# @atlasent/mcp-server AtlaSent stops risky changes to production unless someone approved them, and gives you proof for your auditor. MCP server for AI agents; works offline in local mode. - **Type:** MCP server - **Trust:** 85/100 (A), scored on the package rubric - **Verification:** verified (build provenance) - **Version:** 2.16.0 - **Author:** io.github.Atlasent - **License:** Apache-2.0 - **npm:** @atlasent/mcp-server - **Source:** https://github.com/Atlasent/atlasent-mcp-server - **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport) ## Trust 85/100 (A), scored on the package rubric - Publisher verified: no - Build provenance: verified attestation - npm trusted publishing (OIDC): yes - Install scripts: nothing suspicious found - Prompt-injection scan: not run - Obfuscation scan: not run - Evidence age: 6 days ## Security scan - **Status:** clean - **Scanned:** 2026-09-28T15:22:56.651Z - **Version scanned:** 2.16.0 - **CVEs:** none found by OSV at scan time ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `atlasent_list_scim_users` — List provisioned users via SCIM 2.0 (RFC 7643) for an organization. - `atlasent_get_scim_user` — Retrieve a single provisioned SCIM user by ID. - `atlasent_create_scim_user` — Provision a new user via SCIM 2.0. Adds the user to the AtlaSent - `atlasent_patch_scim_user` — Update a provisioned user using RFC 7644 SCIM PatchOp operations. - `atlasent_delete_scim_user` — Deprovision a SCIM user. Removes them from the AtlaSent directory. - `atlasent_list_scim_groups` — List provisioned groups via SCIM 2.0 for an organization. - `atlasent_get_siem_config` — Retrieve the SIEM export configuration for an organization. - `atlasent_upsert_siem_config` — Create or update the SIEM export configuration for an organization. - `atlasent_test_siem_delivery` — Send a test event to the configured SIEM destination and report the result. - `atlasent_list_evidence_exports` — List compliance evidence bundles for an organization. - `atlasent_get_evidence_export` — Retrieve a specific compliance evidence bundle by ID. - `atlasent_create_evidence_export` — Generate a compliance evidence bundle for audit regimes (SOC 2 Type II, - `evaluate` — Call this BEFORE performing any sensitive action. Returns a Decision: - `verify_permit` — Call this AFTER `evaluate` returns allow and BEFORE the protected native side effect. - `deploy_service` — Example protected tool. Every call is authorized AND its Permit is verified by AtlaSent - `atlasent_evaluate` — Evaluate an action against your published AtlaSent policies. - `atlasent_list_policies` — List all constraint bundles / policies for this organization. - `atlasent_get_policy` — Retrieve a single constraint bundle / policy by ID. - `atlasent_list_audit_events` — Retrieve recent evaluation events from the audit log. - `atlasent_explain_authority` — Explain why a principal currently has (or lacks) authority for a scope. - `atlasent_integrity_audit` — Audit the organization's authority graph for internal inconsistency and - `atlasent_create_policy` — Create a new constraint bundle for an action. - `atlasent_update_policy` — Update a constraint bundle — change rules, title, or publish/archive it. - `atlasent_delete_policy` — Permanently delete a constraint bundle. Prefer archiving over deleting. - `atlasent_revoke_permit` — Revoke a permit before it expires. The permit immediately becomes - `atlasent_list_permits` — List issued permit tokens for audit and monitoring. - `atlasent_get_permit` — Fetch one permit's record: status, actor, action, environment, issue/expiry/consume - `atlasent_check_permit` — Check whether a permit is still usable without consuming it. Returns - `atlasent_get_decision` — Fetch one authorization decision (execution evaluation) by id: the decision, - `atlasent_permit` — Manually issue a permit token for an action. Use for pre-authorized - `atlasent_verify_permit` — Verify a permit token with full binding inputs against the V1 endpoint. - `atlasent_await_approval` — Wait for a person to approve or reject a held action in the AtlaSent console. - `atlasent_record_execution_evaluation` — Record the outcome of an execution that was permitted by a prior evaluate - `atlasent_create_webhook` — Register a webhook URL to receive evaluation events. - `atlasent_delete_webhook` — Remove a registered webhook. - `atlasent_lookup_action` — Look up canonical action specifications from the Authorization Intelligence Library. - `atlasent_atlas_lookup` — Look up a canonical AtlaSent concept from the Knowledge Atlas — the compiled graph of the system's own - `atlasent_evaluate_many` — Evaluate up to 100 actions in a single request against your published - `atlasent_evaluate_stream` — Evaluate up to 100 actions via the streaming endpoint. The tool buffers - `atlasent_query` — Run a read-only GraphQL query against the AtlaSent V2 GraphQL endpoint. ## Install **Verdict: install** — No blocking findings and no open coverage gaps — safe to install as configured. **Config** (claude-code): ```json "{\n \"mcpServers\": {\n \"mcp-server\": {\n \"command\": \"npx\",\n \"args\": [\n \"-y\",\n \"@atlasent/mcp-server\"\n ],\n \"env\": {\n \"ATLASENT_API_KEY\": \"\"\n }\n }\n }\n}" ``` **Credentials it will ask for** (names only — Forge never holds a value): - `ATLASENT_API_KEY` — Atlasent API Key (optional) Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one. - This entry needs 1 credential (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset. ## Blast radius Extensive blast radius — deletes data; holds an api key. - Floor 55, ceiling 55 (tier: extensive) - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/%40atlasent%2Fmcp-server - Install plan: https://forgeregistry.com/api/v1/packages/%40atlasent%2Fmcp-server/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/%40atlasent%2Fmcp-server - HTML page: https://forgeregistry.com/registry/%40atlasent%2Fmcp-server - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.