Tako MCP
GitHub★ — Get started
Enterprise MCP Server for Oktav1.5.0-beta

TAKO MCP Autonomous Identity Context for LLMs.

Built on Anthropic's Code Execution Pattern

Stop filling your context window with raw JSON. Tako MCP autonomously reasons through your Okta environment and executes server-side code to deliver only the results that matter.

  • Dual-Mode: STDIO & HTTP Transports
  • 90% Token Reduction via Code Execution
  • Zero Result Limits for Thousands of Entities
Deploy on GitHub ↗ Explore Architecture
STDIO + HTTP · Zero context bloat
Tako MCP in Claude DesktopWatch the agent process thousands of users server-side without context window limitations.
Core Logic

Deferred Tool Discovery.

Tako MCP executes server-side code instead of streaming raw tool data, preserving your context window for complex reasoning.

Traditional MCP

Raw Data to LLM

  1. User asks “Find users without MFA.”
  2. Server streams 5,000 users as raw JSON.
  3. Context window exceeded. Results truncated.
Tako Deferred Flow

Code to Sandbox

  1. LLM receives 3 sample rows + API schema.
  2. LLM writes Python analysis script [okta_audit.py].
  3. Sandbox executes script. Returns 100% of data via CSV.
Architectural Advantages

90% less tokens. No result limits.

  • Only sample data and metadata go to the LLM, keeping costs low and speed high.
  • Process 10,000+ entities without hitting token limits or truncation errors.
Secure Sandbox

Isolated and read-only.

Code execution is isolated in an AST-based sandbox. Read-only by design.

Configuration

Two Powerful Operating Modes.

Choose the interaction pattern that fits your workflow—from standard tool access to fully autonomous agent logic.

Default · MCP Mode

Direct tools for IDE assistants.

  • Claude & Cursor: Direct tool access for standard IDE assistants.
  • Full Toolset: All 20+ Okta tools loaded into context immediately.
  • Sample Arrays: Returns metadata and sample results directly to LLM.
Autonomous · Agent Mode

Progressive discovery at full scale.

  • Progressive: Lower initial tokens; tools discovered as needed.
  • Full Scale: Processes thousands of rows via server-side code.
  • Agent Frameworks: LangGraph, LlamaIndex, and complex autonomous loops.
Connectivity

Works Everywhere.

Native STDIO for local desktop environments and HTTP/SSE for remote enterprise deployments.

STDIO Transport

Desktop & IDEs

Claude Desktop, Cursor AI, VS Code, Zed, and Windsurf.

Agent Orchestration

Agent Frameworks

LangGraph, LlamaIndex, Goose, and custom autonomous agents.

HTTP / SSE

Enterprise Gateways

Obot.ai, Smithery.ai, Lasso Security, and custom clients.

Core Capabilities

Built for the Enterprise.

Production-ready MCP server with enterprise-grade security, flexible transport options, and deterministic execution.

Mode Switch

Dual-Mode Operation

Switch between standard MCP mode for direct tool access or autonomous agent mode for complex logic execution.

Net Transport

Flexible Transports

Native STDIO for desktop clients like Claude or Cursor, and HTTP/SSE for remote enterprise team deployments.

Security

Enterprise Auth

OAuth2 with Private Key JWT (RFC 7523) for production or simple API tokens for development.

Data I/O

CSV Export

Automatic large-dataset export to files to reduce token costs and keep context windows clean.

Compliance · Open Standards

Built on interoperable foundations.

  • Elastic License 2.0
  • MCP Specification
  • Production Ready
  • OAuth2 RFC 7523
Core Protection

Enterprise Security Sandbox

AST-based sandbox with multi-layer protection designed for safe code execution in production environments.

  • Pattern blocking: Dangerous operations and OS-level calls are blocked at the Abstract Syntax Tree level before execution.
  • Import control: Pre-injected modules only. No arbitrary third-party imports or unauthorized library access allowed.
  • Function whitelist: Strict enforcement of safe, built-in functions. Isolated logic ensures zero data exfiltration.
  • HTTP restriction: Read-only GET request enforcement ensures your identity data is analyzed but never modified.
Pricing

Simple, transparent pricing.

Start free with full read access. Upgrade when you need write operations and enterprise controls.

Open Source
$0 Forever

For individuals & small teams exploring Okta automation.

  • Full read access to Okta APIs
  • Users, Groups, Apps, Policies, Logs
  • Basic MCP & Agent Mode
  • CSV export & OAuth2 auth
Get Started Free ↗
Enterprise
Custom Coming Soon

For organizations at scale needing write operations and advanced controls.

  • Write operations & approvals
  • Multi-tenant support & RBAC
  • Custom tool builder
  • SSO & audit log streaming
  • Priority support & SLA
Contact Sales ↗
Onboarding

Ready in 5 Minutes.

Three simple steps to start querying Okta with natural language using Tako MCP.

  1. STEP_01

    Clone Repository

    Download the source code. Use Docker for quick setup or Python for more control.

    git clone github.com/fctr-id/fctr-okta-mcp-server
  2. STEP_02

    Configure Access

    Add your Okta org URL and choose API Token or OAuth2 for authentication.

    OKTA_CLIENT_ORGURL=https://your-org.okta.com
  3. STEP_03

    Connect & Query

    Add the MCP server to Claude Desktop or Cursor and start querying.

    “Find all users without MFA” ✓

FAQ

Commonly asked questions.

Details for evaluating, deploying, and operating Tako MCP Server.

Is this affiliated with Okta?

No, this is an independent open-source project built by Fctr Identity. We are not affiliated with Okta, Inc.

Is my Okta data safe?

Yes. The server is read-only by default, runs in a sandboxed environment, and all code is validated before execution. Your credentials never leave your infrastructure.

Which MCP clients are supported?

Any MCP-compatible client: Claude Desktop, VS Code, Cursor, Zed, and agent frameworks like LangGraph and LlamaIndex.

Can I self-host this?

Absolutely. The community edition is fully self-hosted. Run it on your laptop, in Docker, or on your own servers.

What Okta editions are supported?

Works with all Okta editions: Workforce Identity, Customer Identity (Auth0), and free Developer accounts.

What is MCP and how does Tako MCP Server work?

Model Context Protocol (MCP) is an open standard that connects AI assistants to external tools and data sources. Tako MCP Server implements Anthropic's Code Execution with MCP pattern (deferred tool discovery), allowing your AI to discover Okta APIs progressively and generate Python code for querying your environment.

What authentication methods are supported?

Tako MCP Server supports both API Token (simple setup) and OAuth2 with Private Key JWT (recommended for production). OAuth2 provides scoped permissions and better security for enterprise deployments.

Do I need Docker to run Tako MCP Server?

No, Docker is optional. You can run Tako MCP Server locally with Python (we recommend uv for package management), but Docker provides the fastest setup without managing dependencies.

What's the difference between Basic Mode and Agent Mode?

Basic Mode exposes 20+ Okta tools directly to the AI, using more context upfront. Agent Mode (also called deferred tool discovery) uses meta-tools for progressive discovery, saving tokens and enabling autonomous workflows. Agent Mode is ideal for complex queries and agent frameworks like LangGraph.

How does Tako MCP Server handle rate limits?

Tako MCP Server includes configurable concurrent request limits based on your Okta plan (Integrator, One App, Enterprise, or Workforce Identity). The server monitors rate limits and provides warnings if limits are exceeded.

Can Tako MCP Server modify my Okta data?

The open-source community edition is read-only by design. Write operations, approval workflows, and role-based access control are available in the upcoming Enterprise Edition.

Get Started

Start querying Okta with AI.

Free, open source, self-hosted.
Deploy in 5 minutes and eliminate the context window limits of traditional MCP servers.

MIT Licensed · Production Ready · Community Support
Get Started Free ↗ Documentation