@samik081/mcp-authentik 0.1.0

package/dist/tools/applications.js

@@ -0,0 +1,324 @@
+import { z } from 'zod';
+import { registerTool } from '../core/tools.js';
+export function registerApplicationTools(server, client, config) {
+    // 1. List applications
+    registerTool(server, config, {
+        name: 'authentik_apps_list',
+        description: 'List applications with optional filters for name, slug, group, search, and more.',
+        accessTier: 'read-only',
+        category: 'core',
+        inputSchema: {
+            name: z.string().optional().describe('Filter by exact application name'),
+            slug: z.string().optional().describe('Filter by exact slug'),
+            group: z.string().optional().describe('Filter by application group'),
+            search: z.string().optional().describe('Search across application fields'),
+            superuser_full_list: z.boolean().optional().describe('When true, return all apps regardless of policy'),
+            for_user: z.number().optional().describe('Filter applications accessible by this user ID'),
+            ordering: z.string().optional().describe('Field to order by (prefix with - for descending)'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreApplicationsList({
+                name: args.name,
+                slug: args.slug,
+                group: args.group,
+                search: args.search,
+                superuserFullList: args.superuser_full_list,
+                forUser: args.for_user,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 2. Get application
+    registerTool(server, config, {
+        name: 'authentik_apps_get',
+        description: 'Get a single application by its slug.',
+        accessTier: 'read-only',
+        category: 'core',
+        inputSchema: {
+            slug: z.string().describe('Application slug'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreApplicationsRetrieve({
+                slug: args.slug,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 3. Create application
+    registerTool(server, config, {
+        name: 'authentik_apps_create',
+        description: 'Create a new application with name, slug, and optional provider, group, and metadata.',
+        accessTier: 'full',
+        category: 'core',
+        inputSchema: {
+            name: z.string().describe('Application display name (required)'),
+            slug: z.string().describe('Internal application slug for URLs (required)'),
+            provider: z.number().optional().describe('Provider ID to associate'),
+            group: z.string().optional().describe('Application group name'),
+            meta_launch_url: z.string().optional().describe('Launch URL for the application'),
+            meta_description: z.string().optional().describe('Application description'),
+            meta_publisher: z.string().optional().describe('Application publisher'),
+            policy_engine_mode: z.enum(['all', 'any']).optional().describe('Policy engine mode: "all" (all policies must pass) or "any" (any policy must pass)'),
+            open_in_new_tab: z.boolean().optional().describe('Open launch URL in a new browser tab'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreApplicationsCreate({
+                applicationRequest: {
+                    name: args.name,
+                    slug: args.slug,
+                    provider: args.provider,
+                    group: args.group,
+                    metaLaunchUrl: args.meta_launch_url,
+                    metaDescription: args.meta_description,
+                    metaPublisher: args.meta_publisher,
+                    policyEngineMode: args.policy_engine_mode,
+                    openInNewTab: args.open_in_new_tab,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 4. Update application
+    registerTool(server, config, {
+        name: 'authentik_apps_update',
+        description: 'Update an existing application. Only provided fields are modified (partial update).',
+        accessTier: 'full',
+        category: 'core',
+        inputSchema: {
+            slug: z.string().describe('Application slug (required, used as identifier)'),
+            name: z.string().optional().describe('New display name'),
+            provider: z.number().optional().describe('New provider ID'),
+            group: z.string().optional().describe('New application group name'),
+            meta_launch_url: z.string().optional().describe('New launch URL'),
+            meta_description: z.string().optional().describe('New description'),
+            meta_publisher: z.string().optional().describe('New publisher'),
+            policy_engine_mode: z.enum(['all', 'any']).optional().describe('Policy engine mode'),
+            open_in_new_tab: z.boolean().optional().describe('Open launch URL in a new browser tab'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreApplicationsPartialUpdate({
+                slug: args.slug,
+                patchedApplicationRequest: {
+                    name: args.name,
+                    provider: args.provider,
+                    group: args.group,
+                    metaLaunchUrl: args.meta_launch_url,
+                    metaDescription: args.meta_description,
+                    metaPublisher: args.meta_publisher,
+                    policyEngineMode: args.policy_engine_mode,
+                    openInNewTab: args.open_in_new_tab,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 4b. Set application icon via URL
+    registerTool(server, config, {
+        name: 'authentik_apps_set_icon_url',
+        description: 'Set an application icon from a URL. Provide a URL pointing to an image to use as the application icon, or set clear to true to remove the current icon.',
+        accessTier: 'full',
+        category: 'core',
+        inputSchema: {
+            slug: z.string().describe('Application slug (required)'),
+            url: z.string().optional().describe('URL pointing to the icon image'),
+            clear: z.boolean().optional().describe('Set to true to clear/remove the current icon'),
+        },
+        handler: async (args) => {
+            const slug = args.slug;
+            if (args.clear) {
+                await client.coreApi.coreApplicationsSetIconCreate({ slug, clear: true });
+                return `Icon cleared for application "${slug}".`;
+            }
+            if (!args.url) {
+                throw new Error('Either "url" or "clear: true" must be provided.');
+            }
+            await client.coreApi.coreApplicationsSetIconUrlCreate({
+                slug,
+                filePathRequest: { url: args.url },
+            });
+            return `Icon set for application "${slug}" from URL: ${args.url}`;
+        },
+    });
+    // 5. Delete application
+    registerTool(server, config, {
+        name: 'authentik_apps_delete',
+        description: 'Delete an application by its slug. This action is irreversible.',
+        accessTier: 'full',
+        category: 'core',
+        tags: ['destructive'],
+        inputSchema: {
+            slug: z.string().describe('Application slug to delete'),
+        },
+        handler: async (args) => {
+            await client.coreApi.coreApplicationsDestroy({ slug: args.slug });
+            return `Application "${args.slug}" deleted successfully.`;
+        },
+    });
+    // 6. Check access
+    registerTool(server, config, {
+        name: 'authentik_apps_check_access',
+        description: 'Check whether a specific user has access to an application.',
+        accessTier: 'read-only',
+        category: 'core',
+        inputSchema: {
+            slug: z.string().describe('Application slug'),
+            for_user: z.number().optional().describe('User ID to check access for'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreApplicationsCheckAccessRetrieve({
+                slug: args.slug,
+                forUser: args.for_user,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 7. Transactional application update (create app + provider atomically)
+    registerTool(server, config, {
+        name: 'authentik_apps_update_transactional',
+        description: 'Create or update an application and its provider in a single atomic transaction. Useful for setting up an application with a new provider.',
+        accessTier: 'full',
+        category: 'core',
+        inputSchema: {
+            app: z.object({
+                name: z.string().describe('Application display name'),
+                slug: z.string().describe('Application slug'),
+                provider: z.number().optional().describe('Existing provider ID'),
+                group: z.string().optional().describe('Application group'),
+                meta_launch_url: z.string().optional().describe('Launch URL'),
+                meta_description: z.string().optional().describe('Description'),
+                meta_publisher: z.string().optional().describe('Publisher'),
+            }).describe('Application configuration'),
+            provider_model: z.string().describe('Provider model identifier (e.g. "authentik_providers_oauth2.oauth2provider")'),
+            provider: z.record(z.unknown()).describe('Provider configuration object. IMPORTANT: Use camelCase field names (e.g. authorizationFlow, invalidationFlow, propertyMappings, clientType). Must include a providerModel discriminator field matching provider_model value. For OAuth2, redirectUris must be an array of {matchingMode: "strict", url: "..."} objects.'),
+        },
+        handler: async (args) => {
+            const app = args.app;
+            const result = await client.coreApi.coreTransactionalApplicationsUpdate({
+                transactionApplicationRequest: {
+                    app: {
+                        name: app.name,
+                        slug: app.slug,
+                        provider: app.provider,
+                        group: app.group,
+                        metaLaunchUrl: app.meta_launch_url,
+                        metaDescription: app.meta_description,
+                        metaPublisher: app.meta_publisher,
+                    },
+                    providerModel: args.provider_model,
+                    provider: args.provider,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 8. List application entitlements
+    registerTool(server, config, {
+        name: 'authentik_app_entitlements_list',
+        description: 'List application entitlements with optional filters.',
+        accessTier: 'read-only',
+        category: 'core',
+        inputSchema: {
+            app: z.string().optional().describe('Filter by application slug'),
+            name: z.string().optional().describe('Filter by entitlement name'),
+            ordering: z.string().optional().describe('Field to order by'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+            search: z.string().optional().describe('Search across entitlement fields'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreApplicationEntitlementsList({
+                app: args.app,
+                name: args.name,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+                search: args.search,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 9. Get application entitlement
+    registerTool(server, config, {
+        name: 'authentik_app_entitlements_get',
+        description: 'Get a single application entitlement by its UUID.',
+        accessTier: 'read-only',
+        category: 'core',
+        inputSchema: {
+            pbm_uuid: z.string().describe('Entitlement UUID'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreApplicationEntitlementsRetrieve({
+                pbmUuid: args.pbm_uuid,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 10. Create application entitlement
+    registerTool(server, config, {
+        name: 'authentik_app_entitlements_create',
+        description: 'Create a new application entitlement.',
+        accessTier: 'full',
+        category: 'core',
+        inputSchema: {
+            name: z.string().describe('Entitlement name (required)'),
+            app: z.string().describe('Application slug or UUID (required)'),
+            attributes: z.record(z.unknown()).optional().describe('Custom attributes'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreApplicationEntitlementsCreate({
+                applicationEntitlementRequest: {
+                    name: args.name,
+                    app: args.app,
+                    attributes: args.attributes,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 11. Update application entitlement
+    registerTool(server, config, {
+        name: 'authentik_app_entitlements_update',
+        description: 'Update an existing application entitlement. Only provided fields are modified (partial update).',
+        accessTier: 'full',
+        category: 'core',
+        inputSchema: {
+            pbm_uuid: z.string().describe('Entitlement UUID (required)'),
+            name: z.string().optional().describe('New entitlement name'),
+            app: z.string().optional().describe('New application slug or UUID'),
+            attributes: z.record(z.unknown()).optional().describe('New custom attributes'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreApplicationEntitlementsPartialUpdate({
+                pbmUuid: args.pbm_uuid,
+                patchedApplicationEntitlementRequest: {
+                    name: args.name,
+                    app: args.app,
+                    attributes: args.attributes,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 12. Delete application entitlement
+    registerTool(server, config, {
+        name: 'authentik_app_entitlements_delete',
+        description: 'Delete an application entitlement by its UUID. This action is irreversible.',
+        accessTier: 'full',
+        category: 'core',
+        tags: ['destructive'],
+        inputSchema: {
+            pbm_uuid: z.string().describe('Entitlement UUID to delete'),
+        },
+        handler: async (args) => {
+            await client.coreApi.coreApplicationEntitlementsDestroy({
+                pbmUuid: args.pbm_uuid,
+            });
+            return `Application entitlement ${args.pbm_uuid} deleted successfully.`;
+        },
+    });
+}

package/dist/tools/authenticators.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthentikClient } from '../core/client.js';
+import type { AppConfig } from '../types/index.js';
+export declare function registerAuthenticatorTools(server: McpServer, client: AuthentikClient, config: AppConfig): void;

package/dist/tools/authenticators.js

@@ -0,0 +1,136 @@
+import { z } from 'zod';
+import { registerTool } from '../core/tools.js';
+// SDK method name prefixes for each authenticator device type
+const DEVICE_TYPES = ['duo', 'email', 'endpoint', 'sms', 'static', 'totp', 'webauthn'];
+// SDK method name prefixes: authenticatorsAdmin{Prefix}List, etc.
+const ADMIN_PREFIX = {
+    duo: 'AdminDuo',
+    email: 'AdminEmail',
+    endpoint: 'AdminEndpoint',
+    sms: 'AdminSms',
+    static: 'AdminStatic',
+    totp: 'AdminTotp',
+    webauthn: 'AdminWebauthn',
+};
+// User-facing method prefixes: authenticators{Prefix}List
+const USER_PREFIX = {
+    duo: 'Duo',
+    email: 'Email',
+    endpoint: 'Endpoint',
+    sms: 'Sms',
+    static: 'Static',
+    totp: 'Totp',
+    webauthn: 'Webauthn',
+};
+// Endpoint uses uuid (string), all others use id (number)
+function isEndpointType(deviceType) {
+    return deviceType === 'endpoint';
+}
+export function registerAuthenticatorTools(server, client, config) {
+    // 1. List all authenticator devices (cross-type)
+    registerTool(server, config, {
+        name: 'authentik_authenticators_list',
+        description: 'List all authenticator devices across all types for the current user.',
+        accessTier: 'read-only',
+        category: 'authenticators',
+        handler: async () => {
+            const result = await client.authenticatorsApi.authenticatorsAllList();
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 2. Admin list devices by type
+    registerTool(server, config, {
+        name: 'authentik_authenticators_admin_by_type_list',
+        description: 'List authenticator devices of a specific type (admin view). Supports: duo, email, endpoint, sms, static, totp, webauthn.',
+        accessTier: 'read-only',
+        category: 'authenticators',
+        inputSchema: {
+            device_type: z.enum(DEVICE_TYPES).describe('Authenticator device type'),
+            name: z.string().optional().describe('Filter by device name'),
+            ordering: z.string().optional().describe('Field to order by'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const prefix = ADMIN_PREFIX[args.device_type];
+            const method = `authenticators${prefix}List`;
+            const fn = client.authenticatorsApi[method];
+            const result = await fn.call(client.authenticatorsApi, {
+                name: args.name,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 3. Admin get device by type
+    registerTool(server, config, {
+        name: 'authentik_authenticators_admin_by_type_get',
+        description: 'Get a single authenticator device by type and ID (admin view). Use numeric id for most types, uuid string for endpoint type.',
+        accessTier: 'read-only',
+        category: 'authenticators',
+        inputSchema: {
+            device_type: z.enum(DEVICE_TYPES).describe('Authenticator device type'),
+            id: z.union([z.number(), z.string()]).describe('Device ID (number for most types, UUID string for endpoint)'),
+        },
+        handler: async (args) => {
+            const prefix = ADMIN_PREFIX[args.device_type];
+            const method = `authenticators${prefix}Retrieve`;
+            const fn = client.authenticatorsApi[method];
+            const idParam = isEndpointType(args.device_type)
+                ? { uuid: args.id }
+                : { id: args.id };
+            const result = await fn.call(client.authenticatorsApi, idParam);
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 4. Admin delete device by type
+    registerTool(server, config, {
+        name: 'authentik_authenticators_admin_by_type_delete',
+        description: 'Delete an authenticator device by type and ID (admin view). This action is irreversible.',
+        accessTier: 'full',
+        category: 'authenticators',
+        tags: ['destructive'],
+        inputSchema: {
+            device_type: z.enum(DEVICE_TYPES).describe('Authenticator device type'),
+            id: z.union([z.number(), z.string()]).describe('Device ID (number for most types, UUID string for endpoint)'),
+        },
+        handler: async (args) => {
+            const prefix = ADMIN_PREFIX[args.device_type];
+            const method = `authenticators${prefix}Destroy`;
+            const fn = client.authenticatorsApi[method];
+            const idParam = isEndpointType(args.device_type)
+                ? { uuid: args.id }
+                : { id: args.id };
+            await fn.call(client.authenticatorsApi, idParam);
+            return `Authenticator device (${args.device_type}) ${args.id} deleted successfully.`;
+        },
+    });
+    // 5. User list devices by type
+    registerTool(server, config, {
+        name: 'authentik_authenticators_user_by_type_list',
+        description: 'List authenticator devices of a specific type for the current user. Supports: duo, email, endpoint, sms, static, totp, webauthn.',
+        accessTier: 'read-only',
+        category: 'authenticators',
+        inputSchema: {
+            device_type: z.enum(DEVICE_TYPES).describe('Authenticator device type'),
+            name: z.string().optional().describe('Filter by device name'),
+            ordering: z.string().optional().describe('Field to order by'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const prefix = USER_PREFIX[args.device_type];
+            const method = `authenticators${prefix}List`;
+            const fn = client.authenticatorsApi[method];
+            const result = await fn.call(client.authenticatorsApi, {
+                name: args.name,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+}

package/dist/tools/brands.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthentikClient } from '../core/client.js';
+import type { AppConfig } from '../types/index.js';
+export declare function registerBrandTools(server: McpServer, client: AuthentikClient, config: AppConfig): void;

package/dist/tools/brands.js

@@ -0,0 +1,164 @@
+import { z } from 'zod';
+import { registerTool } from '../core/tools.js';
+export function registerBrandTools(server, client, config) {
+    // 1. List brands
+    registerTool(server, config, {
+        name: 'authentik_brands_list',
+        description: 'List brands with optional filters for UUID, domain, and search.',
+        accessTier: 'read-only',
+        category: 'core',
+        inputSchema: {
+            brand_uuid: z.string().optional().describe('Filter by brand UUID'),
+            domain: z.string().optional().describe('Filter by domain'),
+            search: z.string().optional().describe('Search across brand fields'),
+            ordering: z.string().optional().describe('Field to order by (prefix with - for descending)'),
+            page: z.number().optional().describe('Page number'),
+            page_size: z.number().optional().describe('Number of results per page'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreBrandsList({
+                brandUuid: args.brand_uuid,
+                domain: args.domain,
+                search: args.search,
+                ordering: args.ordering,
+                page: args.page,
+                pageSize: args.page_size,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 2. Get brand
+    registerTool(server, config, {
+        name: 'authentik_brands_get',
+        description: 'Get a single brand by its UUID.',
+        accessTier: 'read-only',
+        category: 'core',
+        inputSchema: {
+            brand_uuid: z.string().describe('Brand UUID'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreBrandsRetrieve({
+                brandUuid: args.brand_uuid,
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 3. Create brand
+    registerTool(server, config, {
+        name: 'authentik_brands_create',
+        description: 'Create a new brand with domain, branding settings, flow assignments, and optional attributes.',
+        accessTier: 'full',
+        category: 'core',
+        inputSchema: {
+            domain: z.string().describe('Domain that activates this brand (required). Can be a superset, e.g. "a.b" matches "aa.b" and "ba.b".'),
+            is_default: z.boolean().optional().describe('Whether this is the default brand'),
+            branding_title: z.string().optional().describe('Branding title displayed in the UI'),
+            branding_logo: z.string().optional().describe('URL or path to the branding logo'),
+            branding_favicon: z.string().optional().describe('URL or path to the favicon'),
+            flow_authentication: z.string().optional().describe('Flow UUID for authentication'),
+            flow_invalidation: z.string().optional().describe('Flow UUID for session invalidation'),
+            flow_recovery: z.string().optional().describe('Flow UUID for account recovery'),
+            flow_unenrollment: z.string().optional().describe('Flow UUID for unenrollment'),
+            flow_user_settings: z.string().optional().describe('Flow UUID for user settings'),
+            flow_device_code: z.string().optional().describe('Flow UUID for device code authentication'),
+            default_application: z.string().optional().describe('Application slug to redirect external users to after authentication'),
+            web_certificate: z.string().optional().describe('Web certificate UUID for the authentik core webserver'),
+            attributes: z.record(z.unknown()).optional().describe('Custom attributes key-value pairs'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreBrandsCreate({
+                brandRequest: {
+                    domain: args.domain,
+                    _default: args.is_default,
+                    brandingTitle: args.branding_title,
+                    brandingLogo: args.branding_logo,
+                    brandingFavicon: args.branding_favicon,
+                    flowAuthentication: args.flow_authentication,
+                    flowInvalidation: args.flow_invalidation,
+                    flowRecovery: args.flow_recovery,
+                    flowUnenrollment: args.flow_unenrollment,
+                    flowUserSettings: args.flow_user_settings,
+                    flowDeviceCode: args.flow_device_code,
+                    defaultApplication: args.default_application,
+                    webCertificate: args.web_certificate,
+                    attributes: args.attributes,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 4. Update brand
+    registerTool(server, config, {
+        name: 'authentik_brands_update',
+        description: 'Update an existing brand. Only provided fields are modified (partial update).',
+        accessTier: 'full',
+        category: 'core',
+        inputSchema: {
+            brand_uuid: z.string().describe('Brand UUID (required)'),
+            domain: z.string().optional().describe('New domain'),
+            is_default: z.boolean().optional().describe('Whether this is the default brand'),
+            branding_title: z.string().optional().describe('New branding title'),
+            branding_logo: z.string().optional().describe('New logo URL or path'),
+            branding_favicon: z.string().optional().describe('New favicon URL or path'),
+            flow_authentication: z.string().optional().describe('Flow UUID for authentication'),
+            flow_invalidation: z.string().optional().describe('Flow UUID for session invalidation'),
+            flow_recovery: z.string().optional().describe('Flow UUID for account recovery'),
+            flow_unenrollment: z.string().optional().describe('Flow UUID for unenrollment'),
+            flow_user_settings: z.string().optional().describe('Flow UUID for user settings'),
+            flow_device_code: z.string().optional().describe('Flow UUID for device code authentication'),
+            default_application: z.string().optional().describe('Application slug'),
+            web_certificate: z.string().optional().describe('Web certificate UUID'),
+            attributes: z.record(z.unknown()).optional().describe('Custom attributes key-value pairs'),
+        },
+        handler: async (args) => {
+            const result = await client.coreApi.coreBrandsPartialUpdate({
+                brandUuid: args.brand_uuid,
+                patchedBrandRequest: {
+                    domain: args.domain,
+                    _default: args.is_default,
+                    brandingTitle: args.branding_title,
+                    brandingLogo: args.branding_logo,
+                    brandingFavicon: args.branding_favicon,
+                    flowAuthentication: args.flow_authentication,
+                    flowInvalidation: args.flow_invalidation,
+                    flowRecovery: args.flow_recovery,
+                    flowUnenrollment: args.flow_unenrollment,
+                    flowUserSettings: args.flow_user_settings,
+                    flowDeviceCode: args.flow_device_code,
+                    defaultApplication: args.default_application,
+                    webCertificate: args.web_certificate,
+                    attributes: args.attributes,
+                },
+            });
+            return JSON.stringify(result, null, 2);
+        },
+    });
+    // 5. Delete brand
+    registerTool(server, config, {
+        name: 'authentik_brands_delete',
+        description: 'Delete a brand by its UUID. This action is irreversible.',
+        accessTier: 'full',
+        category: 'core',
+        tags: ['destructive'],
+        inputSchema: {
+            brand_uuid: z.string().describe('Brand UUID to delete'),
+        },
+        handler: async (args) => {
+            await client.coreApi.coreBrandsDestroy({
+                brandUuid: args.brand_uuid,
+            });
+            return `Brand ${args.brand_uuid} deleted successfully.`;
+        },
+    });
+    // 6. Get current brand
+    registerTool(server, config, {
+        name: 'authentik_brands_current',
+        description: 'Get the brand configuration for the current domain.',
+        accessTier: 'read-only',
+        category: 'core',
+        handler: async () => {
+            const result = await client.coreApi.coreBrandsCurrentRetrieve();
+            return JSON.stringify(result, null, 2);
+        },
+    });
+}

package/dist/tools/crypto.d.ts

@@ -0,0 +1,4 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthentikClient } from '../core/client.js';
+import type { AppConfig } from '../types/index.js';
+export declare function registerCryptoTools(server: McpServer, client: AuthentikClient, config: AppConfig): void;