// SCAN REPORT

Fusionauth

314 tools. 208 can modify or destroy data without limits.

39 destructive tools with no built-in limits. Policy required.

Last updated:

208 can modify or destroy data
106 read-only
314 tools total

Community server · catalogue entry checked 30/06/2026

How to control Fusionauth ↓

TOOL MAP

What Fusionauth exposes to your agents

Read (106) Write / Execute (169) Destructive / Financial (39)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS
Critical Risk

The most dangerous Fusionauth tools

Destructive · Critical deleteApplicationRoleWithId The tool explicitly performs a hard delete operation that is irreversible and affects all users with the role. Destructive · Critical deleteTenantWithId The tool irreversibly deletes an entire tenant and all associated data (applications, users, metrics, reports). Destructive · High deleteAPIKeyWithId Deleting an API key is a destructive action that cannot be undone. Destructive · Critical deleteApplicationWithId This tool irreversibly deletes application data and all associated records (registrations, metrics, reports, roles) with no undo capability.

208 of Fusionauth's 314 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Fusionauth

PolicyLayer is an MCP gateway — it sits between your AI agents and Fusionauth, and nothing reaches the server without passing your rules. These are the rules we recommend:

Deny destructive operations
{
  "deleteAPIKeyWithId": {
    "deny_if": [
      {
        "conditions": [],
        "on_deny": "Blocked by default. Requires approval."
      }
    ]
  }
}

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
{
  "actionUserWithId": {
    "limits": [
      {
        "counter": "actionuserwithid_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
{
  "createDeviceUserCode": {
    "limits": [
      {
        "counter": "createdeviceusercode_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

  1. Create a free account and register Fusionauth — nothing to install.
  2. Add these rules — paste them, or build them visually. Tune the limits to your setup.
  3. Point your MCP client (Claude, Cursor, anything) at your gateway URL.
ENFORCE POLICY ON FUSIONAUTH →

Instant setup, no code required.

FULL CATALOGUE

All 314 Fusionauth tools

DESTRUCTIVE 39 tools
Destructive deleteAPIKeyWithId Deletes the API key for the given Id. Destructive deleteApplicationRoleWithId Hard deletes an application role. This is a dangerous operation and should not be used in most circumstances. Destructive deleteApplicationWithId Hard deletes an application. This is a dangerous operation and should not be used in most circumstances. This Destructive deleteConnectorWithId Deletes the connector for the given Id. Destructive deleteConsentWithId Deletes the consent for the given Id. Destructive deleteEmailTemplateWithId Deletes the email template for the given Id. Destructive deleteEntityGrantWithId Deletes an Entity Grant for the given User or Entity. Destructive deleteEntityTypePermissionWithId Hard deletes a permission. This is a dangerous operation and should not be used in most circumstances. This pe Destructive deleteEntityTypeWithId Deletes the Entity Type for the given Id. Destructive deleteEntityWithId Deletes the Entity for the given Id. Destructive deleteFormFieldWithId Deletes the form field for the given Id. Destructive deleteFormWithId Deletes the form for the given Id. Destructive deleteGroupMembersWithId Removes users as members of a group. Destructive deleteGroupWithId Deletes the group for the given Id. Destructive deleteIdentityProviderWithId Deletes the identity provider for the given Id. Destructive deleteIPAccessControlListWithId Deletes the IP Access Control List for the given Id. Destructive deleteJwtRefresh Revokes refresh tokens using the information in the JSON body. The handling for this method is the same as the Destructive deleteKeyWithId Deletes the key for the given Id. Destructive deleteLambdaWithId Deletes the lambda for the given Id. Destructive deleteMessageTemplateWithId Deletes the message template for the given Id. Destructive deleteMessengerWithId Deletes the messenger for the given Id. Destructive deleteOAuthScopeWithId Hard deletes a custom OAuth scope. OAuth workflows that are still requesting the deleted OAuth scope may fail Destructive deleteTenantWithId Deletes the tenant based on the given request (sent to the API as JSON). This permanently deletes all informat Destructive deleteThemeWithId Deletes the theme for the given Id. Destructive deleteUserActionReasonWithId Deletes the user action reason for the given Id. Destructive deleteUserActionWithId Deletes the user action for the given Id. This permanently deletes the user action and also any history and lo Destructive deleteUserBulk Deletes the users with the given Ids, or users matching the provided JSON query or queryString. The order of p Destructive deleteUserLinkWithId Remove an existing link that has been made from a 3rd party identity provider to a FusionAuth user. Destructive deleteUserRegistrationWithId Deletes the user registration for the given user and application along with the given JSON body that contains Destructive deleteUserTwoFactorWithId Disable two-factor authentication for a user using a JSON body rather than URL parameters. OR Disable two-fact Destructive deleteUserWithId Deletes the user based on the given request (sent to the API as JSON). This permanently deletes all informatio Destructive deleteWebAuthnCredentialsForUserWithId Deletes all of the WebAuthn credentials for the given User Id. Destructive deleteWebAuthnCredentialWithId Deletes the WebAuthn credential for the given Id. Destructive deleteWebhookWithId Deletes the webhook for the given Id. Destructive forgotPasswordWithId Begins the forgot password sequence, which kicks off an email to the user so that they can reset their passwor Destructive reindexWithId Requests Elasticsearch to delete and rebuild the index for FusionAuth users or entities. Be very careful when Destructive removeUserFromFamilyWithId Removes a user from the family with the given Id. Destructive revokeRefreshTokenByIdWithId Revokes a single refresh token by the unique Id. The unique Id is not sensitive as it cannot be used to obtain Destructive revokeUserConsentWithId Revokes a single User consent by Id.
EXECUTE 20 tools
Execute completeWebAuthnAssertionWithId Complete a WebAuthn authentication ceremony by validating the signature against the previously generated chall Execute completeWebAuthnLoginWithId Complete a WebAuthn authentication ceremony by validating the signature against the previously generated chall Execute createDevice_authorize Start the Device Authorization flow using a request body OR Start the Device Authorization flow using form-enc Execute createToken Exchange User Credentials for a Token. If you will be using the Resource Owner Password Credential Grant, you Execute exchangeRefreshTokenForJWTWithId Exchange a refresh token for a new JWT. Execute identityProviderLoginWithId Handles login via third-parties including Social login, external OAuth and OpenID Connect, and other login sys Execute issueJWTWithId Issue a new access token (JWT) for the requested Application after ensuring the provided JWT is valid. A valid Execute loginWithId Authenticates a user to FusionAuth. This API optionally requires an API key. See <code>Application.loginConf Execute passwordlessLoginWithId Complete a login request using a passwordless code Execute sendEmailWithId Send an email using an email template Id. You can optionally provide <code>requestData</code> to access key va Execute sendTwoFactorCodeForEnableDisableWithId Send a Two Factor authentication code to assist in setting up Two Factor authentication or disabling. Execute sendTwoFactorCodeForLoginUsingMethodWithId Send a Two Factor authentication code to allow the completion of Two Factor authentication. Execute sendVerifyIdentityWithId Send a verification code using the appropriate transport for the identity type being verified. Execute startIdentityProviderLoginWithId Begins a login request for a 3rd party login that requires user interaction such as HYPR. Execute startPasswordlessLoginWithId Start a passwordless login request by generating a passwordless code. This code can be sent to the User using Execute startTwoFactorLoginWithId Start a Two-Factor login request by generating a two-factor identifier. This code can then be sent to the Two Execute startVerifyIdentityWithId Start a verification of an identity by generating a code. This code can be sent to the User using the Verify S Execute startWebAuthnLoginWithId Start a WebAuthn authentication ceremony by generating a new challenge for the user Execute startWebAuthnRegistrationWithId Start a WebAuthn registration ceremony by generating a new challenge for the user Execute twoFactorLoginWithId Complete login using a 2FA challenge
WRITE 149 tools
Write actionUserWithId Takes an action on a user. The user being actioned is called the Write activateReactorWithId Activates the FusionAuth Reactor using a license Id and optionally a license text (for air-gapped deployments) Write cancelActionWithId Cancels the user action. Write changePasswordWithId Changes a user Write commentOnUserWithId Adds a comment to the user Write completeVerifyIdentityWithId Completes verification of an identity using verification codes from the Verify Start API. Write completeWebAuthnRegistrationWithId Complete a WebAuthn registration ceremony by validating the client request and saving the new credential Write createAPIKey Creates an API key. You can optionally specify a unique Id for the key, if not provided one will be generated. Write createAPIKeyWithId Creates an API key. You can optionally specify a unique Id for the key, if not provided one will be generated. Write createApplication Creates an application. You can optionally specify an Id for the application, if not provided one will be gene Write createApplicationRole Creates a new role for an application. You must specify the Id of the application you are creating the role fo Write createApplicationRoleWithId Creates a new role for an application. You must specify the Id of the application you are creating the role fo Write createApplicationWithId Creates an application. You can optionally specify an Id for the application, if not provided one will be gene Write createAuditLogWithId Creates an audit log with the message and user name (usually an email). Audit logs should be written anytime y Write createConnector Creates a connector. You can optionally specify an Id for the connector, if not provided one will be generate Write createConnectorWithId Creates a connector. You can optionally specify an Id for the connector, if not provided one will be generate Write createConsent Creates a user consent type. You can optionally specify an Id for the consent type, if not provided one will b Write createConsentWithId Creates a user consent type. You can optionally specify an Id for the consent type, if not provided one will b Write createDeviceApprove Approve a device grant. OR Approve a device grant. Write createEmailTemplate Creates an email template. You can optionally specify an Id for the template, if not provided one will be gene Write createEmailTemplateWithId Creates an email template. You can optionally specify an Id for the template, if not provided one will be gene Write createEntity Creates an Entity. You can optionally specify an Id for the Entity. If not provided one will be generated. Write createEntityType Creates a Entity Type. You can optionally specify an Id for the Entity Type, if not provided one will be gener Write createEntityTypePermission Creates a new permission for an entity type. You must specify the Id of the entity type you are creating the p Write createEntityTypePermissionWithId Creates a new permission for an entity type. You must specify the Id of the entity type you are creating the p Write createEntityTypeWithId Creates a Entity Type. You can optionally specify an Id for the Entity Type, if not provided one will be gener Write createEntityWithId Creates an Entity. You can optionally specify an Id for the Entity. If not provided one will be generated. Write createFamily Creates a family with the user Id in the request as the owner and sole member of the family. You can optionall Write createFamilyWithId Creates a family with the user Id in the request as the owner and sole member of the family. You can optionall Write createForm Creates a form. You can optionally specify an Id for the form, if not provided one will be generated. Write createFormField Creates a form field. You can optionally specify an Id for the form, if not provided one will be generated. Write createFormFieldWithId Creates a form field. You can optionally specify an Id for the form, if not provided one will be generated. Write createFormWithId Creates a form. You can optionally specify an Id for the form, if not provided one will be generated. Write createGroup Creates a group. You can optionally specify an Id for the group, if not provided one will be generated. Write createGroupMembersWithId Creates a member in a group. Write createGroupWithId Creates a group. You can optionally specify an Id for the group, if not provided one will be generated. Write createIdentityProvider Creates an identity provider. You can optionally specify an Id for the identity provider, if not provided one Write createIdentityProviderWithId Creates an identity provider. You can optionally specify an Id for the identity provider, if not provided one Write createIPAccessControlList Creates an IP Access Control List. You can optionally specify an Id on this create request, if one is not prov Write createIPAccessControlListWithId Creates an IP Access Control List. You can optionally specify an Id on this create request, if one is not prov Write createLambda Creates a Lambda. You can optionally specify an Id for the lambda, if not provided one will be generated. Write createLambdaWithId Creates a Lambda. You can optionally specify an Id for the lambda, if not provided one will be generated. Write createLogout The Logout API is intended to be used to remove the refresh token and access token cookies if they exist on th Write createMessageTemplate Creates an message template. You can optionally specify an Id for the template, if not provided one will be ge Write createMessageTemplateWithId Creates an message template. You can optionally specify an Id for the template, if not provided one will be ge Write createMessenger Creates a messenger. You can optionally specify an Id for the messenger, if not provided one will be generate Write createMessengerWithId Creates a messenger. You can optionally specify an Id for the messenger, if not provided one will be generate Write createOAuthScope Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creati Write createOAuthScopeWithId Creates a new custom OAuth scope for an application. You must specify the Id of the application you are creati Write createTenant Creates a tenant. You can optionally specify an Id for the tenant, if not provided one will be generated. Write createTenantWithId Creates a tenant. You can optionally specify an Id for the tenant, if not provided one will be generated. Write createTheme Creates a Theme. You can optionally specify an Id for the theme, if not provided one will be generated. Write createThemeWithId Creates a Theme. You can optionally specify an Id for the theme, if not provided one will be generated. Write createUser Creates a user. You can optionally specify an Id for the user, if not provided one will be generated. Write createUserAction Creates a user action. This action cannot be taken on a user until this call successfully returns. Anytime aft Write createUserActionReason Creates a user reason. This user action reason cannot be used when actioning a user until this call completes Write createUserActionReasonWithId Creates a user reason. This user action reason cannot be used when actioning a user until this call completes Write createUserActionWithId Creates a user action. This action cannot be taken on a user until this call successfully returns. Anytime aft Write createUserChangePassword Changes a user Write createUserConsent Creates a single User consent. Write createUserConsentWithId Creates a single User consent. Write createUserLinkWithId Link an external user from a 3rd party identity provider to a FusionAuth user. Write createUserVerifyEmail Administratively verify a user Write createUserWithId Creates a user. You can optionally specify an Id for the user, if not provided one will be generated. Write createWebhook Creates a webhook. You can optionally specify an Id for the webhook, if not provided one will be generated. Write createWebhookWithId Creates a webhook. You can optionally specify an Id for the webhook, if not provided one will be generated. Write enableTwoFactorWithId Enable two-factor authentication for a user. Write generateKey Generate a new RSA or EC key pair or an HMAC secret. Write generateKeyWithId Generate a new RSA or EC key pair or an HMAC secret. Write generateTwoFactorRecoveryCodesWithId Generate two-factor recovery codes for a user. Generating two-factor recovery codes will invalidate any existi Write generateTwoFactorSecretUsingJWTWithId Generate a Two Factor secret that can be used to enable Two Factor authentication for a User. The response wil Write importKey Import an existing RSA or EC key pair or an HMAC secret. Write importKeyWithId Import an existing RSA or EC key pair or an HMAC secret. Write importRefreshTokensWithId Bulk imports refresh tokens. This request performs minimal validation and runs batch inserts of refresh tokens Write importUsersWithId Bulk imports users. This request performs minimal validation and runs batch inserts of users with the expectat Write importWebAuthnCredentialWithId Import a WebAuthn credential Write loginPingWithId Sends a ping to FusionAuth indicating that the user was automatically logged into an application. When using F Write loginPingWithRequestWithId Sends a ping to FusionAuth indicating that the user was automatically logged into an application. When using F Write modifyActionWithId Modifies a temporal user action by changing the expiration of the action and optionally adding a comment to th Write patchAPIKeyWithId Updates an API key with the given Id. Write patchApplicationRoleWithId Updates, via PATCH, the application role with the given Id for the application. Write patchApplicationWithId Updates, via PATCH, the application with the given Id. Write patchConnectorWithId Updates, via PATCH, the connector with the given Id. Write patchConsentWithId Updates, via PATCH, the consent with the given Id. Write patchEmailTemplateWithId Updates, via PATCH, the email template with the given Id. Write patchEntityTypePermissionWithId Patches the permission with the given Id for the entity type. Write patchEntityTypeWithId Updates, via PATCH, the Entity Type with the given Id. Write patchEntityWithId Updates, via PATCH, the Entity with the given Id. Write patchFormFieldWithId Patches the form field with the given Id. Write patchFormWithId Patches the form with the given Id. Write patchGroupWithId Updates, via PATCH, the group with the given Id. Write patchIdentityProviderWithId Updates, via PATCH, the identity provider with the given Id. Write patchIntegrationsWithId Updates, via PATCH, the available integrations. Write patchIPAccessControlListWithId Update the IP Access Control List with the given Id. Write patchLambdaWithId Updates, via PATCH, the lambda with the given Id. Write patchMessageTemplateWithId Updates, via PATCH, the message template with the given Id. Write patchMessengerWithId Updates, via PATCH, the messenger with the given Id. Write patchOAuthScopeWithId Updates, via PATCH, the custom OAuth scope with the given Id for the application. Write patchRegistrationWithId Updates, via PATCH, the registration for the user with the given Id and the application defined in the request Write patchSystemConfigurationWithId Updates, via PATCH, the system configuration. Write patchTenantWithId Updates, via PATCH, the tenant with the given Id. Write patchThemeWithId Updates, via PATCH, the theme with the given Id. Write patchUserActionReasonWithId Updates, via PATCH, the user action reason with the given Id. Write patchUserActionWithId Updates, via PATCH, the user action with the given Id. Write patchUserConsentWithId Updates, via PATCH, a single User consent by Id. Write patchUserWithId Updates, via PATCH, the user with the given Id. Write patchWebhookWithId Patches the webhook with the given Id. Write reconcileJWTWithId Reconcile a User to FusionAuth using JWT issued from another Identity Provider. Write register Registers a user for an application. If you provide the User and the UserRegistration object on this request, Write registerWithId Registers a user for an application. If you provide the User and the UserRegistration object on this request, Write sendFamilyRequestEmailWithId Sends out an email to a parent that they need to register and create a family or need to log in and add a chil Write sendPasswordlessCodeWithId Send a passwordless authentication code in an email to complete login. Write updateAPIKeyWithId Updates an API key with the given Id. Write updateApplicationRoleWithId Updates the application role with the given Id for the application. Write updateApplicationWithId Updates the application with the given Id. OR Reactivates the application with the given Id. Write updateConnectorWithId Updates the connector with the given Id. Write updateConsentWithId Updates the consent with the given Id. Write updateEmailTemplateWithId Updates the email template with the given Id. Write updateEntityTypePermissionWithId Updates the permission with the given Id for the entity type. Write updateEntityTypeWithId Updates the Entity Type with the given Id. Write updateEntityWithId Updates the Entity with the given Id. Write updateFormFieldWithId Updates the form field with the given Id. Write updateFormWithId Updates the form with the given Id. Write updateGroupMembersWithId Creates a member in a group. Write updateGroupWithId Updates the group with the given Id. Write updateIdentityProviderWithId Updates the identity provider with the given Id. Write updateIntegrationsWithId Updates the available integrations. Write updateIPAccessControlListWithId Updates the IP Access Control List with the given Id. Write updateKeyWithId Updates the key with the given Id. Write updateLambdaWithId Updates the lambda with the given Id. Write updateMessageTemplateWithId Updates the message template with the given Id. Write updateMessengerWithId Updates the messenger with the given Id. Write updateOAuthScopeWithId Updates the OAuth scope with the given Id for the application. Write updateRegistrationWithId Updates the registration for the user with the given Id and the application defined in the request. Write updateSystemConfigurationWithId Updates the system configuration. Write updateTenantWithId Updates the tenant with the given Id. Write updateThemeWithId Updates the theme with the given Id. Write updateUserActionReasonWithId Updates the user action reason with the given Id. Write updateUserActionWithId Updates the user action with the given Id. OR Reactivates the user action with the given Id. Write updateUserConsentWithId Updates a single User consent by Id. Write updateUserFamilyWithId Updates a family with a given Id. OR Adds a user to an existing family. The family Id must be specified. Write updateUserVerifyEmail Re-sends the verification email to the user. If the Application has configured a specific email template this Write updateUserVerifyRegistration Re-sends the application registration verification email to the user. OR Generate a new Application Registrati Write updateUserWithId Updates the user with the given Id. OR Reactivates the user with the given Id. Write updateWebhookWithId Updates the webhook with the given Id. Write upsertEntityGrantWithId Creates or updates an Entity Grant. This is when a User/Entity is granted permissions to an Entity. Write vendJWTWithId It Write verifyIdentityWithId Administratively verify a user identity. Write verifyUserRegistrationWithId Confirms a user
READ 106 tools
Read createDeviceUserCode Retrieve a user_code that is part of an in-progress Device Authorization Grant. This API is useful if you wan Read createIntrospect Inspect an access token issued as the result of the Client Credentials Grant. OR Inspect an access token issue Read retrieveActionWithId Retrieves a single action log (the log of a user action that was taken on a user previously) for the given Id. Read retrieveAPIKeyWithId Retrieves an authentication API key for the given Id. Read retrieveApplication Retrieves all the applications that are currently inactive. OR Retrieves the application for the given Id or a Read retrieveApplicationWithId Retrieves the application for the given Id or all the applications if the Id is null. Read retrieveAuditLogWithId Retrieves a single audit log for the given Id. Read retrieveConnectorWithId Retrieves the connector with the given Id. Read retrieveConsentWithId Retrieves the Consent for the given Id. Read retrieveDailyActiveReportWithId Retrieves the daily active user report between the two instants. If you specify an application Id, it will onl Read retrieveDeviceUserCode Retrieve a user_code that is part of an in-progress Device Authorization Grant. This API is useful if you wan Read retrieveDeviceValidate Validates the end-user provided user_code from the user-interaction of the Device Authorization Grant. If you Read retrieveEmailTemplate Retrieves the email template for the given Id. If you don Read retrieveEmailTemplatePreviewWithId Creates a preview of the email template provided in the request. This allows you to preview an email template Read retrieveEmailTemplateWithId Retrieves the email template for the given Id. If you don Read retrieveEntityGrantWithId Retrieves an Entity Grant for the given Entity and User/Entity. Read retrieveEntityTypeWithId Retrieves the Entity Type for the given Id. Read retrieveEntityWithId Retrieves the Entity for the given Id. Read retrieveEventLogWithId Retrieves a single event log for the given Id. Read retrieveFamiliesWithId Retrieves all the families that a user belongs to. Read retrieveFamilyMembersByFamilyIdWithId Retrieves all the members of a family by the unique Family Id. Read retrieveFormFieldWithId Retrieves the form field with the given Id. Read retrieveFormWithId Retrieves the form with the given Id. Read retrieveGroupWithId Retrieves the group for the given Id. Read retrieveIdentityProviderByTypeWithId Retrieves one or more identity provider for the given type. For types such as Google, Facebook, Twitter and Li Read retrieveIdentityProviderLink Retrieve all Identity Provider users (links) for the user. Specify the optional identityProviderId to retrieve Read retrieveIdentityProviderLookup Retrieves the identity provider for the given domain and tenantId. A 200 response code indicates the domain is Read retrieveIdentityProviderWithId Retrieves the identity provider for the given Id or all the identity providers if the Id is null. Read retrieveIPAccessControlListWithId Retrieves the IP Access Control List with the given Id. Read retrieveJsonWebKeySetWithId Returns public keys used by FusionAuth to cryptographically verify JWTs using the JSON Web Key format. Read retrieveJwtPublicKey Retrieves the Public Key configured for verifying the JSON Web Tokens (JWT) issued by the Login API by the App Read retrieveKeysWithId Retrieves all the keys. Read retrieveKeyWithId Retrieves the key for the given Id. Read retrieveLambdasByTypeWithId Retrieves all the lambdas for the provided type. Read retrieveLambdaWithId Retrieves the lambda for the given Id. Read retrieveMessageTemplate Retrieves the message template for the given Id. If you don Read retrieveMessageTemplatePreviewWithId Creates a preview of the message template provided in the request, normalized to a given locale. Read retrieveMessageTemplateWithId Retrieves the message template for the given Id. If you don Read retrieveMessengerWithId Retrieves the messenger with the given Id. Read retrieveMonthlyActiveReportWithId Retrieves the monthly active user report between the two instants. If you specify an application Id, it will o Read retrieveOauthConfigurationWithId Retrieves the Oauth2 configuration for the application for the given Application Id. Read retrieveOAuthScopeWithId Retrieves a custom OAuth scope. Read retrieveOpenIdConfigurationWithId Returns the well known OpenID Configuration JSON document Read retrievePasswordValidationRulesWithId Retrieves the password validation rules for a specific tenant. This method requires a tenantId to be provided Read retrievePasswordValidationRulesWithTenantIdWithId Retrieves the password validation rules for a specific tenant. This API does not require an API key. Read retrievePendingChildrenWithId Retrieves all the children for the given parent email address. Read retrievePendingLinkWithId Retrieve a pending identity provider link. This is useful to validate a pending link and retrieve meta-data ab Read retrieveReactorMetricsWithId Retrieves the FusionAuth Reactor metrics. Read retrieveRefreshTokenByIdWithId Retrieves a single refresh token by unique Id. This is not the same thing as the string value of the refresh t Read retrieveRefreshTokensWithId Retrieves the refresh tokens that belong to the user with the given Id. Read retrieveRegistrationReportWithId Retrieves the registration report between the two instants. If you specify an application Id, it will only ret Read retrieveRegistrationWithId Retrieves the user registration for the user with the given Id and the given application Id. Read retrieveReportLogin Retrieves the login report between the two instants for a particular user by login Id, using specific loginIdT Read retrieveStatus Retrieves the FusionAuth system status using an API key. Using an API key will cause the response to include t Read retrieveSystemHealthWithId Retrieves the FusionAuth system health. This API will return 200 if the system is healthy, and 500 if the syst Read retrieveTenantWithId Retrieves the tenant for the given Id. Read retrieveThemeWithId Retrieves the theme for the given Id. Read retrieveTotalReportWithExcludesWithId Retrieves the totals report. This allows excluding applicationTotals from the report. An empty list will inclu Read retrieveTwoFactorRecoveryCodesWithId Retrieve two-factor recovery codes for a user. Read retrieveTwoFactorStatusWithId Retrieve a user Read retrieveTwoFactorStatusWithRequestWithId Retrieve a user Read retrieveUser Retrieves the user by a verificationId. The intended use of this API is to retrieve a user after the forgot pa Read retrieveUserAction Retrieves the user action for the given Id. If you pass in null for the Id, this will return all the user acti Read retrieveUserActioning Retrieves all the actions for the user with the given Id that are currently inactive. An inactive action means Read retrieveUserActionReason Retrieves the user action reason for the given Id. If you pass in null for the Id, this will return all the us Read retrieveUserActionReasonWithId Retrieves the user action reason for the given Id. If you pass in null for the Id, this will return all the us Read retrieveUserActionWithId Retrieves the user action for the given Id. If you pass in null for the Id, this will return all the user acti Read retrieveUserChangePassword Check to see if the user must obtain a Trust Request Id in order to complete a change password request. When a Read retrieveUserChangePasswordWithId Check to see if the user must obtain a Trust Token Id in order to complete a change password request. When a u Read retrieveUserCommentsWithId Retrieves all the comments for the user with the given Id. Read retrieveUserConsentsWithId Retrieves all the consents for a User. Read retrieveUserConsentWithId Retrieve a single User consent by Id. Read retrieveUserInfoFromAccessTokenWithId Call the UserInfo endpoint to retrieve User Claims from the access token issued by FusionAuth. Read retrieveUserRecentLogin Retrieves the last number of login records for a user. OR Retrieves the last number of login records. Read retrieveUserWithId Retrieves the user for the given Id. Read retrieveVersionWithId Retrieves the FusionAuth version string. Read retrieveWebAuthnCredentialsForUserWithId Retrieves all WebAuthn credentials for the given user. Read retrieveWebAuthnCredentialWithId Retrieves the WebAuthn credential for the given Id. Read retrieveWebhook Retrieves the webhook for the given Id. If you pass in null for the Id, this will return all the webhooks. Read retrieveWebhookAttemptLogWithId Retrieves a single webhook attempt log for the given Id. Read retrieveWebhookEventLogWithId Retrieves a single webhook event log for the given Id. Read retrieveWebhookWithId Retrieves the webhook for the given Id. If you pass in null for the Id, this will return all the webhooks. Read searchApplicationsWithId Searches applications with the specified criteria and pagination. Read searchAuditLogsWithId Searches the audit logs with the specified criteria and pagination. Read searchConsentsWithId Searches consents with the specified criteria and pagination. Read searchEmailTemplatesWithId Searches email templates with the specified criteria and pagination. Read searchEntitiesByIdsWithId Retrieves the entities for the given Ids. If any Id is invalid, it is ignored. Read searchEntitiesWithId Searches entities with the specified criteria and pagination. Read searchEntityGrantsWithId Searches Entity Grants with the specified criteria and pagination. Read searchEntityTypesWithId Searches the entity types with the specified criteria and pagination. Read searchEventLogsWithId Searches the event logs with the specified criteria and pagination. Read searchGroupMembersWithId Searches group members with the specified criteria and pagination. Read searchGroupsWithId Searches groups with the specified criteria and pagination. Read searchIdentityProvidersWithId Searches identity providers with the specified criteria and pagination. Read searchIPAccessControlListsWithId Searches the IP Access Control Lists with the specified criteria and pagination. Read searchKeysWithId Searches keys with the specified criteria and pagination. Read searchLambdasWithId Searches lambdas with the specified criteria and pagination. Read searchLoginRecordsWithId Searches the login records with the specified criteria and pagination. Read searchTenantsWithId Searches tenants with the specified criteria and pagination. Read searchThemesWithId Searches themes with the specified criteria and pagination. Read searchUserCommentsWithId Searches user comments with the specified criteria and pagination. Read searchUsersByIdsWithId Retrieves the users for the given Ids. If any Id is invalid, it is ignored. Read searchUsersByQueryWithId Retrieves the users for the given search criteria and pagination. Read searchWebhookEventLogsWithId Searches the webhook event logs with the specified criteria and pagination. Read searchWebhooksWithId Searches webhooks with the specified criteria and pagination. Read validateJWTWithId Validates the provided JWT (encoded JWT string) to ensure the token is valid. A valid access token is properly
EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

UnClick 1658 tools
adminautomation
Nodebench 824 tools
adminautomation
Yaver 812 tools
adminautomation
Binance MCP Server 734 tools
adminautomation
Crow 587 tools
adminautomation
Fortimanager 584 tools
adminautomation
TinyFn 572 tools
adminautomation
Mcp 571 tools
adminautomation
FAQ

Questions about Fusionauth

Can an AI agent delete data through the Fusionauth MCP server? +

Yes. The Fusionauth server exposes 39 destructive tools including deleteAPIKeyWithId, deleteApplicationRoleWithId, deleteApplicationWithId. These permanently remove resources with no undo. PolicyLayer blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Fusionauth? +

The Fusionauth server has 149 write tools including actionUserWithId, activateReactorWithId, cancelActionWithId. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Fusionauth.

How many tools does the Fusionauth MCP server expose? +

314 tools across 4 categories: Destructive, Execute, Read, Write. 106 are read-only. 208 can modify, create, or delete data.

How do I enforce a policy on Fusionauth? +

Register the Fusionauth MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Fusionauth tool call.

Deterministic rules across all 314 Fusionauth tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON FUSIONAUTH →

Instant setup, no code required.

314 Fusionauth tools catalogued and risk-classified — across an index of 46,500+ MCP servers.

// WHERE THIS COMES FROM

These policies come from Fusionauth's registry record.

The record behind this page: verified identity, auth posture, risk grade, every tool classified, recommended policy — re-checked continuously.

Teams ship this data inside their own products. See what a licence covers →

// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.