IBM Verify · Identity & Access Management
Talk to Your IAM: Announcing the IBM Verify MCP Server
Identity and Access Management is the operational backbone of every enterprise — but it has always demanded skilled administrators, command-line expertise, or complex UI navigation to get things done. Onboarding a new hire, resetting a locked-out account, reviewing pending access requests, auditing MFA enrollments before a compliance deadline: these are routine tasks that consume disproportionate time and require privileged system access.
What if you could just ask for what you need, in plain English, and have it done?
Today, IBM is introducing the IBM Verify MCP Server as an Early Preview — a bridge between AI assistants and your IBM Verify tenant that lets authorized users manage identity and access through natural language conversation.
Why This Matters
Enterprise IT teams face a growing tension: the scope of IAM operations keeps expanding — more users, more applications, more MFA policies, more access requests — while the expectation is that everything is handled faster, with fewer errors, and with complete audit trails.
Traditional tooling forces administrators to context-switch between dashboards, APIs, and scripts. Help desk staff need training to navigate IAM consoles. Compliance officers must manually pull reports. Security teams track down anomalies through fragmented interfaces.
The Model Context Protocol (MCP) removes that friction. MCP is an open standard that lets AI assistants securely discover and call external tools through a structured, auditable interface. The IBM Verify MCP Server implements that standard for IAM — so every operation becomes a conversation instead of a workflow to memorize.
Introducing the IBM Verify MCP Server
The IBM Verify MCP Server acts as a secure intermediary between an AI assistant and your IBM Verify tenant. Administrators connect their preferred MCP-compatible AI client — Claude Desktop or IBM Bob — to the server, authenticate via OAuth 2.0, and immediately gain the ability to manage their IAM environment conversationally.
The toolset covers everything IT teams touch daily. Whether it is provisioning users, managing group memberships, configuring applications, auditing MFA enrollments, processing access requests, or browsing directory attributes — every operation is available through a single conversational interface, with no dashboards to navigate and no APIs to look up. And the capability set continues to grow, with new tools being added regularly to cover an ever-broader range of identity and access operations.
How It Works
The IBM Verify MCP Server follows a straightforward request-response flow:
- The AI assistant receives a natural language prompt from the user.
- The MCP server translates the intent into one or more IBM Verify API calls on behalf of the authenticated user.
- IBM Verify processes the requests and enforces entitlement checks.
- The MCP server formats the API response for the AI assistant.
- The AI assistant presents the result in plain language — and can take follow-on actions in the same conversation.
Authentication uses OAuth 2.0 Authorization Code Flow with Token Exchange (RFC 8693). Users authenticate directly with IBM Verify via browser sign-in — no credentials are ever stored in or exposed to the AI client. For automated pipelines and agent workflows, a Direct Access Token mode is available.
See It in Action
Each of these is a single natural-language prompt, running inside IBM Bob — the server handles the rest.
Scenario 1 — New Hire Onboarding
"Onboard our new hire Jessica Turner — jessica.turner@acme.com, Finance department, Add her to the Finance-Team and VPN-Users groups."
Scenario 2 — Stolen Device: Emergency MFA Wipe
"Sarah Chen just reported her phone stolen. Show me all her MFA enrollments and remove them so she can re-enroll on a new device."
Scenario 3 — Self-Service Access Request
"I need to request access to the Corporate DB app for the Marketing entitlement. Reason: I need to access and store marketing documents."
Scenario 4 — Register a New OIDC Application
"Register a new OIDC web application called 'Internal Dev Portal' with redirect URI https://devportal.acme.internal/callback. Set it to require PKCE."
Built for Enterprise Security
- No hardcoded credentials — OAuth 2.0 with automatic token refresh; credentials never reside in the AI client.
- Least-privilege enforcement — the STS client is configured with only the minimum required entitlements; IBM Verify enforces access at the token level.
- Full audit trail — every operation is logged in IBM Verify's native audit logs, with the authenticated user identity attached to every action.
- Kubernetes and Docker deployment — deploy in minutes for local development (Docker) or at enterprise scale (Kubernetes / OpenShift).
- MCP-compatible clients — works with Claude Desktop and IBM Bob today, and any MCP-compatible AI assistant.
Who IBM Verify MCP Server Is Built For
| Audience |
Primary Need |
What IBM Verify MCP Server Provides |
| IT Administrators |
Execute IAM operations faster without navigating complex UIs |
Natural language access to the full admin toolset — users, groups, apps, and more |
| Help Desk Teams |
Resolve user issues without deep IAM training |
Conversational password resets, MFA enrollment management, and account lookups |
| Security Teams |
Rapidly investigate and remediate access anomalies |
Instant cross-tenant MFA audits, group membership lookups, and access reviews |
| Compliance Officers |
Generate accurate audit evidence on demand |
Paginated, filterable reports across users, enrollments, and access requests |
| End Users |
Self-service access and password management |
Request app access, check assignments, manage own MFA, initiate password resets |
Getting Started
Everything you need to deploy and use the IBM Verify MCP Server — prerequisites, installation, client configuration, tool reference, and troubleshooting — is available in the full documentation cookbook:
Also see:
Questions or Feedback
For questions, feedback, or support requests, please contact the IBM Verify team.