Build with AI

Available tools

The AIC Remote MCP Server is currently available in Rapid (Sandbox) environments only. Support for Development, UAT, Staging, and Production environments is rolling out over the coming weeks.

The AIC Remote MCP Server exposes tools for administering your PingOne Advanced Identity Cloud environment through an AI client. You don’t need to know the individual tool names. Describe what you want in natural language and your AI agent selects the right tool automatically.

Every request must include the mandatory aic:mcp:access scope. Each category table below groups its tools by the additional scope required. For the full scope reference and per-tier request lists, refer to Scopes. Available tools also depend on your environment tier. Refer to Environments and access.

Category What you can do

Managed objects

Create, query, update, and delete managed objects, object types, and custom relationships.

Themes

List, create, update, delete, and set default themes.

Logging

List log sources and query authentication and activity logs.

ESVs

Query, create, update, and delete environment variables and secrets.

Feature management

Inspect and install optional IDM and platform features.

Applications

List, retrieve, create, update, and delete OIDC applications.

AM journeys, nodes, and scripts

Manage authentication journeys, node types, and Scripted Decision Node scripts.

AM services and identity providers

Inspect and configure AM services and social identity providers.

CORS policies

Manage cross-origin resource sharing policies.

Policy and notifications

Manage email templates, outbound email, password policies, and terms and conditions.

Reporting

Query, run, and author reports.

Managed objects

Generic CRUD operations for any managed object type in your environment, plus administrative tools for managing object type definitions and custom relationship properties.

Scope Tool Description

aic:mcp:identities.read

listManagedObjects

Discover all managed object types in your environment.

getManagedObjectSchema

Get the schema definition for an object type.

queryManagedObjects

Query objects with filters, pagination, and sorting.

getManagedObject

Retrieve an object’s complete profile.

aic:mcp:identities.write

createManagedObject

Create a new managed object.

patchManagedObject

Update object fields.

deleteManagedObject

Delete an object.

createManagedObjectDefinition

Create a new managed object type definition.

patchManagedObjectDefinition

Modify an existing managed object type definition.

deleteManagedObjectDefinition

Delete a managed object type definition.

patchManagedObjectRelationship

Add, update, or remove a custom relationship property. Custom relationships must use the custom_ prefix.

Example prompts

  • "List all managed object types in my tenant"

  • "Show me the schema for the alpha_user managed object"

  • "Find users whose email starts with admin@"

  • "Create a managed object for this user"

Themes

Customize login and account page appearance.

Scope Tool Description

aic:mcp:themes.read

getThemeSchema

Get complete theme schema documentation.

getThemes

List all themes in a realm.

getTheme

Get a theme’s complete configuration.

aic:mcp:themes.write

createTheme

Create a new theme.

updateTheme

Update theme properties.

deleteTheme

Delete a theme.

setDefaultTheme

Set a theme as the realm default.

Example prompts

  • "List all themes in my realm"

  • "Show me the current login theme"

  • "Create a new theme with this primary color"

  • "Set this theme as the default"

Logging

Query and analyze authentication and activity logs.

Scope Tool Description

aic:mcp:logs.read

getLogSources

List available log sources.

queryLogs

Query logs with time range, source, and content filters.

Example prompts

  • "List available log sources"

  • "Show authentication errors from the last hour"

  • "Query activity logs for failed requests"

ESVs (Environment Secrets and Variables)

Manage environment variables used for configuration across your tenant.

Scope Tool Description

aic:mcp:esv.read

queryESVs

Query variables or secrets by ID pattern.

getVariable

Retrieve a variable with its decoded value.

aic:mcp:esv.write

setVariable

Create or update a variable.

deleteVariable

Delete a variable.

Example prompts

  • "List the environment variables in my tenant"

  • "Get the value of this environment variable"

  • "Set an environment variable for this configuration"

Feature management

Inspect and enable optional IDM and platform features.

Scope Tool Description

aic:mcp:idm.read

listFeatures

List all features (IDM + AIC platform) and their install status.

validateIdmFeature

Check whether an IDM feature can be installed without making any changes.

aic:mcp:idm.write

installIdmFeature

Install an IDM feature. Run validateIdmFeature first.

aic:mcp:agents.write

enableAiAgent

Enable AI Agents on the tenant. Re-running is safe.

Example prompts

  • "Which IDM features are installed?"

  • "Can I install the groups feature?"

  • "Enable AI Agents"

Applications

Manage OIDC applications, plus cross-type lookups for any application (OIDC, SAML, PingOne, and others).

Scope Tool Description

aic:mcp:apps.read

listApplications

List all applications in a realm regardless of type, with summary fields only.

getApplication

Retrieve a single application by name or ID, regardless of type.

getOidcAppSchema

Get the OIDC application schema.

listOidcApps

List OIDC applications in a realm with summary fields.

getOidcApp

Retrieve a complete OIDC application configuration.

aic:mcp:apps.write

createOidcApp

Create a new OIDC application.

updateOidcApp

Update an OIDC application. Partial updates. Send only changed fields.

deleteOidcApp

Delete an OIDC application.

Example prompts

  • "List the OIDC applications in my realm"

  • "Show me the configuration for this application"

  • "Create an OIDC application named Customer Portal"

  • "Update the redirect URI for my application"

AM journeys, nodes, and scripts

Manage authentication journeys, node types, and Scripted Decision Node scripts.

Scope Tool Description

aic:mcp:journeys.read

listJourneys

List all authentication journeys in a realm.

getJourney

Get a journey with node schemas and configs automatically included.

getJourneyPreviewUrl

Generate a preview URL to test a journey in a browser.

exportJourney

Export a journey with its nodes, inner trees, SAML entities, circles of trust, and themes.

listNodeTypes

Discover all available authentication node types.

getNodeTypeDetails

Get the schema, template, and outcomes for a node type.

getDynamicNodeOutcomes

Calculate outcomes for a node based on its configuration.

listScripts

List Scripted Decision Node scripts in a realm.

getAMScript

Get an AM script with automatic base64 decoding.

getScriptedDecisionNodeBindings

Get available bindings and allowed imports for scripting.

aic:mcp:journeys.write

createJourney

Create or replace an authentication journey atomically.

updateJourney

Update an existing journey’s metadata and node graph.

deleteJourney

Delete a journey and its associated nodes.

setDefaultJourney

Set the default authentication journey for a realm.

updateJourneyNode

Update a single node’s configuration.

deleteJourneyNodes

Batch delete orphaned node instances.

createScript

Create a new Scripted Decision Node script.

updateScript

Update an existing script’s name, description, or content.

deleteScript

Delete an AM script.

Example prompts

  • "List the authentication journeys in the alpha realm"

  • "Show me the node types available for authentication journeys"

  • "Get the configuration for the Login journey"

  • "Create a script for this authentication decision"

AM services and identity providers

Manage AM services and social/third-party identity providers.

Scope Tool Description

aic:mcp:journeys.read

listAmServices

List AM services (configured or all/creatable types) in a realm.

getAmService

Retrieve the full configuration of a single AM service.

getAmServiceSchema

Return the JSON Schema for a configurable AM service type.

listSocialIdps

List configured social/third-party identity providers, or discover IdP sub-types.

getSocialIdp

Retrieve the full configuration of a single social/third-party identity provider.

aic:mcp:journeys.write

createOrUpdateAmService

Create or update an AM service configuration (upsert, partial payloads).

deleteAmService

Permanently delete an AM service configuration.

configureOidcIdp

Create or update a social/third-party OIDC identity provider.

deleteIdp

Permanently remove a social/third-party identity provider.

Example prompts

  • "List the AM services configured in the alpha realm"

  • "Show me the available social identity provider types"

  • "Configure a Google identity provider"

  • "Get the configuration for this AM service"

CORS policies

Manage cross-origin resource sharing policies for AM.

Scope Tool Description

aic:mcp:idm.read

listCorsPolicies

List all CORS policies configured in PingOne Advanced Identity Cloud.

getCorsPolicy

Retrieve a single CORS policy by ID.

aic:mcp:idm.write

createCorsPolicy

Create a new CORS policy.

updateCorsPolicy

Update an existing CORS policy (full replacement).

deleteCorsPolicy

Permanently delete a CORS policy.

Example prompts

  • "List the CORS policies configured in my tenant"

  • "Show me the CORS policy with ID policy-1"

  • "Create a CORS policy for https://example.com"

Policy and notifications

Manage email templates, outbound email provider config, password policy, and terms and conditions.

Scope Tool Description

aic:mcp:idm.read

listEmailTemplates

List all end-user email templates.

configureTermsAndConditions (read)

Read the current terms and conditions configuration.

aic:mcp:idm.write

createEmailTemplate

Create a new end-user email template.

updateEmailTemplate

Update an existing email template (full replacement).

configureEmailProvider

Create or update the tenant outbound email provider (SMTP config, singleton).

configureTermsAndConditions (write)

Add and activate a new terms and conditions version.

aic:mcp:journeys.read

getPasswordPolicy

Retrieve the password policy for a managed object type.

aic:mcp:journeys.write

setPasswordPolicy

Update the password policy for a managed object type.

Example prompts

  • "List the email templates in my tenant"

  • "Update the outbound email provider configuration"

  • "Show me the password policy for alpha_user"

  • "Update the terms and conditions configuration"

Reporting

Query, run, and author PingOne Advanced Identity Cloud reports. Includes out-of-the-box (OOTB) reports every tenant has, plus custom reports built through the Advanced Reporting add-on.

Reporting tools are available in all environment tiers, including UAT, Staging, and Production. This lets administrators author and run reports in upper environments even when write tools are otherwise restricted.
Scope Tool Description

aic:mcp:reports.read

listReportTemplates

List available OOTB and custom report templates.

getReportDefinition

Get a single report’s parameters and fields by name.

runReport

Run a published report with parameters, polling briefly for completion.

getReportResults

Fetch paginated results for a report run by jobId.

exportReport

Export a completed report run’s results as CSV or JSON Lines.

exportReportTemplate

Export a custom report template definition as JSON.

aic:mcp:reports.write

duplicateReport

Copy an existing report (OOTB or custom) into a new draft.

createCustomReport

Author and auto-publish a custom report. Requires the Advanced Reporting add-on.

importReportTemplate

Import a previously exported custom report template.

Example prompts

  • "List the report templates available in my tenant"

  • "Run the sign-on report for the last 30 days"

  • "Show me the results for this report run"

  • "Create a custom report for failed authentications"