Delinea Mcp

by DelineaXPM

284 downloads

Not rated

GitHub

Description

# DelineaMCP **MCP server for the Delinea Secret Server and Platform APIs** [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) --- ## Features - Automatic authentication against Secret Server - Extensive Secret Server tool set for managing folders, secrets…

About

Details

Author: DelineaXPM
Downloads: 284
Categories: Productivity, Other

- Automatic authentication against Secret Server
- Tools for folders, secrets, users, groups, and roles
- ChatGPT compatibility tools (search and fetch)
- Optional Delinea Platform user management
- Supports STDIO and SSE transport modes
- OAuth 2.0 with dynamic client registration
- TLS support for secure connections
- Ready-to-run Docker image

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name Delinea Mcp

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

From the repository

Install uv, sync dependencies with uv pip sync requirements.txt, create a config.json with your Secret Server URL and username, set the DELINEA_PASSWORD environment variable, and run uv run server.py --config config.json. For development use python server.py. A Docker image is also available.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "delinea mcp": {
            "delinea-mcp": {
                "command": "python",
                "args": [
                    "server.py"
                ]
            }
        }
    }
}

McpServers

{
    "delinea-mcp": {
        "command": "python",
        "args": [
            "server.py"
        ]
    }
}

- Search and fetch secrets— Usesearchandfetchto find secrets and retrieve their details, with object types limited bysearch_objectsandfetch_objectsconfig.
- Manage secrets without exposing values— Create or rotate passwords server-side viacreate_secret_with_generated_passwordandupdate_secret_generated_password, keeping secret values out of model context.
- Run SQL reports— Execute ad-hoc queries withrun_reportor generate SQL from a description usingai_generate_and_run_report(requires Azure OpenAI).
- Handle access requests and inbox— Approve or deny pending requests withhandle_access_request, list them viaget_pending_access_requests, and manage inbox messages withget_inbox_messagesandmark_inbox_messages_read.
- Administer users, groups, and roles— Manage Secret Server entities viauser_management,group_management,role_management, and related membership tools likeuser_role_managementandgroup_role_management.
- Check service health— Query the Secret Server status endpoint withhealth_checkto verify the service is operational.

MCP server for the Delinea Secret Server and Platform APIs

- 11 Aug 2026— MCP Protocol v2 (spec revision 2026-07-28, streamable HTTP) and experimental StrongDM API support are here — see therelease notes.
- 11 Aug 2026— We're the original providers of the "no secret visibility to the LLM" vault use case — beware of copycats ;)

- Automatic authentication against Secret Server
- Extensive Secret Server tool set for managing folders, secrets, users, groups and roles. Includes inbox and access request helpers and coding agent utilities.
- ChatGPT compatibility tools (searchandfetch) for controlled AI interactions.
- Optional Delinea Platform user management tools
- OptionalexperimentalStrongDM (SDM) tools — access grants, entitlement audits, user/role lifecycle, health and activity reports (see docs/strongdm.md; install withpip install "delinea-mcp[strongdm]")
- Streamable HTTP (/mcp), legacy Server-Sent Events (/mcp/sse) and STDIO transports
- OAuth 2.0 with dynamic client registration per the MCP specification
- TLS support for secure connections
- Ready-to-run Docker image and development server entry point
- Tested with ChatGPT, Claude Desktop, remote Claude connector, VSCode Copilot and openwebui

This project usesuv(https://github.com/astral-sh/uv), but if you prefer to run commands without this, you can dopipandvenvcommands as usual if desired.

- Install Uv
- Initialize project:uv pip sync requirements.txt
- Useuv run server.py --config config.json

Secrets such as passwords continue to come from environment variables. ProvideDELINEA_PASSWORDin your shell environment. Optional features rely on additional variables such asAZURE_OPENAI_KEYorPLATFORM_SERVICE_PASSWORD.

Non-secret parameters belong inconfig.json:

{ "delinea_username": "<username>", "delinea_base_url": "https://your-secret-server/SecretServer", "platform_hostname": "<tenant>.secureplatform.io", "platform_service_account": "<service_account>", "platform_tenant_id": "<tenant_id>", "azure_openai_endpoint": "https://example.openai.azure.com/", "azure_openai_deployment": "<deployment_name>", "auth_mode": "none", "transport_mode": "stdio", "chatgpt_disable_scope_checks": false, "port": 8000, "debug": false, "external_hostname": null, "ssl_keyfile": null, "ssl_certfile": null, "registration_psk": null, "jwt_key_path": ".cache/jwt.json", "oauth_db_path": ".cache/oauth.db", "enabled_tools": [] }

For Secret Server Cloud simply use the cloud URL without/SecretServer. Specifyssl_keyfileandssl_certfileto enable HTTPS. For Let's Encrypt, use theprivkey.pemandfullchain.pemfiles.

The configuration file supports the following keys:

- delinea_username- Secret Server username. Must be a programmatic user with permission to do the tasks you want.
- delinea_base_url- Base URL of your Secret Server instance.
- platform_hostname- Platform tenant hostname (enables Platform tools).
- platform_service_account- Service account used with the Platform API.
- platform_tenant_id- Tenant ID for Platform API requests.
- strongdm_api_host- StrongDM control plane (defaultapp.strongdm.com:443; UK/EU variants available). Credentials come fromSDM_API_ACCESS_KEY/SDM_API_SECRET_KEYenv vars; seedocs/strongdm.md.
- azure_openai_endpoint- Azure OpenAI endpoint. Only if you want the automatic report generation (most agents can generate their own report SQL so don't enable unless you need it).
- azure_openai_deployment- Deployment name for Azure OpenAI.
- auth_mode- Authentication mode (noneoroauth). OAuth obviously doesn't work with stdio transport.
- transport_mode-stdiofor command line orssefor HTTP. Inssemode the server exposes both the streamable HTTP endpoint at/mcp(current MCP transport, serves protocol revisions 2024-11-05 through 2026-07-28) and the legacy HTTP+SSE endpoints at/mcp/sse+/messages/.
- streamable_http_stateless- defaulttrue; run/mcpwithout server-side sessions (recommended for remote connectors). Setfalseto enable session-based operation with the standalone GET stream.
- streamable_http_json_response- defaulttrue; respond with plain JSON instead of SSE-framed responses on/mcp.
- chatgpt_disable_scope_checks- Skip scope validation on ChatGPT requests. Enable only if you encounter problems connecting to ChatGPT.
- port- Port for the HTTP server inssemode.
- debug- Enable verbose logging.
- external_hostname- Hostname used when constructing OAuth token audiences. Don't add HTTP(S) prefix or port.
- ssl_keyfile- Path to the SSL key for HTTPS. (egprivkey.pem)
- ssl_certfile- Path to the SSL certificate for HTTPS. (egfullchain.pem)
- registration_psk- Pre-shared key required to register OAuth clients. You will need to type in this secret in your browser to approve OAuth connections.
- jwt_key_path- Location of the RSA key pair used for OAuth tokens. Defaults to.cache/jwt.json. autogenerated if doesn't exist.
- oauth_db_path- Path to the OAuth database file. Defaults to.cache/oauth.db. autogenerated if doesn't exist.
- enabled_tools- List of tool names to register. An empty list enables all tools. It is highly recommended to enable tools selectively per use case or task. Seedocs/folder for some examples.
- search_objects- Allowed object types for thesearchtool. Defaults to["secret"]but can includeuser,folder,groupandrole.
- fetch_objects- Allowed object types for thefetchtool. Defaults to["secret"]but can include the same values assearch_objects.

Start the server locally in development mode:

On startup the server requests a bearer token and stores it for subsequent API requests. This project will be expanded to integrate further with the Secret Server API.

The server exposes MCP tools for Secret Server, the Delinea Platform identity directory, and (optionally) StrongDM. Every tool publishes behaviour annotations (read-only/destructive hints) viatools/list.

- search(query)- unified search returning{id, title, url}results; object types are limited by thesearch_objectsconfig key (default: secrets only).
- fetch(id)- retrieve a single object surfaced bysearch; limited byfetch_objects.

- run_report(sql_query, report_name=None)- create and execute a temporary report.
- ai_generate_and_run_report(description)- generate SQL using Azure OpenAI and run it. Requires the Azure OpenAI variables.
- list_example_reports()- list sample queries and table information.
- get_secret(id, summary=False)- retrieve a secret or summary details.
- get_folder(id)- fetch folder metadata and children.
- search_secrets(query, lookup=False)- search or look up secrets.
- search_folders(query, lookup=False)- search or look up folders.
- get_secret_environment_variable(secret_id, environment)- output a script for fetching secret credentials in the specified shell.
- check_secret_template(template_id)- fetch secret template details.
- check_secret_template_field(template_id, field_id)- check if a template contains a field.
- get_secret_template_field(field_id)- retrieve details about a specific secret template field by ID.
- handle_access_request(request_id, status, response_comment, start_date=None, expiration_date=None)- approve or deny an access request.
- get_pending_access_requests()- list pending access requests.
- get_inbox_messages(read_status_filter=None, take=20, skip=0)- retrieve inbox messages.
- mark_inbox_messages_read(message_ids, read=True)- mark messages as read or unread.
- create_secret_with_generated_password(name, secret_template_id, password_field_id, items, folder_id=None, site_id=None, comment=None)- create a secret whose password is generated server-side; only sanitized metadata is returned, the value never reaches the model.
- update_secret_generated_password(secret_id, field_slug, password_field_id, comment=None)- rotate a secret's password server-side without surfacing the value.
- update_secret_fields(secret_id, field_updates, comment=None, allow_password_fields=False)- read-template → mutate non-password fields → verify flow; refuses password-marked fields unless explicitly allowed.
- set_secret_field_environment_variable(secret_id, field_slug, environment, source="stdin", comment=None)- emit a shell script (bash/powershell/cmd) that reads a value locally and pushes it into the secret field, so the value bypasses the model entirely.
- bulk_user_response(user_ids, scenario, comment, confirm=False)- opinionated incident combinator over the bulk-user operations API. Scenarios:compromise,offboard,unlock,reenable,force_logout; requiresconfirm=Trueplus a non-empty audit comment, and previews when unconfirmed.
- role_management(action, role_id=None, data=None, params=None)- manage roles.actionmay belist,get,createorupdate. Pass optional query parameters withparamswhen listing roles. Example:role_management("update", role_id=3, data={"name": "New Role"}).
- user_role_management(action, user_id, role_ids=None)- assign or remove roles from a user.actionisget,addorremoveandrole_idsis a list of role identifiers for add/remove operations.
- group_management(action, group_id=None, data=None, params=None)- handle groups.actionmay beget,list,createordelete. Providegroup_idfor get/delete anddatawhen creating a group.
- folder_management(action, folder_id=None, data=None, params=None)- manage folders.actionmay beget,list,create,updateordelete. Providefolder_idfor get, update or delete and supplydatawhen creating or updating a folder.
- user_group_management(action, user_id, group_ids=None)- manage group membership for a user.actionisget,addorremove. Supply a list ofgroup_idswhen adding or removing membership.
- group_role_management(action, group_id, role_ids=None)- control roles on a group. Uselist,addorremoveactions. Providerole_idswhen adding or removing.
- health_check()- query the Secret Server health check endpoint and return the current service status.

Since v1.0.0 the canonical user tools target the Delinea Platform identity directory (requiresplatform_hostname+PLATFORM_SERVICE_credentials; without them the tools return guidance instead of failing):

- user_management(action, user_id=None, data=None, username=None)- Platform user CRUD.actionacceptsget,create,update,deleteorsearch.
- search_users(query)- search the Platform user directory.
- platform_role_management(action, role_id=None, data=None, page_size=100, query="%")- Platform role CRUD (list,get,create,update,delete); role mutations are discovery-driven and return guidance on tenants whose API scope doesn't expose them.
- platform_user_role_management(action, role_id, user_principals=None)-list,addorremoveusers on a Platform role.
- platform_user_management(...)- deprecated alias ofuser_management.

For SS-only deployments without Platform configured:

- secretserver_local_user_management(action, user_id=None, data=None, skip=0, take=20, is_exporting=False)- the pre-v1.0.0 Secret Server user operations:get,create,update,delete,list_sessions,reset_2fa,reset_password,lock_out. Example:secretserver_local_user_management("reset_password", user_id=42, data={"newPassword": "Pa$$w0rd"}).
- search_secretserver_local_users(query)- search Secret Server's local user store.

Experimental: the StrongDM backend has not yet been verified against a live SDM organization (unit-tested against the SDK surface only). Expect rough edges and report issues. Installed via thestrongdmextra; seedocs/strongdm.mdfor the full guide.sdm_search,sdm_audit_access,sdm_grant_access(time-boxed just-in-time or standing grants),sdm_revoke_access,sdm_user_management(onboard/offboard flows),sdm_role_management,sdm_resource_health,sdm_access_requests,sdm_activity_report,sdm_network_status. Destructive actions are confirm-gated with audit comments; ambiguous name matches return candidates without mutating.

Use the server configuration variables described above to authenticate. The AI tool is automatically disabled if the Azure OpenAI variables are missing. Only the tool names listed inconfig.jsonwill be registered. An empty list enables every tool.

The documentation covers several workflows for connecting tools to the server:

- ChatGPT Custom Connector
- Claude Desktop
- Remote Claude Connector
- openwebui for Administration
- VSCode Copilot

ADockerfileis provided for running the MCP server without installing Python dependencies locally.

docker build -t dev.local/delinea-mcp:latest .

- Run the server (pass your credentials via environment variables):

docker run --rm -p 8000:8000 \ -e DELINEA_PASSWORD=<password> \ -e PLATFORM_SERVICE_PASSWORD=<password> \ -e DELINEA_DEBUG=1 \ -e AZURE_OPENAI_KEY=<your-key-or-appropriate-token> \ -v $(pwd)/config.json:/app/config.json:ro \ -v mcp-data:/app/data \ dev.local/delinea-mcp:latest

Populateconfig.jsonwith your usernames and URLs as shown above.

The container storesoauth.dbandjwt.jsonin/app/data. Mount a volume (shown asmcp-dataabove) so these files and any HTTPS certificates persist between runs.

Replace<https://your-secret-server/SecretServer>with the base URL of your Secret Server instance to avoid connection errors.

The server will start on port8000by default usingpython server.py. Set theportoption inconfig.jsonto override the default. Enabledebug: trueto log all incoming HTTP requests.

Themanual_secret_request.pyscript shows how to retrieve an OAuth token for a specific secret ID:

python scripts/manual_secret_request.py <Secret_ID>

Set the environment variablesSECRET_USERNAME_<id>andSECRET_PASSWORD_<id>for the secret before running the script. Optionally setDELINEA_BASE_URLto override the defaulthttps://localhost/SecretServer.

Run the unit tests with coverage (CI enforces a minimum of 70%):

pip install -r requirements.txt coverage run -m pytest -q coverage report --omit "tests/"

Some integration tests require valid credentials. Set the following environment variables and the optionalLIVE_SECRET_IDbefore running the suite:

export DELINEA_PASSWORD=<password> # Optional secret used by tests/test_live.py export LIVE_SECRET_ID=<id> export SECRET_USERNAME_<id>=<secret_username> export SECRET_PASSWORD_<id>=<secret_password>

When these variables are present the live tests will perform real API requests.

Dependencies are pinned inrequirements.txtand releases are tagged using Semantic Versioning. Build the Docker image from a tagged commit and deploy it to your production environment, passing the required environment variables (DELINEA_USERNAME,DELINEA_PASSWORD, optionallyDELINEA_BASE_URL). Optional features rely on additional variables:

- PLATFORM_SERVICE_PASSWORDalong withPLATFORM_HOSTNAME,PLATFORM_SERVICE_ACCOUNT, andPLATFORM_TENANT_IDenables the user management tools.
- AZURE_OPENAI_KEYtogether withAZURE_OPENAI_ENDPOINTandAZURE_OPENAI_DEPLOYMENTenables the AI report generation helper.
- SDM_API_ACCESS_KEYandSDM_API_SECRET_KEYenable the experimental StrongDM tools (requires thestrongdmextra; see docs/strongdm.md).

When running with OAuth or SSE transport you may need to provideregistration_pskand configure anexternal_hostnameor HTTPS certificate files.

- delinea_mcp/- package containing the MCP tools:tools.py(Secret Server),user_platform_tools.py(Delinea Platform),secretserver_users.py(SS-local users),strongdm_tools.py(StrongDM, optional), plustransports/(SSE + streamable HTTP) andauth/(the embedded OAuth authorization server).
- server.py- thin entry point that registers everything with the MCP server.
- docs/- project documentation and the generateddelinea-secret-server-openapi-spec.json.
- scripts/- helper examples includingmanual_secret_request.py.

The embedded OAuth authorization server is a convenience for development, testing and small deployments; larger deployments should front the server with their organisation's identity provider. Current safeguards:

- Client registration (/oauth/register) and the authorization form both require theregistration_pskshared secret (constant-time compared).
- redirect_urivalues are validated against the URIs registered for the client on both the authorize form and the code redirect.
- Access tokens are audience-bound RS256 JWTs; resource discovery follows RFC 9728 (/.well-known/oauth-protected-resourceplusWWW-Authenticateheaders on 401/403 responses).
- Always deploy with TLS (ssl_keyfile/ssl_certfileor a terminating proxy) — bearer tokens and secrets transit every request.
- Scope tool exposure per use case withenabled_tools; secretvaluesare kept out of model context by design (server-side password generation, env-var script indirection, password-field guards).

See CHANGELOG.mdfor a summary of the latest features and roadmap items.
- Passthrough authentication
- OAuth Client ID Metadata Documents (CIMD) client support (Dynamic Client Registration is deprecated as of MCP protocol revision 2026-07-28; the PSK-gated/oauth/registerflow keeps working for current connectors)
- Expand tool coverage on the Delinea Platform and add other Delinea products

Contributions are welcome! Please open issues or pull requests for any improvements. All new code should include unit tests and pass the existing test suite.

This project is licensed under the MIT License.

The 1Password MCP server creates a bridge that allows MCP clients such as Codex and Kiro to manage your 1Password Environments with secure authorization prompts.

This is the 1st, easiest, and cheapest PPT, slides, presentation AI generation MCP Server in the world.

Persistent memory for any AI assistant. Zero token cost until recall. Stores memories in local SQLite, ranks by 6-factor scoring, returns results 79% smaller than JSON. Works with Claude, ChatGPT, Grok, Cursor, Windsurf, and any MCP client.

A MCP server that enables AI assistants to interact with Anki, the spaced repetition flashcard application.

Enables LLM clients to interact with macOS applications through AppleScript. Built using the @beyondbetter/bb-mcp-server library, this server provides safe, controlled execution of predefined scripts with optional support for arbitrary script execution.

An MCP server for WordPress plugin audits

Turn your AI assistant into a digital marketing hub that creates, organizes, and analyzes links and QR Codes on demand.

Connect AI clients to Cal.com scheduling through the Model Context Protocol using the hosted server at mcp.cal.com or a local instance.

Sync Calendars, Scheduling Links, AI Executive Scheduling Assistant, Unified Calendar

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

Description

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

Install

More like this

Sequential Thinking

Time

Filesystem

EverArt

Google Drive

Reactive Resume