Title: Use Clerk's MCP server
URL Source: https://clerk.com/docs/guides/ai/mcp/clerk-mcp-server
Markdown Content:
Clerk provides a remote Model Context Protocol (MCP) server that allows AI agents like Claude, Cursor, and GitHub Copilot to work with your Clerk account and access Clerk SDK snippets.
The Clerk MCP server provides:
- Account tools: Create and configure applications, manage users, and set up production instances in your Clerk workspace.
- SDK snippet tools: Ready-to-use code patterns for common Clerk features.
All tools require you to sign in with your Clerk account.
The server requires you to sign in with the Clerk account you use for the Clerk Dashboard. Your AI client starts sign-in when it connects to the server, as shown in the setup instructions for each client. Sign-in opens your browser so you can:
- Sign in to Clerk.
- Select the workspace your agent can access.
- Review the requested permissions and select Allow.
Your client stores this access, so you don't need to sign in each time it connects. The server acts as you in the selected workspace, so it can only do what your workspace Role allows. It requests the following permissions:
| Scope | Allows the server to |
|---|
user:org:read | Identify the workspace you selected |
applications:read | Read the applications in that workspace |
applications:manage | Create applications and production instances, and read and change instance configuration, such as OAuth credentials |
users:read | List the users of an instance |
users:manage | Create users |
application_domains:read | Read domains, the DNS records they need, and their verification status |
application_domains:manage | Start a DNS check for a domain |
Tools that make changes are marked as such, so your AI client can ask you before it runs them.
| Tools | Description |
|---|
whoami | Show the connected user, workspace, and granted permissions. |
list_applications, get_application, create_application | List, inspect, and create applications. Results include each instance's publishable key. |
get_instance_config, get_instance_config_schema, patch_instance_config, put_instance_config | Read, update, or replace instance configuration, and read its schema. Preview changes with a dry run. |
list_users, create_user | Find users with filters and create users in an instance. |
list_domains, get_domain_status, check_domain_dns | Get the DNS records a domain needs, check its verification status, and request a new DNS check. |
get_deploy_oauth_providers, create_production_instance, set_oauth_provider_credentials | Create a production instance from development and configure production OAuth credentials. Creating a production instance can't be undone, so the tool requires confirm: true. |
configure_mcp_server, check_mcp_server | Register your own MCP server's URL as an OAuth resource on an instance, and check its public discovery. Preview changes with a dry run. See Configure authentication for your own MCP server. |
list_application_feedback | Read the feedback AI agents reported through your own MCP server, filtered by kind, impact, or user. To collect it, see Collect feedback from agents using your MCP server. |
submit_feedback | Report problems and missing documentation to the Clerk team. |
get_more_tools | Tell the Clerk team about a task none of the other tools can do. |
| Tool | Description |
|---|
clerk_sdk_snippet | Get a code snippet for a Clerk feature, or a bundle of snippets for a common setup, such as b2b-saas or organizations. |
list_clerk_sdk_snippets | List the available snippets and bundles, optionally filtered by tag. |
Once connected, you can ask your AI assistant questions such as:
- "Which Clerk applications do I have?"
- "Show the authentication settings for my development instance"
- "List the five most recent sign-ups"
- "Check which DNS records are required for production"
- "Summarize the feedback agents left on my production instance"
- "How do I use the useUser hook in Clerk?"
- "Show me how to set up B2B SaaS with Clerk Organizations"
configure_mcp_server registers an MCP server URL as an OAuth resource on an instance; pass dry_run: true to preview the change first, or replace_resource_url to replace a saved URL. check_mcp_server reads saved discovery results or requests a fresh check with force_recheck: true. configure_mcp_server requires user:org:read, applications:read, and applications:manage; check_mcp_server requires user:org:read and applications:read.
These tools configure Clerk for an MCP server you host. For the complete setup and implementation, follow Build and authenticate an MCP server with Clerk.
We recommend that all developers building with Clerk use the MCP server to get the best experience out of their agents.
The server works with your Clerk account, so it needs to know who you are and which workspace to use. Sign-in uses OAuth, so your AI client never handles your Clerk password.
Sign out of the Clerk MCP server in your AI client, then connect again and select a different workspace. If your client connects through mcp-remote, sign out by deleting the ~/.mcp-auth folder and restarting the client. This signs you out of every server you connect to through mcp-remote.
No. The MCP server never returns your instances' secret keys, including when it creates an application or a production instance. It also redacts sensitive values when it reads instance configuration. To add your keys to a project, copy them from the API keys page in the Clerk Dashboard or run clerk env pull.
Your workspace Role doesn't allow the request, or your connection is missing a permission the tool needs. To grant a missing permission, sign out of the Clerk MCP server in your AI client and connect again. If the error persists, ask a workspace Owner or Admin to check your Role.
Your agent can call submit_feedback when a Clerk task fails or needs a workaround, or when you ask it to report a problem. The report describes what your agent tried and what went wrong, and includes your user and workspace IDs. The server redacts recognizable credentials, such as API keys and tokens, before it stores the report.
Every tool asks your agent for a one-sentence context that describes what you're trying to do. Your agent writes this summary and is told to leave out names, email addresses, IDs, and secrets. When your agent calls a tool, the server sends the summary to Clerk for product analytics. The server also adds which tool your agent called, whether the call succeeded, your Clerk user ID, and your AI client's name, version, and OAuth client ID. It doesn't send the tool's inputs or results. When your agent calls get_more_tools, the server records the task it couldn't complete, so the Clerk team can see which tools to add next.
This usually indicates a network or transport issue. Try disconnecting and reconnecting the MCP server, and ensure your client supports Streamable HTTP transport.
No. Clerk's MCP server only supports Streamable HTTP transport, available at https://mcp.clerk.com/mcp.