Using Oauth to Login to the Axonius MCP Server

Use OAuth to connect the Axonius MCP Server to your AI client with your personal Axonius credentials, including SSO. When connected, your AI tools can query your full Axonius asset model in natural language — across devices, users, applications, cloud workloads, networks, and exposures — without switching to the Axonius interface.

The MCP operates within your existing role and data scope. If you can't see certain data in Axonius, neither can the MCP. All MCP activity is logged separately from actions you take directly, so your team keeps a clear audit trail.

Prerequisites

• Your Axonius account must have a role with the permissions required for the operations you want the MCP to perform.
• Your AI client must support custom MCP connectors (for example, Claude).

Connecting with OAuth

1. In your AI client, add a new custom MCP connector.

2. When prompted for the connector configuration, enter the Axonius-provided JSON for your instance:

   JSON

   {
     "url": "https://{your_instance_url}.axonius.com/mcp"
   }

   Replace {your_instance_url} with your Axonius instance URL.

3. Your Axonius instance login page opens. Sign in with your Axonius credentials. SSO is supported.

4. The MCP Permissions page opens. Select the operations you want to allow the MCP to perform on your behalf.

5. Click Allow. Your AI client reconnects with the MCP access token applied.

MCP Permissions Page

The MCP Permissions page controls what the MCP can do using your Axonius account. The MCP can only access data and perform operations that your role permits — if your role doesn't allow an operation, the MCP can't perform it either.

Select the categories of operations to allow, then click Allow to complete the connection.

Data Access and Scope

The MCP accesses only the data your Axonius account is scoped to. If your account uses a data scope, the MCP operates within that same scope. Visiting data scopes is not supported for MCP connections.

Token Expiration

The MCP access token expires after 24 hours. When the token expires, reconnect the MCP connector in your AI client to generate a new token.

Activity Logs

Axonius activity logs identify whether an action was performed by you directly or by the MCP on your behalf. To review MCP activity, go to System Settings > Activity Log and filter by source.

Using the MCP Server

After connecting, your AI client can perform read-only operations against your Axonius environment. The following are some examples: