Frontegg MCP Server

Frontegg MCP Server

96 tools — mobile-SDK audit/fix (47) + Frontegg Management API (49)

Diagnose. Apply real diffs. Configure your tenant from chat.

_{Works with Claude Desktop · Cursor · Claude Code · any MCP-compatible client}

Companion repos:

• 🧠 frontegg/coding-agent-skills — 27 trigger-activated skills that orchestrate these tools end-to-end
• 🚀 frontegg/coding-agent-toolkit — one-command installer that wires both into your AI client

Table of contents

• Highlights
• Supported SDKs
• Install
• Development
• Quick start
• What you can ask it
• Examples
• Tools
• What it checks
• Configuration
• FAQ & troubleshooting

Highlights

Supported SDKs

Platform	Canonical repo	Coverage
Android (Kotlin)	frontegg/frontegg-android-kotlin	full
iOS (Swift)	frontegg/frontegg-ios-swift	full
Flutter	frontegg/frontegg-flutter	full
React Native	frontegg/frontegg-react-native	full
Ionic / Capacitor	frontegg/frontegg-ionic-capacitor	full

Install

This server installs standalone — no other Frontegg tooling required. The package is published on npm as @frontegg/frontegg-mcp-server. Wire it directly into any MCP-compatible client; npx fetches the latest version on first run.

⚠️ Version note. This branch / PR is 2.0.0 (96 tools — mobile + platform). npm currently has the pre-merge 1.0.1 (49 platform tools only). Until PR #24 merges and 2.0.0 ships to npm, npx --yes @frontegg/frontegg-mcp-server will fetch 1.0.1. To run the full 96-tool surface today, use the Development clone-and-build flow below.

Want the tenant configuration tools (MFA, SSO, users, branding, audit logs, etc.)? Set the FRONTEGG_CLIENT_ID + FRONTEGG_API_KEY env vars in your client's MCP config. The diagnose / fix tools work without them. See Configuration for where to find your Frontegg credentials.

{
  "mcpServers": {
    "frontegg": {
      "command": "npx",
      "args": ["--yes", "@frontegg/frontegg-mcp-server"],
      "env": {
        "FRONTEGG_CLIENT_ID": "your-client-id",
        "FRONTEGG_API_KEY": "your-api-secret"
      }
    }
  }
}

claude mcp add frontegg \
  -e FRONTEGG_CLIENT_ID=your-client-id \
  -e FRONTEGG_API_KEY=your-api-secret \
  -- npx --yes @frontegg/frontegg-mcp-server

npx @frontegg/coding-agent-toolkit init

Development

To build from source (for contributing or running a fork):

git clone https://github.com/frontegg/frontegg-mcp-server.git
cd frontegg-mcp-server
npm install
npm run build              # tsc → dist/
npm test                   # 215 jest + 89 vitest

Point your client at node /absolute/path/to/frontegg-mcp-server/dist/index.js to test local changes.

Using nvm? GUI apps don't inherit your shell PATH. Use the absolute path from which node.

Quick start

Open your mobile project. Ask your assistant:

Use frontegg_auto on this project and tell me what's wrong with my Frontegg setup.

The MCP will:

1. Detect your SDK (Android / iOS / Flutter / RN / Ionic)
2. Fetch the canonical Frontegg repo from GitHub
3. Diagnose the project — findings grouped by deep-link, init, auth, build, security
4. Generate unified diffs from the official example/ app
5. Apply on request via frontegg_apply_diff

Iterate until clean.

What you can ask it

No tool names required. Plain language works:

Examples

npm run demo:rn

npm run demo:flutter

npm run demo:ionic

npm run demo:security

> frontegg_configure_mfa action=get

  enforceMFAType: DontForce
  allowRememberMyDevice: true
  mfaDeviceExpiration: 1209600

> frontegg_configure_mfa action=update enforceMFAType=ForceExceptSAML

  enforceMFAType: ForceExceptSAML  ✓

Tools

96 tools across two surfaces.

Two-surface model

This server exposes two distinct tool surfaces, registered into a single MCP:

• Mobile / audit surface (47 tools, snake_case names with frontegg_ prefix) — diagnose/fix SDK integration issues, configure tenants, audit user activity. Originally frontegg-mobile-mcp-server.
• Platform surface (49 tools, kebab-case names) — full CRUD over Frontegg roles, permissions, applications, users, tenants, vendor integrations, API tokens. Imported from frontegg/frontegg-mcp-server.

Both surfaces share the same FRONTEGG_CLIENT_ID + FRONTEGG_API_KEY (alias FRONTEGG_SECRET_KEY) credentials. Naming conventions differ for v1 to avoid breaking either upstream's existing integrations; a future v2 may unify.

Mobile / audit surface (47 tools)

Diagnosis & fix (10)

CIAM feature guides (1)

Auth (1, optional)

Tenant configuration (10)

Calls the Frontegg Management API. Requires FRONTEGG_CLIENT_ID + FRONTEGG_SECRET (see Configuration).

Users, tenants, RBAC, audit (11)

Applications, webhooks, entitlements, API tokens (10)

Each API tool: action="get" (or "list") reads, action="update" (or "create") writes.

Known limitations

A few tools ship partial because the Frontegg vendor-token API doesn't expose the needed surface:

• frontegg_configure_sessions write can silently no-op
• frontegg_configure_security_rules write needs real reCAPTCHA keys
• frontegg_email_templates_* 404 on vendor tokens (tenant-scoped admin required)
• frontegg_user_mfa_enforce — per-user endpoint not exposed
• frontegg_plan_feature_attach write may no-op
• frontegg_configure_sso can list and create — cannot delete or disable

Each affected tool's description field flags the limitation so the LLM picks an alternative when one exists.

Platform surface (49 tools)

Imported from frontegg/frontegg-mcp-server — full CRUD over Frontegg's management plane. Tool names are kebab-case to preserve compatibility with anyone already integrated against upstream.

Roles (5)

Permissions (10)

Users (4)

Tenants (3)

Listing tenants is available via the mobile surface's frontegg_tenants_list.

Applications (6)

API Tokens (7)

Personal Tokens (6)

Vendor Integrations (6)

Frontegg Integrations (2)

Activating/configuring Frontegg integrations beyond reading their state requires the Frontegg portal — the API surface is read-only at v1.

What it checks

135+ rules across four layers:

• Detection — missing intent-filter, CFBundleURLTypes, Associated Domains, init call, INTERNET permission, ATS exceptions, .env outside .gitignore
• Config flags — embeddedMode, lateInit, useAssetsLinks, useChromeCustomTabs, enableOfflineMode, enableSessionPerTenant, useLegacySocialLoginFlow, and dozens more per SDK
• Advisory (real support cases) — cold-start deep-link crashes, refresh-token fatals, Doze Mode, R8/ProGuard stripping, tenant permission bleed, WebView issues
• CIAM feature — Apple/Google social login, passkeys (webcredentials: / asset links), step-up, SSO, sessions, tokens, SMS, password policies

Run list_rules inside your project — only relevant rules appear. Pass all: true for the full catalog.

Configuration

Optional (all tools)

GITHUB_TOKEN=ghp_xxx           # Lifts GitHub rate limits — recommended for heavy use
LOG_LEVEL=info                 # error | warn | info | debug

Frontegg credentials (tenant configuration tools only)

The frontegg_configure_*, users, tenants, roles, audit_logs, branding, webhooks, applications, features, plans, api_tokens, and user_sessions / user_mfa admin tools need vendor credentials:

FRONTEGG_CLIENT_ID=your-client-id   # UUID — your Frontegg environment's client ID
FRONTEGG_SECRET=your-api-secret     # UUID — your Frontegg environment's API key

Where to find them in the Frontegg portal:

1. Log into https://portal.frontegg.com
2. Pick the workspace and environment you want to manage
3. Navigate to ⚙️ Settings → Workspace Settings → Environment (path may differ slightly by portal version — search "API Key" or "Client ID" if you can't find it)
4. Copy the Client ID and API Key values

Both are UUIDs in the format xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.

Without these: diagnose / fix tools (analyze_repo, apply_diff, feature_guide, etc.) work normally. Only the tenant-API tools error.

Where to put them:

• .env file at the MCP server's directory (works for local development)
• Your MCP client's config (Cursor ~/.cursor/mcp.json, Claude Desktop claude_desktop_config.json, etc.) — recommended:

{
  "mcpServers": {
    "frontegg-mobile": {
      "command": "node",
      "args": ["/absolute/path/to/frontegg-mcp-server/dist/index.js"],
      "env": {
        "GITHUB_TOKEN": "ghp_xxx",
        "FRONTEGG_CLIENT_ID": "your-client-id",
        "FRONTEGG_SECRET": "your-api-secret"
      }
    }
  }
}

Verify your credentials work — in your MCP client's chat, ask:

Use frontegg_configure_mfa with action=get to read my tenant's MFA policy.

A successful response returns the current MFA config. An error like "FRONTEGG_CLIENT_ID and FRONTEGG_SECRET environment variables are required" means the env vars didn't reach the MCP — double-check spelling and that you restarted the client after editing the config.

FAQ & troubleshooting