk secret key
   ```
   account { op: "connections.requirements", service: "clerk" }
   # free: exactly what to paste, and what is found for you
   ```
3. 03
   ### Make the first call. Check before a write.
   Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free.
   ```
   do    { action: "clerk.users.list" }
   # list all users · read · 1 upstream call
   check { action: "clerk.users.create", input: { … } }
   # free: inputs, permissions, cost and confirmations, nothing sent
   ```

Clerk at a glance

**Sign-in**

Bearer token. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.

**You provide**

`secret_key`

**Limits we pace to**

1,000 calls per 10 seconds, per connection

**API covered**

Clerk Backend API v1, Clerk-API-Version 2026-08-20 (OpenAPI 3.0.3)`api.clerk.com/v1`

**Built from**

Clerk's documentation, read 23 October 2026[OpenAPI spec (GitHub)](https://raw.githubusercontent.com/clerk/openapi-specs/main/bapi/2026-08-20.yml) [clerk.com](https://clerk.com/docs/reference/backend-api)

**Service file**

Version 1.0.0, signed (Ed25519)

**Cached reads**

73 of 87 reads, for up to 5 minutes; a write clears what it affects

**Shared entities**

5, so ask can line Clerk up with your other systems

**Data**

Processed and stored in Sydney, Australia. No US region yet

Capabilities

## What an AI agent can do in Clerk.

252 actions in 87 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

- **87** read look, never change
- **105** write create and update
- **60** destructive wait for a confirmation

1. ### Users
   15
   5 read · 7 write · 3 destructive
   List all users · Create a new user · Retrieve a user · Update a user
2. ### API keys
   7
   3 read · 2 write · 2 destructive
   Create an API Key · Get API Keys · Get an API Key by ID · Delete an API Key
3. ### Oauth applications
   7
   2 read · 2 write · 3 destructive
   Get a list of OAuth applications for an instance · Create an OAuth application · Retrieve an OAuth application by ID · Update an OAuth application
4. ### Organization invitations
   7
   4 read · 2 write · 1 destructive
   Create and send an organization invitation · Bulk create and send organization invitations · Get a list of organization invitations · Get a list of organization invitations for the current instance
5. ### Directories
   6
   2 read · 2 write · 2 destructive
   Create a directory · List all directories · Retrieve a directory · Rotate a directory's API key
6. ### Email addresses
   6
   1 read · 4 write · 1 destructive
   Create an email address · Send a verification code to an email address · Verify a code sent to an email address · Retrieve an email address
7. ### Organization domains
   6
   2 read · 3 write · 1 destructive
   Create a new organization domain. · Get a list of all domains of an organization. · List all organization domains · Update an organization domain.
8. ### Phone numbers
   6
   1 read · 4 write · 1 destructive
   Create a phone number · Send a verification code to a phone number · Verify a code sent to a phone number · Retrieve a phone number

**79 more areas · 192 actions**

- Scim directories **6**
- Templates **6**
- Waitlist entries **6**
- Enterprise connections **5**
- Invitations **5**
- JWT templates **5**
- Machines **5**
- Organization memberships **5**
- Organization permissions **5**
- Organization roles **5**
- Organizations **5**
- Role sets **5**
- Saml connections **5**
- Sessions **5**
- Billing subscription items **4**
- Directory group role mappings **4**
- Domains **4**
- M2M tokens **4**
- Redirect urls **4**
- Scim directory group role mappings **4**
- Allowlist identifiers **3**
- Blocklist identifiers **3**
- Clients **3**
- SSO bypass allowlist users **3**
- Actor tokens **2**
- Admin portal link tokens **2**
- Agent tasks **2**
- Billing prices **2**
- Billing statements **2**
- Billing subscription item discounts **2**
- Enterprise connection test runs **2**
- Instance **2**
- Instance communication **2**
- Instance domain **2**
- Instance oauth application settings **2**
- Instance organization settings **2**
- Instance protect **2**
- Machine scopes **2**
- Machine secret key **2**
- Organization billing credits **2**
- Organization metadata **2**
- Organization role permissions **2**
- Role set roles **2**
- Session tokens **2**
- Sign in tokens **2**
- Sign ups **2**
- Svix app **2**
- User billing credits **2**
- User biometric credentials **2**
- User metadata **2**
- User password **2**
- User trusted devices **2**
- API key secret **1**
- Billing plans **1**
- Billing statement payment attempts **1**
- Instance auth config **1**
- Instance restrictions **1**
- JWKS **1**
- Oauth access tokens **1**
- Organization billing subscription **1**
- Organization logo **1**
- Organization membership metadata **1**
- Proxy checks **1**
- Session reverifications **1**
- Svix dashboard URL **1**
- Testing tokens **1**
- User backup codes **1**
- User billing subscription **1**
- User email address **1**
- User external accounts **1**
- User mfa **1**
- User oauth access tokens **1**
- User organization invitations **1**
- User organization memberships **1**
- User passkeys **1**
- User phone number **1**
- User profile image **1**
- User totp **1**
- User web3 wallets **1**

Top actions

## The Clerk API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 59 of Clerk's 59 action names are shared with at least one other connector, so an agent learns them once.

| Action | What it does | Effect | Same name in |
| --- | --- | --- | --- |
| `clerk.users.list` List all users | List all users. | read | `identity.user.list` 474 connectors |
| `clerk.organizations.list` Get a list of organizations for an instance | Get a list of organizations for an instance. | read | `identity.group.list` 262 connectors |
| `clerk.organization_memberships.list` Get a list of all members of an organization | Get a list of all members of an organization. | read | `identity.group_member.list` 103 connectors |
| `clerk.users.create` Create a new user | Create a new user. | write | `identity.user.create` 262 connectors |
| `clerk.organizations.create` Create an organization | Create an organization. | write | `identity.group.create` 205 connectors |
| `clerk.organization_roles.list` Get a list of organization roles | Get a list of organization roles. | read | `identity.role.list` 184 connectors |
| `clerk.users.delete` Delete a user | Delete a user. | destructive | `identity.user.delete` 253 connectors |
| `clerk.oauth_applications.list` Get a list of OAuth applications for an instance | Get a list of OAuth applications for an instance. | read | `identity.application.list` 37 connectors |
| `clerk.organization_roles.create` Create an organization role | Create an organization role. | write | `identity.role.create` 105 connectors |
| `clerk.organization_memberships.update` Update an organization membership | Update an organization membership. | write | `identity.group_member.update` 34 connectors |
| `clerk.oauth_applications.create` Create an OAuth application | Create an OAuth application. | write | `identity.application.create` 27 connectors |
| `clerk.invitations.create` Create an invitation | Create an invitation. | write | `identity.invitation.create` 41 connectors |

Try it

## Prompts to paste into Claude.

Each one names the Clerk actions it will call, so you know what it reads and what it changes before you send it.

1. Read read
   Who has access in Clerk? List every user and their role.
   calls `clerk.users.list`
2. Write write
   Create a new user in Clerk. Show me exactly what you will send before you save it.
   calls `clerk.users.create`

Governance for Clerk

## Destructive actions wait for a yes.

60 Clerk actions are destructive. The first 10:

- Delete a user `clerk.users.delete`
- Delete an organization `clerk.organizations.delete`
- Remove a member from an organization `clerk.organization_memberships.delete`
- Delete an organization role `clerk.organization_roles.delete`
- Delete an OAuth application `clerk.oauth_applications.delete`
- Delete an invitation `clerk.invitations.delete`
- Delete an API Key `clerk.api_keys.delete`
- Revoke a session `clerk.sessions.revoke`
- Revokes an invitation `clerk.invitations.revoke`
- Delete a machine `clerk.machines.delete`

A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

do clerk.users.delete confirm_policy: **human**

Delete a user?

**intent:** the user asked me to delete a user

run suspended · waiting for a named person · key _clerk-agent_ cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

```
account {
  op: "keys.create", name: "clerk-agent",
  allowed_actions: ["clerk.*"], cap_calls: 2000,
  confirm_policy: "human_for_writes",
  approval_rules: [
    { match: "clerk.users.delete", approver: "lead@example.com" },
    { match: "clerk.organizations.delete", approver: "lead@example.com" },
    { match: "clerk.organization_memberships.delete", approver: "lead@example.com" }
  ]
}
```

Illustrative. Scoped to Clerk only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

## What Clerk costs on actionlake.

Every Clerk action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Clerk refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

- 1 upstream call per action all 252 Clerk actions
- 252 actions page each page of a long list is one call
- 73 reads can be cached a cache hit costs nothing
- 100,000 calls a month, free paid plans from US$49 a month for 250,000

[See pricing](https://actionlake.com/pricing)

Action index

## Every Clerk action.

252 actions by area: the id your agent calls, what it does, and its effect.

**Users 15**

- `clerk.users.ban` Ban a user destructive
- `clerk.users.ban_many` Ban multiple users destructive
- `clerk.users.count` Count users read
- `clerk.users.create` Create a new user write
- `clerk.users.delete` Delete a user destructive
- `clerk.users.get` Retrieve a user read
- `clerk.users.list` List all users read
- `clerk.users.lock` Lock a user write
- `clerk.users.remove_password` Remove a user's password write
- `clerk.users.unban` Unban a user write
- `clerk.users.unban_many` Unban multiple users write
- `clerk.users.unlock` Unlock a user write
- `clerk.users.update` Update a user write
- `clerk.users.verify_password` Verify the password of a user read
- `clerk.users.verify_totp` Verify a TOTP or backup code for a user read

**API keys 7**

- `clerk.api_keys.create` Create an API Key write
- `clerk.api_keys.delete` Delete an API Key destructive
- `clerk.api_keys.get` Get an API Key by ID read
- `clerk.api_keys.list` Get API Keys read
- `clerk.api_keys.revoke` Revoke an API Key destructive
- `clerk.api_keys.update` Update an API Key write
- `clerk.api_keys.verify` Verify an API Key read

**Oauth applications 7**

- `clerk.oauth_applications.create` Create an OAuth application write
- `clerk.oauth_applications.delete` Delete an OAuth application destructive
- `clerk.oauth_applications.get` Retrieve an OAuth application by ID read
- `clerk.oauth_applications.list` Get a list of OAuth applications for an instance read
- `clerk.oauth_applications.revoke_token` Revoke an OAuth application token destructive
- `clerk.oauth_applications.rotate_secret` Rotate the client secret of the given OAuth application destructive
- `clerk.oauth_applications.update` Update an OAuth application write

**Organization invitations 7**

- `clerk.organization_invitations.create` Create and send an organization invitation write
- `clerk.organization_invitations.create_many` Bulk create and send organization invitations write
- `clerk.organization_invitations.get` Retrieve an organization invitation by ID read
- `clerk.organization_invitations.list` Get a list of organization invitations read
- `clerk.organization_invitations.list_all` Get a list of organization invitations for the current instance read
- `clerk.organization_invitations.list_pending` Get a list of pending organization invitations read
- `clerk.organization_invitations.revoke` Revoke a pending organization invitation destructive

**Directories 6**

- `clerk.directories.create` Create a directory write
- `clerk.directories.delete` Delete a directory destructive
- `clerk.directories.get` Retrieve a directory read
- `clerk.directories.list` List all directories read
- `clerk.directories.rotate_api_key` Rotate a directory's API key destructive
- `clerk.directories.update` Update a directory write

**Email addresses 6**

- `clerk.email_addresses.attempt_verification` Verify a code sent to an email address write
- `clerk.email_addresses.create` Create an email address write
- `clerk.email_addresses.delete` Delete an email address destructive
- `clerk.email_addresses.get` Retrieve an email address read
- `clerk.email_addresses.prepare_verification` Send a verification code to an email address write
- `clerk.email_addresses.update` Update an email address write

**Organization domains 6**

- `clerk.organization_domains.create` Create a new organization domain. write
- `clerk.organization_domains.delete` Remove a domain from an organization. destructive
- `clerk.organization_domains.list` Get a list of all domains of an organization. read
- `clerk.organization_domains.list_all` List all organization domains read
- `clerk.organization_domains.update` Update an organization domain. write
- `clerk.organization_domains.verify_ownership` Mark an organization domain's ownership as verified write

**Phone numbers 6**

- `clerk.phone_numbers.attempt_verification` Verify a code sent to a phone number write
- `clerk.phone_numbers.create` Create a phone number write
- `clerk.phone_numbers.delete` Delete a phone number destructive
- `clerk.phone_numbers.get` Retrieve a phone number read
- `clerk.phone_numbers.prepare_verification` Send a verification code to a phone number write
- `clerk.phone_numbers.update` Update a phone number write

**Scim directories 6**

- `clerk.scim_directories.create` Create a directory write
- `clerk.scim_directories.delete` Delete a directory destructive
- `clerk.scim_directories.get` Retrieve a directory read
- `clerk.scim_directories.list` List all directories read
- `clerk.scim_directories.rotate_api_key` Rotate a directory's API key destructive
- `clerk.scim_directories.update` Update a directory write

**Templates 6**

- `clerk.templates.get` Retrieve a template read
- `clerk.templates.list` List all templates read
- `clerk.templates.preview` Preview changes to a template read
- `clerk.templates.revert` Revert a template write
- `clerk.templates.toggle_delivery` Toggle the delivery by Clerk for a template of a given type and slug write
- `clerk.templates.upsert` Update a template for a given type and slug write

**Waitlist entries 6**

- `clerk.waitlist_entries.create` Create a waitlist entry write
- `clerk.waitlist_entries.create_many` Create multiple waitlist entries write
- `clerk.waitlist_entries.delete` Delete a pending waitlist entry destructive
- `clerk.waitlist_entries.invite` Invite a waitlist entry write
- `clerk.waitlist_entries.list` List all waitlist entries read
- `clerk.waitlist_entries.reject` Reject a waitlist entry write

**Enterprise connections 5**

- `clerk.enterprise_connections.create` Create an enterprise connection write
- `clerk.enterprise_connections.delete` Delete an enterprise connection destructive
- `clerk.enterprise_connections.get` Retrieve an enterprise connection read
- `clerk.enterprise_connections.list` List enterprise connections read
- `clerk.enterprise_connections.update` Update an enterprise connection write

**Invitations 5**

- `clerk.invitations.create` Create an invitation write
- `clerk.invitations.create_many` Create multiple invitations write
- `clerk.invitations.delete` Delete an invitation destructive
- `clerk.invitations.list` List all invitations read
- `clerk.invitations.revoke` Revokes an invitation destructive

**JWT templates 5**

- `clerk.jwt_templates.create` Create a JWT template write
- `clerk.jwt_templates.delete` Delete a Template destructive
- `clerk.jwt_templates.get` Retrieve a template read
- `clerk.jwt_templates.list` List all templates read
- `clerk.jwt_templates.update` Update a JWT template write

**Machines 5**

- `clerk.machines.create` Create a machine write
- `clerk.machines.delete` Delete a machine destructive
- `clerk.machines.get` Retrieve a machine read
- `clerk.machines.list` Get a list of machines for an instance read
- `clerk.machines.update` Update a machine write

**Organization memberships 5**

- `clerk.organization_memberships.create` Create a new organization membership write
- `clerk.organization_memberships.delete` Remove a member from an organization destructive
- `clerk.organization_memberships.list` Get a list of all members of an organization read
- `clerk.organization_memberships.list_all` Get a list of all organization memberships within an instance. read
- `clerk.organization_memberships.update` Update an organization membership write

**Organization permissions 5**

- `clerk.organization_permissions.create` Create a new organization permission write
- `clerk.organization_permissions.delete` Delete an organization permission destructive
- `clerk.organization_permissions.get` Get an organization permission read
- `clerk.organization_permissions.list` Get a list of all organization permissions read
- `clerk.organization_permissions.update` Update an organization permission write

**Organization roles 5**

- `clerk.organization_roles.create` Create an organization role write
- `clerk.organization_roles.delete` Delete an organization role destructive
- `clerk.organization_roles.get` Retrieve an organization role read
- `clerk.organization_roles.list` Get a list of organization roles read
- `clerk.organization_roles.update` Update an organization role write

**Organizations 5**

- `clerk.organizations.create` Create an organization write
- `clerk.organizations.delete` Delete an organization destructive
- `clerk.organizations.get` Retrieve an organization by ID or slug read
- `clerk.organizations.list` Get a list of organizations for an instance read
- `clerk.organizations.update` Update an organization write

**Role sets 5**

- `clerk.role_sets.create` Create a role set write
- `clerk.role_sets.get` Retrieve a role set read
- `clerk.role_sets.list` Get a list of role sets read
- `clerk.role_sets.replace` Replace a role set write
- `clerk.role_sets.update` Update a role set write

**Saml connections 5**

- `clerk.saml_connections.create` Create a SAML Connection write
- `clerk.saml_connections.delete` Delete a SAML Connection destructive
- `clerk.saml_connections.get` Retrieve a SAML Connection by ID read
- `clerk.saml_connections.list` Get a list of SAML Connections for an instance read
- `clerk.saml_connections.update` Update a SAML Connection write

**Sessions 5**

- `clerk.sessions.create` Create a new active session write
- `clerk.sessions.get` Retrieve a session read
- `clerk.sessions.list` List all sessions read
- `clerk.sessions.refresh` Refresh a session write
- `clerk.sessions.revoke` Revoke a session destructive

**Billing subscription items 4**

- `clerk.billing_subscription_items.cancel` Cancel a subscription item destructive
- `clerk.billing_subscription_items.extend_free_trial` Extend free trial for a subscription item write
- `clerk.billing_subscription_items.list` List all subscription items read
- `clerk.billing_subscription_items.transition_price` Create a price transition for a subscription item write

**Directory group role mappings 4**

- `clerk.directory_group_role_mappings.create` Create a directory group role mapping destructive
- `clerk.directory_group_role_mappings.delete` Delete a directory group role mapping destructive
- `clerk.directory_group_role_mappings.list` List directory group role mappings read
- `clerk.directory_group_role_mappings.replace` Replace directory group role mappings write

**Domains 4**

- `clerk.domains.create` Add a domain write
- `clerk.domains.delete` Delete a domain destructive
- `clerk.domains.list` List all instance domains read
- `clerk.domains.update` Update a domain write

**M2M tokens 4**

- `clerk.m2m_tokens.create` Create a M2M Token write
- `clerk.m2m_tokens.list` Get M2M Tokens read
- `clerk.m2m_tokens.revoke` Revoke a M2M Token destructive
- `clerk.m2m_tokens.verify` Verify a M2M Token read

**Redirect urls 4**

- `clerk.redirect_urls.create` Create a redirect URL write
- `clerk.redirect_urls.delete` Delete a redirect URL destructive
- `clerk.redirect_urls.get` Retrieve a redirect URL read
- `clerk.redirect_urls.list` List all redirect URLs read

**Scim directory group role mappings 4**

- `clerk.scim_directory_group_role_mappings.create` Create a SCIM group role mapping destructive
- `clerk.scim_directory_group_role_mappings.delete` Delete a SCIM group role mapping destructive
- `clerk.scim_directory_group_role_mappings.list` List SCIM group role mappings read
- `clerk.scim_directory_group_role_mappings.replace` Replace SCIM group role mappings write

**Allowlist identifiers 3**

- `clerk.allowlist_identifiers.create` Add identifier to the allow-list write
- `clerk.allowlist_identifiers.delete` Delete identifier from allow-list destructive
- `clerk.allowlist_identifiers.list` List all identifiers on the allow-list read

**Blocklist identifiers 3**

- `clerk.blocklist_identifiers.create` Add identifier to the block-list write
- `clerk.blocklist_identifiers.delete` Delete identifier from block-list destructive
- `clerk.blocklist_identifiers.list` List all identifiers on the block-list read

**Clients 3**

- `clerk.clients.get` Get a client read
- `clerk.clients.list` List all clients read
- `clerk.clients.verify` Verify a client read

**SSO bypass allowlist users 3**

- `clerk.sso_bypass_allowlist_users.create` Add a user to the SSO bypass allowlist write
- `clerk.sso_bypass_allowlist_users.delete` Remove a user from the SSO bypass allowlist destructive
- `clerk.sso_bypass_allowlist_users.list` List the SSO bypass allowlist read

**Actor tokens 2**

- `clerk.actor_tokens.create` Create actor token write
- `clerk.actor_tokens.revoke` Revoke actor token destructive

**Admin portal link tokens 2**

- `clerk.admin_portal_link_tokens.create` Create an Admin Portal Link Token write
- `clerk.admin_portal_link_tokens.revoke` Revoke an Admin Portal Link Token destructive

**Agent tasks 2**

- `clerk.agent_tasks.create` Create agent task write
- `clerk.agent_tasks.revoke` Revoke agent task destructive

**Billing prices 2**

- `clerk.billing_prices.create` Create a custom billing price write
- `clerk.billing_prices.list` List all billing prices read

**Billing statements 2**

- `clerk.billing_statements.get` Retrieve a billing statement read
- `clerk.billing_statements.list` List all billing statements read

**Billing subscription item discounts 2**

- `clerk.billing_subscription_item_discounts.create` Apply a discount to a subscription item write
- `clerk.billing_subscription_item_discounts.delete` Remove a discount from a subscription item destructive

**Enterprise connection test runs 2**

- `clerk.enterprise_connection_test_runs.create` Create an enterprise connection test run write
- `clerk.enterprise_connection_test_runs.list` List enterprise connection test runs read

**Instance 2**

- `clerk.instance.get` Fetch the current instance read
- `clerk.instance.update` Update instance settings write

**Instance communication 2**

- `clerk.instance_communication.get` Get instance communication settings read
- `clerk.instance_communication.update` Update instance communication settings write

**Instance domain 2**

- `clerk.instance_domain.change` Update production instance domain write
- `clerk.instance_domain.update_beta` Update production instance domain write

**Instance oauth application settings 2**

- `clerk.instance_oauth_application_settings.get` Get OAuth application settings read
- `clerk.instance_oauth_application_settings.update` Update OAuth application settings write

**Instance organization settings 2**

- `clerk.instance_organization_settings.get` Get instance organization settings read
- `clerk.instance_organization_settings.update` Update instance organization settings write

**Instance protect 2**

- `clerk.instance_protect.get` Get instance protect settings read
- `clerk.instance_protect.update` Update instance protect settings write

**Machine scopes 2**

- `clerk.machine_scopes.create` Create a machine scope write
- `clerk.machine_scopes.delete` Delete a machine scope destructive

**Machine secret key 2**

- `clerk.machine_secret_key.get` Retrieve a machine secret key read
- `clerk.machine_secret_key.rotate` Rotate a machine's secret key destructive

**Organization billing credits 2**

- `clerk.organization_billing_credits.adjust` Adjust an organization's credit balance write
- `clerk.organization_billing_credits.get` Retrieve an organization's credit balance read

**Organization metadata 2**

- `clerk.organization_metadata.merge` Merge and update metadata for an organization write
- `clerk.organization_metadata.replace` Replace metadata for an organization write

**Organization role permissions 2**

- `clerk.organization_role_permissions.assign` Assign a permission to an organization role destructive
- `clerk.organization_role_permissions.remove` Remove a permission from an organization role destructive

**Role set roles 2**

- `clerk.role_set_roles.add` Add roles to a role set destructive
- `clerk.role_set_roles.replace` Replace a role in a role set write

**Session tokens 2**

- `clerk.session_tokens.create` Create a session token write
- `clerk.session_tokens.create_from_template` Create a session token from a JWT template write

**Sign in tokens 2**

- `clerk.sign_in_tokens.create` Create sign-in token write
- `clerk.sign_in_tokens.revoke` Revoke the given sign-in token destructive

**Sign ups 2**

- `clerk.sign_ups.get` Retrieve a sign-up by ID read
- `clerk.sign_ups.update` Update a sign-up write

**Svix app 2**

- `clerk.svix_app.create` Create a Svix app write
- `clerk.svix_app.delete` Delete a Svix app destructive

**User billing credits 2**

- `clerk.user_billing_credits.adjust` Adjust a user's credit balance write
- `clerk.user_billing_credits.get` Retrieve a user's credit balance read

**User biometric credentials 2**

- `clerk.user_biometric_credentials.list` List a user's biometric credentials read
- `clerk.user_biometric_credentials.revoke` Revoke a user's biometric credential destructive

**User metadata 2**

- `clerk.user_metadata.merge` Merge and update a user's metadata write
- `clerk.user_metadata.replace` Replace a user's metadata write

**User password 2**

- `clerk.user_password.set_compromised` Set a user's password as compromised write
- `clerk.user_password.unset_compromised` Unset a user's password as compromised write

**User trusted devices 2**

- `clerk.user_trusted_devices.list` List a user's trusted devices read
- `clerk.user_trusted_devices.revoke` Revoke a user's trusted device destructive

**API key secret 1**

- `clerk.api_key_secret.get` Get an API Key Secret read

**Billing plans 1**

- `clerk.billing_plans.list` List all billing plans read

**Billing statement payment attempts 1**

- `clerk.billing_statement_payment_attempts.list` List payment attempts for a billing statement read

**Instance auth config 1**

- `clerk.instance_auth_config.update` Update instance settings write

**Instance restrictions 1**

- `clerk.instance_restrictions.update` Update instance restrictions write

**JWKS 1**

- `clerk.jwks.get` Retrieve the JSON Web Key Set of the instance read

**Oauth access tokens 1**

- `clerk.oauth_access_tokens.verify` Verify an OAuth Access Token read

**Organization billing subscription 1**

- `clerk.organization_billing_subscription.get` Retrieve an organization's billing subscription read

**Organization logo 1**

- `clerk.organization_logo.delete` Delete the organization's logo. destructive

**Organization membership metadata 1**

- `clerk.organization_membership_metadata.merge` Merge and update organization membership metadata write

**Proxy checks 1**

- `clerk.proxy_checks.create` Verify the proxy configuration for your domain write

**Session reverifications 1**

- `clerk.session_reverifications.get` Retrieve a reverification read

**Svix dashboard URL 1**

- `clerk.svix_dashboard_url.create` Create a Svix Dashboard URL write

**Testing tokens 1**

- `clerk.testing_tokens.create` Retrieve a new testing token write

**User backup codes 1**

- `clerk.user_backup_codes.delete` Disable all user's Backup codes destructive

**User billing subscription 1**

- `clerk.user_billing_subscription.get` Retrieve a user's billing subscription read

**User email address 1**

- `clerk.user_email_address.replace` Replace a user's email address write

**User external accounts 1**

- `clerk.user_external_accounts.delete` Delete External Account destructive

**User mfa 1**

- `clerk.user_mfa.disable` Disable a user's MFA methods destructive

**User oauth access tokens 1**

- `clerk.user_oauth_access_tokens.list` Retrieve the OAuth access token of a user read

**User organization invitations 1**

- `clerk.user_organization_invitations.list` Retrieve all invitations for a user read

**User organization memberships 1**

- `clerk.user_organization_memberships.list` Retrieve all memberships for a user read

**User passkeys 1**

- `clerk.user_passkeys.delete` Delete a user passkey destructive

**User phone number 1**

- `clerk.user_phone_number.replace` Replace a user's phone number write

**User profile image 1**

- `clerk.user_profile_image.delete` Delete user profile image destructive

**User totp 1**

- `clerk.user_totp.delete` Delete all the user's TOTPs destructive

**User web3 wallets 1**

- `clerk.user_web3_wallets.delete` Delete a user web3 wallet destructive

Questions

## The Clerk MCP server, answered.

**Is there a Clerk MCP server for Claude?**

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 252 Clerk actions across users, API keys, oauth applications and organization invitations, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Clerk.

**What do I need to connect Clerk?**

Clerk secret key. The free call account { op: "connections.requirements", service: "clerk" } lists exactly what to paste.

**Can an AI agent delete or change things in Clerk?**

Only if its key allows it, and only with an explicit confirmation. 60 Clerk actions are destructive, including delete a user, delete an organization and remove a member from an organization. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

**Will an AI agent use up my Clerk API limit?**

actionlake paces every call to the limits in the Clerk service file: 1,000 calls per 10 seconds per connection. Repeated reads are answered from cache (73 Clerk actions can be), which never reaches Clerk.

**What does a Clerk action cost?**

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (252 Clerk actions page). Cache hits, searches, dry runs and calls Clerk refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

**Which Clerk API does it cover?**

The Clerk Backend API v1, Clerk-API-Version 2026-08-20 (OpenAPI 3.0.3) at api.clerk.com/v1. It is built from Clerk's documentation as read on 23 October 2026. 252 actions in 87 areas, each one in the signed service file (version 1.0.0).

**Does actionlake keep my Clerk data, and where?**

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Clerk credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

**Which AI clients can use it?**

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

## More connectors like Clerk

Shares the most action names with

- [PingOne Platform API 35](https://actionlake.com/connectors/pingone-platform-api)
- [Auth0 Management API 31](https://actionlake.com/connectors/auth0-management-api)
- [WorkOS 30](https://actionlake.com/connectors/workos)
- [Keycloak Admin REST API 29](https://actionlake.com/connectors/keycloak-admin-rest-api)
- [FusionAuth 28](https://actionlake.com/connectors/fusionauth)
- [Doppler 20](https://actionlake.com/connectors/doppler)

Joins with, on shared entities

- [Delinea Secret Server 4](https://actionlake.com/connectors/delinea-secret-server)
- [authentik 4](https://actionlake.com/connectors/authentik)
- [Canvas LMS 4](https://actionlake.com/connectors/canvas-lms)
- [D2L Brightspace 4](https://actionlake.com/connectors/d2l-brightspace)
- [Cal.com 4](https://actionlake.com/connectors/cal-com)
- [Material Security 4](https://actionlake.com/connectors/material-security)

Browse

- [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security)
- [All connectors](https://actionlake.com/connectors)
- [How actionlake compares](https://actionlake.com/compare)

actionlake is independent. It is not made or endorsed by Clerk; the name is the vendor's own. Counts are from the Clerk service file, version 1.0.0.

## Give your agent Clerk today.

[Connect Clerk free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing)

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

---

Source: https://actionlake.com/connectors/clerk
More: https://actionlake.com/llms.txt