Okta

Okta identity directory molecule for SixDegree. Discovers users and groups; exposes lifecycle actions (deactivate, activate, reset password, group membership) over MCP.

• Discovery: OktaUser, OktaGroup (with MEMBER_OF, REPORTS_TO, MANAGED_BY relations). Cross-system identity links (SAME_AS, MAPS_TO) link Okta users to GitHub / Jira / Slack / PagerDuty identities via custom profile attributes.
• MCP: 5 tools (3 Mutate, 2 actually Mutate Destructive, 1 Operation).

Name	Category	Risk	Purpose
okta_deactivate_user	Mutate	Destructive	Off-board a user (loses SSO access immediately).
okta_activate_user	Mutate	Write	Activate a STAGED / DEPROVISIONED user.
okta_reset_password	Operation	Write	Trigger password reset (email or one-time URL).
okta_assign_to_group	Mutate	Write	Add user to group; picks up group's app assignments.
okta_remove_from_group	Mutate	Destructive	Remove user from group; revokes downstream access.

Either an OAuth-resolved bearer token or an SSWS admin token authenticates; the org URL is always required.

Field	Required	Purpose
oauth_token	one-of	Bearer token populated by the platform's Okta OAuth flow. Preferred.
token	one-of	Okta SSWS admin API token. Fallback.
org_url	yes	Org URL, e.g. https://acme.okta.com. Validated against vendor domain.
include_groups	no	Include group entities and membership relations. Default true.

Declares an okta OAuth provider on both Discovery and MCP capabilities. AuthURL/TokenURL are tenant-specific (https://{org}.okta.com/oauth2/v1/{authorize,token}); operators substitute {org} for their Okta tenant subdomain. Scopes: okta.users.read, okta.users.manage, okta.groups.read, okta.groups.manage.

The molecule is consumed by the SixDegree platform via the molecule registry. See the main README for monorepo build and registry instructions.

• AGENTS.md — tool taxonomy and contribution rules.
• Okta API docs.
• License: Apache-2.0.