Available Tools

SailPoint provides more than one MCP server. Each server has its own URL and its own set of tools. To connect to a server, refer to Getting Started.

Server	Global URL	Tools
Access Requests	https://mcp.sailpoint.com/latest/access-requests/mcp	list-requestable create-access-request view-access-requests cancel-access-request
Identity Intelligence	https://mcp.sailpoint.com/latest/intelligence/mcp	get-identity-intelligence get-identity-resource

---

Access Requests Server

The Access Requests server provides integration with SailPoint's Request Center, enabling automated access management through four core tools.

This server supports the following operations:

• Search for requestable access items
• Create access requests
• View access request status
• Cancel pending access requests

list-requestable

Search for requestable objects (roles, entitlements, access profiles) in the SailPoint Request Center and list the available accounts for each.

Limitations

Tool results are limited to 25 items per call, but a total count is provided so that the tool can be re-tried with a more refined query.

Parameters

Parameter	Type	Required	Description
query	string	No	Search term to filter by name and description

Response

{
  "results": [
    {
      "id": "string",
      "type": "string", 
      "name": "string",
      "accountSelectionRequired": "boolean",
      "accounts": [
        {
          "sourceId": "string",
          "sourceName": "string", 
          "accountsOnSource": [
            {
              "nativeIdentity": "string",
              "accountName": "string"
            }
          ]
        }
      ]
    }
  ],
  "accessItemsWithError": [
    {
      "accessItem": "object",
      "errorMessage": "string"
    }
  ],
  "resultsCount": "number",
  "totalCount": "number"
}

Response Fields

• id: Unique identifier of the requestable object
• type: Type of the requestable object
• name: Name of the requestable object
• accountSelectionRequired: Whether account selection is required
• accounts: List of accounts grouped by source system
  • sourceId: Unique identifier of the source system
  • sourceName: Name of the source system
  • accountsOnSource: Accounts associated with the source
    • nativeIdentity: Native identity in the source system
    • accountName: Name of the account
• accessItemsWithError: Items that couldn't be resolved due to misconfiguration
• resultsCount: Count of results returned (max 25)
• totalCount: Total count matching the search query

---

create-access-request

Create a new access request in the SailPoint Request Center for a single requestable item.

Parameters

Parameter	Type	Required	Description
id	string	Yes	ID of the item to request access for
type	string	Yes	Type of access request item (ROLE, ENTITLEMENT, or ACCESS_PROFILE)
accounts	array	Conditional	A mapping of sourceId to nativeIdentifier to select accounts to use when creating the access request. If account selection is required, a single, valid nativeIdentifier must be specified for each sourceId. If no nativeIdentifier is found for the source, pass only the sourceId.

accounts Array Structure

Field	Type	Required	Description
sourceID	string	Yes	Unique identifier of the source system
nativeIdentifier	string	No	Native identity of the user in the target system

Response

{
  "status": "success|error",
  "accessRequestId": "string",
  "errorMessage": "string"
}

---

view-access-requests

Retrieve the status of access requests in the SailPoint Request Center.

Limitations

Search is limited to 100 access requests, sorted by most recent first.

Parameters

Parameter	Type	Required	Description
accessRequestId	string	No	Access request ID to filter by

Response

{
  "requests": [
    {
      "accessRequestId": "string",
      "name": "string",
      "type": "string", 
      "description": "string",
      "state": "string",
      "modified": "timestamp",
      "created": "timestamp",
      "status": "string"
    }
  ]
}

Response Fields

• accessRequestId: Unique identifier of the access request
• name: Name of the requestable object
• type: Type of the requestable object
• description: Description of the requestable object
• state: Current state of the access request
• modified: Timestamp of last modification
• created: Timestamp of creation
• status: Current status of the access request

---

cancel-access-request

Cancel a specific access request by ID.

Parameters

Parameter	Type	Required	Description
accessRequestId	string	Yes	ID of the access request to cancel
comment	string	No	Optional comment for the cancellation

Auto-generated Comments

The system automatically adds "Canceled by AI on behalf of the user adam.archer" as a comment, either standalone or appended to any provided comment.

Response

{
  "status": "success|error",
  "errorMessage": "string"
}

---

Error Handling

All Access Requests tools return a consistent error structure when operations fail:

{
  "status": "error",
  "errorMessage": "Description of the error"
}

Common error scenarios include:

• Invalid or missing required parameters
• Access denied to requested resources
• Network connectivity issues
• Misconfigured requestable objects

---

Identity Intelligence Server

The Identity Intelligence server provides two read-only tools that AI clients can use to investigate human identities in Identity Security Cloud (ISC). The tools do not change data in your tenant.

This server supports the following operations:

• Get the full intelligence package for one identity: profile, access, risk, and access history
• Get one paginated sub-resource for an identity: accounts, rare access, access items, or certifications

Human identities only

The Identity Intelligence server currently supports only human identities.

Required access

The token or OAuth session that you use must have the sp:identity-sec-intel:read scope. This is the least permissive scope for this server. sp:scopes:all also works. It must also carry a user identity, so use an OAuth session or a personal access token (PAT). Your tenant must also have the MCP Server and Response and Remediation licenses.

get-identity-intelligence

Retrieve the full intelligence package for one human identity. The package includes the identity's profile, access, risk, and access history.

Parameters

Pass exactly one of id or email.

Parameter	Type	Required	Description
id	string	Conditional	ID of the human identity
email	string	Conditional	Email address of the human identity

Plain values only

Pass id and email as plain strings, for example 2c9180835d2e5168015d32f890ca1581 or adam.archer@example.com. Do not use list-filter syntax such as id eq "<id>" or email eq "<email>".

---

get-identity-resource

Retrieve one paginated sub-resource for a human identity. Use this tool when you need more detail than get-identity-intelligence returns, or when you need to page through a long list.

Parameters

Parameter	Type	Required	Description
resource	string	Yes	Sub-resource to retrieve: accounts, rare-access, access-items, or certifications
identityId	string	Conditional	ID of the human identity. Use on the first page only.
email	string	Conditional	Email address of the human identity. Use on the first page only.
nextUrl	string	Conditional	HAL continuation link from the previous page's response. Use to get the next page.
limit	integer	No	Page size, from 1 to 100

Pagination

1. For the first page, pass resource and either identityId or email.
2. If the response contains a continuation link, pass that link as nextUrl to get the next page.
3. Repeat step 2 until the response does not contain a continuation link.