--- title: Available tools description: Full list of tools exposed by the AIC Remote MCP Server, organized by category and grouped by required scope. component: build-with-ai page_id: build-with-ai:aic-remote-mcp-server:available-tools canonical_url: https://developer.pingidentity.com/build-with-ai/aic-remote-mcp-server/available-tools.html llms_txt: https://developer.pingidentity.com/build-with-ai/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2026-08-20 keywords: ["MCP", "AI", "AIC", "tools", "managed objects", "journeys", "themes", "applications", "logs", "reports", "PingOne Advanced Identity Cloud"] section_ids: managed-objects: Managed objects example-prompts: Example prompts themes: Themes example-prompts-2: Example prompts logging: Logging example-prompts-3: Example prompts esvs: ESVs (Environment Secrets and Variables) example-prompts-4: Example prompts feature-management: Feature management example-prompts-5: Example prompts applications: Applications example-prompts-6: Example prompts am-journeys-nodes-and-scripts: AM journeys, nodes, and scripts example-prompts-7: Example prompts am-services-and-identity-providers: AM services and identity providers example-prompts-8: Example prompts cors-policies: CORS policies example-prompts-9: Example prompts policy-and-notifications: Policy and notifications example-prompts-10: Example prompts reporting: Reporting example-prompts-11: Example prompts --- # Available tools | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The AIC Remote MCP Server is currently available in **Rapid (Sandbox)** environments only. Support for Development, UAT, Staging, and Production environments is rolling out over the coming weeks. | The AIC Remote MCP Server exposes tools for administering your PingOne Advanced Identity Cloud environment through an AI client. You don't need to know the individual tool names. Describe what you want in natural language and your AI agent selects the right tool automatically. Every request must include the mandatory `aic:mcp:access` scope. Each category table below groups its tools by the additional scope required. For the full scope reference and per-tier request lists, refer to [Scopes](scopes.html). Available tools also depend on your environment tier. Refer to [Environments and access](overview.html#_environments_and_access). | Category | What you can do | | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------ | | [Managed objects](#managed-objects) | Create, query, update, and delete managed objects, object types, and custom relationships. | | [Themes](#themes) | List, create, update, delete, and set default themes. | | [Logging](#logging) | List log sources and query authentication and activity logs. | | [ESVs](#esvs) | Query, create, update, and delete environment variables and secrets. | | [Feature management](#feature-management) | Inspect and install optional IDM and platform features. | | [Applications](#applications) | List, retrieve, create, update, and delete OIDC applications. | | [AM journeys, nodes, and scripts](#am-journeys-nodes-and-scripts) | Manage authentication journeys, node types, and Scripted Decision Node scripts. | | [AM services and identity providers](#am-services-and-identity-providers) | Inspect and configure AM services and social identity providers. | | [CORS policies](#cors-policies) | Manage cross-origin resource sharing policies. | | [Policy and notifications](#policy-and-notifications) | Manage email templates, outbound email, password policies, and terms and conditions. | | [Reporting](#reporting) | Query, run, and author reports. | ## Managed objects Generic CRUD operations for any managed object type in your environment, plus administrative tools for managing object type definitions and custom relationship properties. | Scope | Tool | Description | | -------------------------- | -------------------------------- | ---------------------------------------------------------------------------------------------------------- | | `aic:mcp:identities.read` | `listManagedObjects` | Discover all managed object types in your environment. | | | `getManagedObjectSchema` | Get the schema definition for an object type. | | | `queryManagedObjects` | Query objects with filters, pagination, and sorting. | | | `getManagedObject` | Retrieve an object's complete profile. | | `aic:mcp:identities.write` | `createManagedObject` | Create a new managed object. | | | `patchManagedObject` | Update object fields. | | | `deleteManagedObject` | Delete an object. | | | `createManagedObjectDefinition` | Create a new managed object type definition. | | | `patchManagedObjectDefinition` | Modify an existing managed object type definition. | | | `deleteManagedObjectDefinition` | Delete a managed object type definition. | | | `patchManagedObjectRelationship` | Add, update, or remove a custom relationship property. Custom relationships must use the `custom_` prefix. | ### Example prompts * "List all managed object types in my tenant" * "Show me the schema for the alpha\_user managed object" * "Find users whose email starts with admin@" * "Create a managed object for this user" ## Themes Customize login and account page appearance. | Scope | Tool | Description | | ---------------------- | ----------------- | ---------------------------------------- | | `aic:mcp:themes.read` | `getThemeSchema` | Get complete theme schema documentation. | | | `getThemes` | List all themes in a realm. | | | `getTheme` | Get a theme's complete configuration. | | `aic:mcp:themes.write` | `createTheme` | Create a new theme. | | | `updateTheme` | Update theme properties. | | | `deleteTheme` | Delete a theme. | | | `setDefaultTheme` | Set a theme as the realm default. | ### Example prompts * "List all themes in my realm" * "Show me the current login theme" * "Create a new theme with this primary color" * "Set this theme as the default" ## Logging Query and analyze authentication and activity logs. | Scope | Tool | Description | | ------------------- | --------------- | -------------------------------------------------------- | | `aic:mcp:logs.read` | `getLogSources` | List available log sources. | | | `queryLogs` | Query logs with time range, source, and content filters. | ### Example prompts * "List available log sources" * "Show authentication errors from the last hour" * "Query activity logs for failed requests" ## ESVs (Environment Secrets and Variables) Manage environment variables used for configuration across your tenant. | Scope | Tool | Description | | ------------------- | ---------------- | ------------------------------------------- | | `aic:mcp:esv.read` | `queryESVs` | Query variables or secrets by ID pattern. | | | `getVariable` | Retrieve a variable with its decoded value. | | `aic:mcp:esv.write` | `setVariable` | Create or update a variable. | | | `deleteVariable` | Delete a variable. | ### Example prompts * "List the environment variables in my tenant" * "Get the value of this environment variable" * "Set an environment variable for this configuration" ## Feature management Inspect and enable optional IDM and platform features. | Scope | Tool | Description | | ---------------------- | -------------------- | ------------------------------------------------------------------------- | | `aic:mcp:idm.read` | `listFeatures` | List all features (IDM + AIC platform) and their install status. | | | `validateIdmFeature` | Check whether an IDM feature can be installed without making any changes. | | `aic:mcp:idm.write` | `installIdmFeature` | Install an IDM feature. Run `validateIdmFeature` first. | | `aic:mcp:agents.write` | `enableAiAgent` | Enable AI Agents on the tenant. Re-running is safe. | ### Example prompts * "Which IDM features are installed?" * "Can I install the groups feature?" * "Enable AI Agents" ## Applications Manage OIDC applications, plus cross-type lookups for any application (OIDC, SAML, PingOne, and others). | Scope | Tool | Description | | -------------------- | ------------------ | ------------------------------------------------------------------------------ | | `aic:mcp:apps.read` | `listApplications` | List all applications in a realm regardless of type, with summary fields only. | | | `getApplication` | Retrieve a single application by name or ID, regardless of type. | | | `getOidcAppSchema` | Get the OIDC application schema. | | | `listOidcApps` | List OIDC applications in a realm with summary fields. | | | `getOidcApp` | Retrieve a complete OIDC application configuration. | | `aic:mcp:apps.write` | `createOidcApp` | Create a new OIDC application. | | | `updateOidcApp` | Update an OIDC application. Partial updates. Send only changed fields. | | | `deleteOidcApp` | Delete an OIDC application. | ### Example prompts * "List the OIDC applications in my realm" * "Show me the configuration for this application" * "Create an OIDC application named Customer Portal" * "Update the redirect URI for my application" ## AM journeys, nodes, and scripts Manage authentication journeys, node types, and Scripted Decision Node scripts. | Scope | Tool | Description | | ------------------------ | --------------------------------- | ------------------------------------------------------------------------------------------ | | `aic:mcp:journeys.read` | `listJourneys` | List all authentication journeys in a realm. | | | `getJourney` | Get a journey with node schemas and configs automatically included. | | | `getJourneyPreviewUrl` | Generate a preview URL to test a journey in a browser. | | | `exportJourney` | Export a journey with its nodes, inner trees, SAML entities, circles of trust, and themes. | | | `listNodeTypes` | Discover all available authentication node types. | | | `getNodeTypeDetails` | Get the schema, template, and outcomes for a node type. | | | `getDynamicNodeOutcomes` | Calculate outcomes for a node based on its configuration. | | | `listScripts` | List Scripted Decision Node scripts in a realm. | | | `getAMScript` | Get an AM script with automatic base64 decoding. | | | `getScriptedDecisionNodeBindings` | Get available bindings and allowed imports for scripting. | | `aic:mcp:journeys.write` | `createJourney` | Create or replace an authentication journey atomically. | | | `updateJourney` | Update an existing journey's metadata and node graph. | | | `deleteJourney` | Delete a journey and its associated nodes. | | | `setDefaultJourney` | Set the default authentication journey for a realm. | | | `updateJourneyNode` | Update a single node's configuration. | | | `deleteJourneyNodes` | Batch delete orphaned node instances. | | | `createScript` | Create a new Scripted Decision Node script. | | | `updateScript` | Update an existing script's name, description, or content. | | | `deleteScript` | Delete an AM script. | ### Example prompts * "List the authentication journeys in the alpha realm" * "Show me the node types available for authentication journeys" * "Get the configuration for the Login journey" * "Create a script for this authentication decision" ## AM services and identity providers Manage AM services and social/third-party identity providers. | Scope | Tool | Description | | ------------------------ | ------------------------- | --------------------------------------------------------------------------------- | | `aic:mcp:journeys.read` | `listAmServices` | List AM services (configured or all/creatable types) in a realm. | | | `getAmService` | Retrieve the full configuration of a single AM service. | | | `getAmServiceSchema` | Return the JSON Schema for a configurable AM service type. | | | `listSocialIdps` | List configured social/third-party identity providers, or discover IdP sub-types. | | | `getSocialIdp` | Retrieve the full configuration of a single social/third-party identity provider. | | `aic:mcp:journeys.write` | `createOrUpdateAmService` | Create or update an AM service configuration (upsert, partial payloads). | | | `deleteAmService` | Permanently delete an AM service configuration. | | | `configureOidcIdp` | Create or update a social/third-party OIDC identity provider. | | | `deleteIdp` | Permanently remove a social/third-party identity provider. | ### Example prompts * "List the AM services configured in the alpha realm" * "Show me the available social identity provider types" * "Configure a Google identity provider" * "Get the configuration for this AM service" ## CORS policies Manage cross-origin resource sharing policies for AM. | Scope | Tool | Description | | ------------------- | ------------------ | --------------------------------------------------------------------- | | `aic:mcp:idm.read` | `listCorsPolicies` | List all CORS policies configured in PingOne Advanced Identity Cloud. | | | `getCorsPolicy` | Retrieve a single CORS policy by ID. | | `aic:mcp:idm.write` | `createCorsPolicy` | Create a new CORS policy. | | | `updateCorsPolicy` | Update an existing CORS policy (full replacement). | | | `deleteCorsPolicy` | Permanently delete a CORS policy. | ### Example prompts * "List the CORS policies configured in my tenant" * "Show me the CORS policy with ID policy-1" * "Create a CORS policy for https\://example.com" ## Policy and notifications Manage email templates, outbound email provider config, password policy, and terms and conditions. | Scope | Tool | Description | | ------------------------ | ------------------------------------- | ----------------------------------------------------------------------------- | | `aic:mcp:idm.read` | `listEmailTemplates` | List all end-user email templates. | | | `configureTermsAndConditions` (read) | Read the current terms and conditions configuration. | | `aic:mcp:idm.write` | `createEmailTemplate` | Create a new end-user email template. | | | `updateEmailTemplate` | Update an existing email template (full replacement). | | | `configureEmailProvider` | Create or update the tenant outbound email provider (SMTP config, singleton). | | | `configureTermsAndConditions` (write) | Add and activate a new terms and conditions version. | | `aic:mcp:journeys.read` | `getPasswordPolicy` | Retrieve the password policy for a managed object type. | | `aic:mcp:journeys.write` | `setPasswordPolicy` | Update the password policy for a managed object type. | ### Example prompts * "List the email templates in my tenant" * "Update the outbound email provider configuration" * "Show me the password policy for alpha\_user" * "Update the terms and conditions configuration" ## Reporting Query, run, and author PingOne Advanced Identity Cloud reports. Includes out-of-the-box (OOTB) reports every tenant has, plus custom reports built through the Advanced Reporting add-on. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Reporting tools are available in all environment tiers, including UAT, Staging, and Production. This lets administrators author and run reports in upper environments even when write tools are otherwise restricted. | | Scope | Tool | Description | | ----------------------- | ---------------------- | -------------------------------------------------------------------------------- | | `aic:mcp:reports.read` | `listReportTemplates` | List available OOTB and custom report templates. | | | `getReportDefinition` | Get a single report's parameters and fields by name. | | | `runReport` | Run a published report with parameters, polling briefly for completion. | | | `getReportResults` | Fetch paginated results for a report run by jobId. | | | `exportReport` | Export a completed report run's results as CSV or JSON Lines. | | | `exportReportTemplate` | Export a custom report template definition as JSON. | | `aic:mcp:reports.write` | `duplicateReport` | Copy an existing report (OOTB or custom) into a new draft. | | | `createCustomReport` | Author and auto-publish a custom report. Requires the Advanced Reporting add-on. | | | `importReportTemplate` | Import a previously exported custom report template. | ### Example prompts * "List the report templates available in my tenant" * "Run the sign-on report for the last 30 days" * "Show me the results for this report run" * "Create a custom report for failed authentications"