Connectors · Identity & security
FusionAuth MCP server for AI agents.
actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to FusionAuth and the rest of your systems. It gives your agent 337 FusionAuth actions (122 reads, 174 writes and 41 that wait for a confirmation) and holds the FusionAuth credential itself, so the agent never does. It paces FusionAuth's limits and records every call.
100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.
claude mcp add --transport http actionlake https://connect.actionlake.com/mcpdo { action: "fusionauth.groups.list", intent: "check which FusionAuth account is connected"}# List — groups · read · 1 upstream call- 337actionsin one signed file
- 122readlook, never change
- 174writecreate and update
- 41wait for a yesdestructive, confirmed first
Set up
Connect FusionAuth in three steps.
- 01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp - 02
Connect FusionAuth.
API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
api_keyFusionAuth API key (Settings > API Keys)hostWhere your FusionAuth lives: your host
account { op: "connections.requirements", service: "fusionauth" } # free: exactly what to paste, and what is found for you - 03
Make the first call. Check before a write.
Ask in plain words; Claude picks the action. Before anything changes,
checkvalidates the call and prices it, for free.do { action: "fusionauth.groups.list" }# list — groups · read · 1 upstream callcheck { action: "fusionauth.users.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent
FusionAuth at a glance
- Sign-in
- API key. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
- You provide
api_key- Setup fields
host- Limits we pace to
- 20 calls a second, per connection
- API covered
- FusionAuth API 1.69.0 (OpenAPI 3.0.3), at your FusionAuth instance's API base URL, which you enter when connecting
- Built from
- FusionAuth's documentation, read 23 October 2026OpenAPI spec (GitHub)fusionauth.io
- Service file
- Version 1.0.0, signed (Ed25519)
- Cached reads
- 82 of 122 reads, for up to 5 minutes; a write clears what it affects
- Shared entities
- 3, so ask can line FusionAuth up with your other systems
- Data
- Processed and stored in Sydney, Australia. No US region yet
Capabilities
What an AI agent can do in FusionAuth.
337 actions in 56 areas. Every one carries its effect, so a key can allow the reads and hold the rest.
- 122readlook, never change
- 174writecreate and update
- 41destructivewait for a confirmation
Users
207 read · 11 write · 2 destructive
Create — users · Search — users · Get — users · Update — users
Identity providers
146 read · 7 write · 1 destructive
List — identity providers · Create — identity providers · Get — identity providers · Update — identity providers
Keys
104 read · 5 write · 1 destructive
List — keys · Get — keys · Delete — keys · Update — keys
Tenants
105 read · 4 write · 1 destructive
List — tenants · Create — tenants · Get — tenants · Update — tenants
Applications
94 read · 4 write · 1 destructive
List — applications · Create — applications · Get — applications · Update — applications
Consents
94 read · 4 write · 1 destructive
Create — consents · Create with id — consents · List — consents · Search — consents
Email templates
94 read · 4 write · 1 destructive
List — email templates · Create — email templates · Get — email templates · Update — email templates
Entities
93 read · 5 write · 1 destructive
Create — entities · Create with id — entities · Get many — entities · Search — entities
48 more areas · 247 actions
- Entity types 9
- Webhooks 9
- Families 8
- Groups 8
- Ip access control lists 8
- Lambdas 8
- Message templates 8
- Registrations 8
- Themes 8
- Connectors 7
- Form fields 7
- Forms 7
- Messengers 7
- User action reasons 7
- User actions 7
- User consents 7
- API keys 6
- Oauth scopes 6
- Two factor 6
- Application roles 5
- Entity grants 5
- Entity type permissions 5
- Reactor 5
- Refresh tokens 5
- Reports 5
- System 5
- User actioning 5
- User two factor 5
- Webauthn 5
- Webauthn credentials 5
- Group members 4
- Identity provider links 4
- Identity verification 4
- JWT 4
- Login 4
- Tenant manager identity providers 4
- Audit logs 3
- Integrations 3
- Passwordless 3
- System configuration 3
- Tenant manager 3
- User comments 3
- Event logs 2
- Oidc 2
- Webhook event logs 2
- Emails 1
- Login records 1
- Webhook attempt logs 1
Top actions
The FusionAuth API, shaped for agents.
The ids your agent types, what each does, and the one name it shares with other systems. 61 of FusionAuth's 61 action names are shared with at least one other connector, so an agent learns them once.
| Action | What it does | Effect | Same name in |
|---|---|---|---|
fusionauth.groups.listList — groups | List — groups. | read | identity.group.list262 connectors |
fusionauth.users.createCreate — users | Create — users. | write | identity.user.create262 connectors |
fusionauth.users.searchSearch — users | Search — users. | read | identity.user.search40 connectors |
fusionauth.applications.listList — applications | List — applications. | read | identity.application.list37 connectors |
fusionauth.groups.createCreate — groups | Create — groups. | write | identity.group.create205 connectors |
fusionauth.applications.createCreate — applications | Create — applications. | write | identity.application.create27 connectors |
fusionauth.application_roles.createCreate — application roles | Create — application roles. | write | identity.role.create105 connectors |
fusionauth.api_keys.createCreate — api keys | Create — api keys. | write | identity.api_key.create100 connectors |
fusionauth.group_members.addAdd — group members | Add — group members. | write | identity.group_member.add72 connectors |
fusionauth.group_members.removeRemove — group members | Remove — group members. | destructive | identity.group_member.remove69 connectors |
fusionauth.application_roles.updateUpdate — application roles | Update — application roles. | write | identity.role.update98 connectors |
fusionauth.api_keys.getGet — api keys | Get — api keys. | read | identity.api_key.get66 connectors |
Try it
Prompts to paste into Claude.
Each one names the FusionAuth actions it will call, so you know what it reads and what it changes before you send it.
- Readread
Who has access in FusionAuth? List every user and their role.
calls
fusionauth.users.search - Writewrite
Create — users in FusionAuth. Show me exactly what you will send before you save it.
calls
fusionauth.users.create
Governance for FusionAuth
Destructive actions wait for a yes.
41 FusionAuth actions are destructive. The first 10:
- Delete — users
fusionauth.users.delete - Delete — groups
fusionauth.groups.delete - Delete — applications
fusionauth.applications.delete - Remove — group members
fusionauth.group_members.remove - Delete — application roles
fusionauth.application_roles.delete - Delete — api keys
fusionauth.api_keys.delete - Delete — identity providers
fusionauth.identity_providers.delete - Delete — webhooks
fusionauth.webhooks.delete - Delete — keys
fusionauth.keys.delete - Delete — email templates
fusionauth.email_templates.delete
A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.
dofusionauth.users.deleteconfirm_policy: human
Delete — users?
intent: the user asked me to delete — users
run suspended · waiting for a named person · key fusionauth-agent cannot confirm itself
In the console, or from an emailed signed link.
account { op: "keys.create", name: "fusionauth-agent", allowed_actions: ["fusionauth.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "fusionauth.users.delete", approver: "[email protected]" }, { match: "fusionauth.groups.delete", approver: "[email protected]" }, { match: "fusionauth.applications.delete", approver: "[email protected]" } ]}Cost
What FusionAuth costs on actionlake.
Every FusionAuth action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call FusionAuth refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
- 1upstream call per actionall 337 FusionAuth actions
- 337actions pageeach page of a long list is one call
- 82reads can be cacheda cache hit costs nothing
- 100,000calls a month, freepaid plans from US$49 a month for 250,000
Action index
Every FusionAuth action.
337 actions by area: the id your agent calls, what it does, and its effect.
Users20
fusionauth.users.bulk_deleteBulk delete — usersdestructivefusionauth.users.change_passwordChange password — userswritefusionauth.users.change_password_by_identityChange password by identity — userswritefusionauth.users.check_change_password_by_login_idCheck change password by login id — usersreadfusionauth.users.check_change_password_idCheck change password id — usersreadfusionauth.users.createCreate — userswritefusionauth.users.create_with_idCreate with id — userswritefusionauth.users.deleteDelete — usersdestructivefusionauth.users.forgot_passwordForgot password — userswritefusionauth.users.getGet — usersreadfusionauth.users.get_manyGet many — usersreadfusionauth.users.importImport — userswritefusionauth.users.list_recent_loginsList recent logins — usersreadfusionauth.users.lookupLookup — usersreadfusionauth.users.patchPatch — userswritefusionauth.users.refresh_search_indexRefresh search index — userswritefusionauth.users.searchSearch — usersreadfusionauth.users.start_verify_emailStart verify email — userswritefusionauth.users.updateUpdate — userswritefusionauth.users.verify_emailVerify email — userswrite
Identity providers14
fusionauth.identity_providers.complete_loginComplete login — identity providerswritefusionauth.identity_providers.createCreate — identity providerswritefusionauth.identity_providers.create_with_idCreate with id — identity providerswritefusionauth.identity_providers.deleteDelete — identity providersdestructivefusionauth.identity_providers.getGet — identity providersreadfusionauth.identity_providers.get_connection_test_resultGet connection test result — identity providersreadfusionauth.identity_providers.listList — identity providersreadfusionauth.identity_providers.lookupLookup — identity providersreadfusionauth.identity_providers.patchPatch — identity providerswritefusionauth.identity_providers.searchSearch — identity providersreadfusionauth.identity_providers.search_by_paramsSearch by params — identity providersreadfusionauth.identity_providers.start_connection_testStart connection test — identity providerswritefusionauth.identity_providers.start_loginStart login — identity providerswritefusionauth.identity_providers.updateUpdate — identity providerswrite
Keys10
fusionauth.keys.deleteDelete — keysdestructivefusionauth.keys.generateGenerate — keyswritefusionauth.keys.generate_with_idGenerate with id — keyswritefusionauth.keys.getGet — keysreadfusionauth.keys.importImport — keyswritefusionauth.keys.import_with_idImport with id — keyswritefusionauth.keys.listList — keysreadfusionauth.keys.searchSearch — keysreadfusionauth.keys.search_by_paramsSearch by params — keysreadfusionauth.keys.updateUpdate — keyswrite
Tenants10
fusionauth.tenants.createCreate — tenantswritefusionauth.tenants.create_with_idCreate with id — tenantswritefusionauth.tenants.deleteDelete — tenantsdestructivefusionauth.tenants.getGet — tenantsreadfusionauth.tenants.get_password_validation_rulesGet password validation rules — tenantsreadfusionauth.tenants.get_password_validation_rules_for_tenantGet password validation rules for tenant — tenantsreadfusionauth.tenants.listList — tenantsreadfusionauth.tenants.patchPatch — tenantswritefusionauth.tenants.searchSearch — tenantsreadfusionauth.tenants.updateUpdate — tenantswrite
Applications9
fusionauth.applications.createCreate — applicationswritefusionauth.applications.create_with_idCreate with id — applicationswritefusionauth.applications.deleteDelete — applicationsdestructivefusionauth.applications.getGet — applicationsreadfusionauth.applications.get_oauth_configurationGet oauth configuration — applicationsreadfusionauth.applications.listList — applicationsreadfusionauth.applications.patchPatch — applicationswritefusionauth.applications.searchSearch — applicationsreadfusionauth.applications.updateUpdate — applicationswrite
Consents9
fusionauth.consents.createCreate — consentswritefusionauth.consents.create_with_idCreate with id — consentswritefusionauth.consents.deleteDelete — consentsdestructivefusionauth.consents.getGet — consentsreadfusionauth.consents.listList — consentsreadfusionauth.consents.patchPatch — consentswritefusionauth.consents.searchSearch — consentsreadfusionauth.consents.search_by_paramsSearch by params — consentsreadfusionauth.consents.updateUpdate — consentswrite
Email templates9
fusionauth.email_templates.createCreate — email templateswritefusionauth.email_templates.create_with_idCreate with id — email templateswritefusionauth.email_templates.deleteDelete — email templatesdestructivefusionauth.email_templates.getGet — email templatesreadfusionauth.email_templates.listList — email templatesreadfusionauth.email_templates.patchPatch — email templateswritefusionauth.email_templates.previewPreview — email templatesreadfusionauth.email_templates.searchSearch — email templatesreadfusionauth.email_templates.updateUpdate — email templateswrite
Entities9
fusionauth.entities.createCreate — entitieswritefusionauth.entities.create_with_idCreate with id — entitieswritefusionauth.entities.deleteDelete — entitiesdestructivefusionauth.entities.getGet — entitiesreadfusionauth.entities.get_manyGet many — entitiesreadfusionauth.entities.patchPatch — entitieswritefusionauth.entities.refresh_search_indexRefresh search index — entitieswritefusionauth.entities.searchSearch — entitiesreadfusionauth.entities.updateUpdate — entitieswrite
Entity types9
fusionauth.entity_types.createCreate — entity typeswritefusionauth.entity_types.create_with_idCreate with id — entity typeswritefusionauth.entity_types.deleteDelete — entity typesdestructivefusionauth.entity_types.getGet — entity typesreadfusionauth.entity_types.listList — entity typesreadfusionauth.entity_types.patchPatch — entity typeswritefusionauth.entity_types.searchSearch — entity typesreadfusionauth.entity_types.search_by_paramsSearch by params — entity typesreadfusionauth.entity_types.updateUpdate — entity typeswrite
Webhooks9
fusionauth.webhooks.createCreate — webhookswritefusionauth.webhooks.create_with_idCreate with id — webhookswritefusionauth.webhooks.deleteDelete — webhooksdestructivefusionauth.webhooks.getGet — webhooksreadfusionauth.webhooks.listList — webhooksreadfusionauth.webhooks.patchPatch — webhookswritefusionauth.webhooks.searchSearch — webhooksreadfusionauth.webhooks.search_by_paramsSearch by params — webhooksreadfusionauth.webhooks.updateUpdate — webhookswrite
Families8
fusionauth.families.add_memberAdd member — familieswritefusionauth.families.createCreate — familieswritefusionauth.families.list_for_userList for user — familiesreadfusionauth.families.list_membersList members — familiesreadfusionauth.families.list_pending_childrenList pending children — familiesreadfusionauth.families.remove_memberRemove member — familiesdestructivefusionauth.families.send_request_emailSend request email — familieswritefusionauth.families.update_memberUpdate member — familieswrite
Groups8
fusionauth.groups.createCreate — groupswritefusionauth.groups.create_with_idCreate with id — groupswritefusionauth.groups.deleteDelete — groupsdestructivefusionauth.groups.getGet — groupsreadfusionauth.groups.listList — groupsreadfusionauth.groups.patchPatch — groupswritefusionauth.groups.searchSearch — groupsreadfusionauth.groups.updateUpdate — groupswrite
Ip access control lists8
fusionauth.ip_access_control_lists.createCreate — ip access control listswritefusionauth.ip_access_control_lists.create_with_idCreate with id — ip access control listswritefusionauth.ip_access_control_lists.deleteDelete — ip access control listsdestructivefusionauth.ip_access_control_lists.getGet — ip access control listsreadfusionauth.ip_access_control_lists.patchPatch — ip access control listswritefusionauth.ip_access_control_lists.searchSearch — ip access control listsreadfusionauth.ip_access_control_lists.search_by_paramsSearch by params — ip access control listsreadfusionauth.ip_access_control_lists.updateUpdate — ip access control listswrite
Lambdas8
fusionauth.lambdas.createCreate — lambdaswritefusionauth.lambdas.create_with_idCreate with id — lambdaswritefusionauth.lambdas.deleteDelete — lambdasdestructivefusionauth.lambdas.getGet — lambdasreadfusionauth.lambdas.listList — lambdasreadfusionauth.lambdas.patchPatch — lambdaswritefusionauth.lambdas.searchSearch — lambdasreadfusionauth.lambdas.updateUpdate — lambdaswrite
Message templates8
fusionauth.message_templates.createCreate — message templateswritefusionauth.message_templates.create_with_idCreate with id — message templateswritefusionauth.message_templates.deleteDelete — message templatesdestructivefusionauth.message_templates.getGet — message templatesreadfusionauth.message_templates.listList — message templatesreadfusionauth.message_templates.patchPatch — message templateswritefusionauth.message_templates.previewPreview — message templatesreadfusionauth.message_templates.updateUpdate — message templateswrite
Registrations8
fusionauth.registrations.createCreate — registrationswritefusionauth.registrations.create_with_userCreate with user — registrationswritefusionauth.registrations.deleteDelete — registrationsdestructivefusionauth.registrations.getGet — registrationsreadfusionauth.registrations.patchPatch — registrationswritefusionauth.registrations.start_verifyStart verify — registrationswritefusionauth.registrations.updateUpdate — registrationswritefusionauth.registrations.verifyVerify — registrationswrite
Themes8
fusionauth.themes.createCreate — themeswritefusionauth.themes.create_with_idCreate with id — themeswritefusionauth.themes.deleteDelete — themesdestructivefusionauth.themes.getGet — themesreadfusionauth.themes.listList — themesreadfusionauth.themes.patchPatch — themeswritefusionauth.themes.searchSearch — themesreadfusionauth.themes.updateUpdate — themeswrite
Connectors7
fusionauth.connectors.createCreate — connectorswritefusionauth.connectors.create_with_idCreate with id — connectorswritefusionauth.connectors.deleteDelete — connectorsdestructivefusionauth.connectors.getGet — connectorsreadfusionauth.connectors.listList — connectorsreadfusionauth.connectors.patchPatch — connectorswritefusionauth.connectors.updateUpdate — connectorswrite
Form fields7
fusionauth.form_fields.createCreate — form fieldswritefusionauth.form_fields.create_with_idCreate with id — form fieldswritefusionauth.form_fields.deleteDelete — form fieldsdestructivefusionauth.form_fields.getGet — form fieldsreadfusionauth.form_fields.listList — form fieldsreadfusionauth.form_fields.patchPatch — form fieldswritefusionauth.form_fields.updateUpdate — form fieldswrite
Forms7
fusionauth.forms.createCreate — formswritefusionauth.forms.create_with_idCreate with id — formswritefusionauth.forms.deleteDelete — formsdestructivefusionauth.forms.getGet — formsreadfusionauth.forms.listList — formsreadfusionauth.forms.patchPatch — formswritefusionauth.forms.updateUpdate — formswrite
Messengers7
fusionauth.messengers.createCreate — messengerswritefusionauth.messengers.create_with_idCreate with id — messengerswritefusionauth.messengers.deleteDelete — messengersdestructivefusionauth.messengers.getGet — messengersreadfusionauth.messengers.listList — messengersreadfusionauth.messengers.patchPatch — messengerswritefusionauth.messengers.updateUpdate — messengerswrite
User action reasons7
fusionauth.user_action_reasons.createCreate — user action reasonswritefusionauth.user_action_reasons.create_with_idCreate with id — user action reasonswritefusionauth.user_action_reasons.deleteDelete — user action reasonsdestructivefusionauth.user_action_reasons.getGet — user action reasonsreadfusionauth.user_action_reasons.listList — user action reasonsreadfusionauth.user_action_reasons.patchPatch — user action reasonswritefusionauth.user_action_reasons.updateUpdate — user action reasonswrite
User actions7
fusionauth.user_actions.createCreate — user actionswritefusionauth.user_actions.create_with_idCreate with id — user actionswritefusionauth.user_actions.deleteDelete — user actionsdestructivefusionauth.user_actions.getGet — user actionsreadfusionauth.user_actions.listList — user actionsreadfusionauth.user_actions.patchPatch — user actionswritefusionauth.user_actions.updateUpdate — user actionswrite
User consents7
fusionauth.user_consents.createCreate — user consentswritefusionauth.user_consents.create_with_idCreate with id — user consentswritefusionauth.user_consents.getGet — user consentsreadfusionauth.user_consents.listList — user consentsreadfusionauth.user_consents.patchPatch — user consentswritefusionauth.user_consents.revokeRevoke — user consentsdestructivefusionauth.user_consents.updateUpdate — user consentswrite
API keys6
fusionauth.api_keys.createCreate — api keyswritefusionauth.api_keys.create_with_idCreate with id — api keyswritefusionauth.api_keys.deleteDelete — api keysdestructivefusionauth.api_keys.getGet — api keysreadfusionauth.api_keys.patchPatch — api keyswritefusionauth.api_keys.updateUpdate — api keyswrite
Oauth scopes6
fusionauth.oauth_scopes.createCreate — oauth scopeswritefusionauth.oauth_scopes.create_with_idCreate with id — oauth scopeswritefusionauth.oauth_scopes.deleteDelete — oauth scopesdestructivefusionauth.oauth_scopes.getGet — oauth scopesreadfusionauth.oauth_scopes.patchPatch — oauth scopeswritefusionauth.oauth_scopes.updateUpdate — oauth scopeswrite
Two factor6
fusionauth.two_factor.check_statusCheck status — two factorreadfusionauth.two_factor.get_statusGet status — two factorreadfusionauth.two_factor.loginLogin — two factorwritefusionauth.two_factor.send_code_for_enable_disableSend code for enable disable — two factorwritefusionauth.two_factor.send_code_for_loginSend code for login — two factorwritefusionauth.two_factor.start_loginStart login — two factorwrite
Application roles5
fusionauth.application_roles.createCreate — application roleswritefusionauth.application_roles.create_with_idCreate with id — application roleswritefusionauth.application_roles.deleteDelete — application rolesdestructivefusionauth.application_roles.patchPatch — application roleswritefusionauth.application_roles.updateUpdate — application roleswrite
Entity grants5
fusionauth.entity_grants.deleteDelete — entity grantsdestructivefusionauth.entity_grants.getGet — entity grantsreadfusionauth.entity_grants.searchSearch — entity grantsreadfusionauth.entity_grants.search_by_paramsSearch by params — entity grantsreadfusionauth.entity_grants.upsertUpsert — entity grantswrite
Entity type permissions5
fusionauth.entity_type_permissions.createCreate — entity type permissionswritefusionauth.entity_type_permissions.create_with_idCreate with id — entity type permissionswritefusionauth.entity_type_permissions.deleteDelete — entity type permissionsdestructivefusionauth.entity_type_permissions.patchPatch — entity type permissionswritefusionauth.entity_type_permissions.updateUpdate — entity type permissionswrite
Reactor5
fusionauth.reactor.activateActivate — reactorwritefusionauth.reactor.deactivateDeactivate — reactordestructivefusionauth.reactor.get_metricsGet metrics — reactorreadfusionauth.reactor.get_statusGet status — reactorreadfusionauth.reactor.regenerate_keysRegenerate keys — reactorwrite
Refresh tokens5
fusionauth.refresh_tokens.getGet — refresh tokensreadfusionauth.refresh_tokens.importImport — refresh tokenswritefusionauth.refresh_tokens.listList — refresh tokensreadfusionauth.refresh_tokens.revokeRevoke — refresh tokensdestructivefusionauth.refresh_tokens.revoke_by_idRevoke by id — refresh tokensdestructive
Reports5
fusionauth.reports.daily_active_usersDaily active users — reportsreadfusionauth.reports.loginsLogins — reportsreadfusionauth.reports.monthly_active_usersMonthly active users — reportsreadfusionauth.reports.registrationsRegistrations — reportsreadfusionauth.reports.totalsTotals — reportsread
System5
fusionauth.system.get_reindex_statusGet reindex status — systemreadfusionauth.system.healthHealth — systemreadfusionauth.system.reindexReindex — systemwritefusionauth.system.statusStatus — systemreadfusionauth.system.versionVersion — systemread
User actioning5
fusionauth.user_actioning.cancelCancel — user actioningdestructivefusionauth.user_actioning.getGet — user actioningreadfusionauth.user_actioning.listList — user actioningreadfusionauth.user_actioning.modifyModify — user actioningwritefusionauth.user_actioning.takeTake — user actioningwrite
User two factor5
fusionauth.user_two_factor.disableDisable — user two factordestructivefusionauth.user_two_factor.enableEnable — user two factorwritefusionauth.user_two_factor.generate_recovery_codesGenerate recovery codes — user two factorwritefusionauth.user_two_factor.list_recovery_codesList recovery codes — user two factorreadfusionauth.user_two_factor.update_methodUpdate method — user two factorwrite
Webauthn5
fusionauth.webauthn.complete_assertionComplete assertion — webauthnwritefusionauth.webauthn.complete_loginComplete login — webauthnwritefusionauth.webauthn.complete_registrationComplete registration — webauthnwritefusionauth.webauthn.start_loginStart login — webauthnwritefusionauth.webauthn.start_registrationStart registration — webauthnwrite
Webauthn credentials5
fusionauth.webauthn_credentials.deleteDelete — webauthn credentialsdestructivefusionauth.webauthn_credentials.delete_for_userDelete for user — webauthn credentialsdestructivefusionauth.webauthn_credentials.getGet — webauthn credentialsreadfusionauth.webauthn_credentials.importImport — webauthn credentialswritefusionauth.webauthn_credentials.list_for_userList for user — webauthn credentialsread
Group members4
fusionauth.group_members.addAdd — group memberswritefusionauth.group_members.removeRemove — group membersdestructivefusionauth.group_members.replaceReplace — group memberswritefusionauth.group_members.searchSearch — group membersread
Identity provider links4
fusionauth.identity_provider_links.createCreate — identity provider linkswritefusionauth.identity_provider_links.deleteDelete — identity provider linksdestructivefusionauth.identity_provider_links.get_pendingGet pending — identity provider linksreadfusionauth.identity_provider_links.listList — identity provider linksread
Identity verification4
fusionauth.identity_verification.completeComplete — identity verificationwritefusionauth.identity_verification.sendSend — identity verificationwritefusionauth.identity_verification.startStart — identity verificationwritefusionauth.identity_verification.verifyVerify — identity verificationwrite
JWT4
fusionauth.jwt.get_public_keyGet public key — jwtreadfusionauth.jwt.reconcileReconcile — jwtwritefusionauth.jwt.refreshRefresh — jwtwritefusionauth.jwt.vendVend — jwtwrite
Login4
fusionauth.login.loginLogin — loginwritefusionauth.login.logoutLogout — logindestructivefusionauth.login.pingPing — loginwritefusionauth.login.ping_with_requestPing with request — loginwrite
Tenant manager identity providers4
fusionauth.tenant_manager_identity_providers.createCreate — tenant manager identity providerswritefusionauth.tenant_manager_identity_providers.deleteDelete — tenant manager identity providersdestructivefusionauth.tenant_manager_identity_providers.patchPatch — tenant manager identity providerswritefusionauth.tenant_manager_identity_providers.updateUpdate — tenant manager identity providerswrite
Audit logs3
fusionauth.audit_logs.createCreate — audit logswritefusionauth.audit_logs.getGet — audit logsreadfusionauth.audit_logs.searchSearch — audit logsread
Integrations3
fusionauth.integrations.getGet — integrationsreadfusionauth.integrations.patchPatch — integrationswritefusionauth.integrations.updateUpdate — integrationswrite
Passwordless3
fusionauth.passwordless.loginLogin — passwordlesswritefusionauth.passwordless.send_codeSend code — passwordlesswritefusionauth.passwordless.startStart — passwordlesswrite
System configuration3
fusionauth.system_configuration.getGet — system configurationreadfusionauth.system_configuration.patchPatch — system configurationwritefusionauth.system_configuration.updateUpdate — system configurationwrite
Tenant manager3
fusionauth.tenant_manager.getGet — tenant managerreadfusionauth.tenant_manager.patchPatch — tenant managerwritefusionauth.tenant_manager.updateUpdate — tenant managerwrite
User comments3
fusionauth.user_comments.createCreate — user commentswritefusionauth.user_comments.list_for_userList for user — user commentsreadfusionauth.user_comments.searchSearch — user commentsread
Event logs2
fusionauth.event_logs.getGet — event logsreadfusionauth.event_logs.searchSearch — event logsread
Oidc2
fusionauth.oidc.get_jwksGet jwks — oidcreadfusionauth.oidc.get_openid_configurationGet openid configuration — oidcread
Webhook event logs2
fusionauth.webhook_event_logs.getGet — webhook event logsreadfusionauth.webhook_event_logs.searchSearch — webhook event logsread
Emails1
fusionauth.emails.sendSend — emailswrite
Login records1
fusionauth.login_records.searchSearch — login recordsread
Webhook attempt logs1
fusionauth.webhook_attempt_logs.getGet — webhook attempt logsread
Questions
The FusionAuth MCP server, answered.
Is there a FusionAuth MCP server for Claude?
Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 337 FusionAuth actions across users, identity providers, keys and tenants, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by FusionAuth.
What do I need to connect FusionAuth?
FusionAuth API key (Settings > API Keys). Plus your host. The free call account { op: "connections.requirements", service: "fusionauth" } lists exactly what to paste.
Can an AI agent delete or change things in FusionAuth?
Only if its key allows it, and only with an explicit confirmation. 41 FusionAuth actions are destructive, including delete — users, delete — groups and delete — applications. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.
Will an AI agent use up my FusionAuth API limit?
actionlake paces every call to the limits in the FusionAuth service file: 20 calls a second per connection. Repeated reads are answered from cache (82 FusionAuth actions can be), which never reaches FusionAuth.
What does a FusionAuth action cost?
One upstream call, the only unit actionlake bills. A list that pages bills one call per page (337 FusionAuth actions page). Cache hits, searches, dry runs and calls FusionAuth refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.
Which FusionAuth API does it cover?
The FusionAuth API 1.69.0 (OpenAPI 3.0.3) at your FusionAuth instance's API base URL, which you enter when connecting. It is built from FusionAuth's documentation as read on 23 October 2026. 337 actions in 56 areas, each one in the signed service file (version 1.0.0).
Does actionlake keep my FusionAuth data, and where?
actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your FusionAuth credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.
Which AI clients can use it?
Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.
Give your agent FusionAuth today.
Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.
