Getting started with MCP
What is BalkanID MCP?
BalkanID MCP connects your BalkanID tenant to AI assistants that support the Model Context Protocol (MCP) — for example Claude, Claude Code, Cursor, VS Code, etc.
Once connected, you can ask natural-language questions and have the assistant securely call BalkanID tools on your behalf: discover identities and credentials, manage user access reviews, work with access requests, Purposes, and Constraints, and more — with the same authorization boundaries you already have in BalkanID.
You do not need to build custom integrations for each AI client. BalkanID hosts the MCP server; your assistant connects to it over HTTPS.
Who is it for?
Security and identity administrators investigating identities, connections, resources, and credentials across connected applications — including non-human identities (service accounts, bots) and credential risk
Integrations and platform owners listing application integrations and triggering syncs when data needs a refresh
HR / people operations admins listing and maintaining employee (HRIS) records used for ownership, requests, and reviews
Risk managers monitoring user access review (UAR) campaigns and managing JITPBAC Constraints
Reviewers and approvers working their review queue — approving, rejecting, or delegating access reviews and access requests
Employees and requesters creating Purpose requests and assigning or unassigning themselves from eligible Purposes under JITPBAC
Anyone who wants to run BalkanID workflows from their AI assistant without leaving the chat
Capabilities
With BalkanID MCP you can:
Discover identities, connections, resources, and credentials across connected applications
List and sync application integrations
Manage employee (HRIS) records (where your role allows)
Work with user access review (UAR) campaigns and review items
List, inspect, approve, reject, or delegate access requests
Work with JITPBAC Purposes and Constraints
For detailed scenarios and example prompts, see Workflows and Example Prompts.
How it works
An administrator enables MCP for your tenant (if it is not already enabled).
You connect your AI client to BalkanID — OAuth is the preferred method when your client supports it. API keys remain available for clients that need a static Bearer token.
You ask the assistant to perform BalkanID tasks in natural language.
The assistant calls BalkanID tools. Every call is authorized using your connection scopes and your BalkanID role.
Before you begin
An active BalkanID tenant with MCP enabled
A BalkanID user account (Reviewer, Risk Manager, or Administrator, depending on the tools you need)
An MCP-compatible AI client
Continue to Installation and Setup to connect your client. For org-wide deployment (Claude Enterprise, managed Claude Code), see Enterprise Rollout.
Related Documentation
Last updated
Was this helpful?