Auth0 Agent Toolkit

independent prototype

Governed Auth0 capabilities for AI agents

Goal-oriented tools · real human approval · durable evidence

Give agents real Auth0 power. Keep humans in control.

A lifecycle layer for agents that need to operate an Auth0 tenant—not a wrapper around 327 endpoints. The agent proposes the complete change, a human approves that exact authority out of band, and every scoped action is receipted.

Open the live console Read the integration

Live tenant access is limited to Okta/Auth0 colleagues and invited guests. Sign in with a work email and one-time code; no password.

14
composite tools
3
toolsets
3
principal types
1
write gate

How it is built

One policy-bearing core. Thin surfaces everywhere else.

Hosts decide who is acting and which capability family is enabled. The registry projects the same tool definitions into every surface; the lifecycle, scope ceiling, and receipt policy never move into adapter code.

Composite by design. “Onboard this customer” is one resumable operation with a complete blast radius, not a model improvising four API calls.

Fail-closed by default. Principal, toolset, scope, token, and approval are separate layers. No single layer can silently stand in for another.

Open the interactive architecture map →

What it can do

Fourteen tools organized around human jobs.

Toolsets are the host’s grant unit. Each tool remains inspectable data with its own principal rules, scopes, approval annotation, and schema.

Tenant admin06

Customer lifecycle

Turn a B2B onboarding or offboarding goal into one reviewable operation instead of making the model sequence Management API endpoints.

  • Onboard an organization
  • Check onboarding status
  • List customers
  • Offboard safely
Try the admin console →org-admin
Admin or agent03

Security operations

Read real tenant logs, identify brute force or credential stuffing, then gate containment on an exact human-approved plan.

  • Query auth events
  • Analyze threat patterns
  • Remediate with approval
Investigate the tenant →security-ops
End user05

Identity self-service

Let people inspect and revoke their own access. The target subject is resolved by the server and never accepted from model input.

  • View profile
  • List sessions
  • Review connected apps
  • Revoke my access
Open My access →self-service

Who can act

Identity is part of the operation—not ambient context.

tenant-admin

Tenant operator

A role the host must authorize explicitly. Gets only the enabled toolsets and each tool’s declared scope ceiling.

end-user

Person managing their access

Requires a subject. Self-service targets are derived on the server, so a model cannot swap in another user.

agent

Autonomous actor

Carries a stable agent id and optional on-behalf-of user. Actor, subject, and human approver remain distinct.

Ways to use it

Interactive, local, hosted, or autonomous.

The human’s placement can change—from driving a chat to answering an overnight on-call push. The write gate does not.

01

Interactive

AI SDK copilot

/ai-sdk · /reactProject the registry into streamText(), then render plans, approval states, and receipts with the optional React kit.
02

Local

MCP stdio

/mcpGive an IDE or desktop agent the same filtered tools and tenant-admin read resources through a local MCP process.
03

Hosted

OAuth-protected MCP

/mcp/httpMount a fetch-native resource server with JWT verification, per-user scopes, server-fixed toolsets, and write policy.
04

Autonomous

Worker or workflow

package rootEmbed the framework-free core in cron jobs and long-running agents. A human can stay on the loop through Guardian.

Two reference apps · neither is legacy

Human in the loop, and human on the loop.

apps/demodeployed

Interactive product demo

The site you are viewing: admin chat, end-user access, live receipt trail, and the hosted MCP resource—all in one Next.js Cloudflare Worker.

person↔agent→phone approval
Open the console →
apps/sentineldeployable reference

Autonomous security agent

A separate cron-triggered Worker with no chat or client session. It investigates as an agent principal and asks a pinned on-call human before containment.

cron→agent→on-call approval
Read the Sentinel snippet →

shared invariantBoth hosts use the same registry, approval gate, scoped credentials, and hash-chained receipt model.

Toolkit services

The infrastructure an agent integration should not rebuild.

The core starts with no infrastructure and lets a host opt into only the pieces it needs. Cloudflare D1 is demo wiring, not a dependency of the package.

01

Tool registry

Immutable ToolSpec data drives every projection and the JSON contract.

02

Lifecycle gate

One ensureApproved() path owns planning, approval, single-use execution, and recovery.

03

Credential router

Principal-aware strategies select an exact-grant M2M client for each tool ceiling.

04

Approval engine

Auth0 CIBA + Guardian push, durable polling, exact approver and optional RAR verification.

05

Receipt ledger

Every transition and Management call enters one hash-chained, optionally signed trail.

06

Storage seam

Zero-infrastructure memory defaults plus a structural SQLite adapter used by Cloudflare D1.

Developer experience

Small host integration. Serious lifecycle.

The full reader now follows the current architecture: AI SDK, hosted MCP, self-service, Sentinel, custom tools, durable state, and the approval gate.

AI SDK host integrationone registry projection — seven real snippets
import { auth0 } from '@auth0/agent-toolkit/ai-sdk';
const result = streamText({
  model,
  system: auth0.systemPrompt(),
  tools: auth0.tools({
    // The host authorizes the role; the toolkit binds its authority.
    principal: { type: 'tenant-admin', user: session.user },
    writes: true,
  }),
  messages,
});
Explore seven annotated snippets →Browse the repository ↗

Prototype boundary

What exists today—and what is only designed.

Shipped in this repository
  • 14 composite tools and three principals
  • AI SDK, React, MCP stdio, and hosted MCP HTTP
  • Memory and SQLite-compatible lifecycle stores
  • Interactive demo and autonomous Sentinel reference
Designed—not implemented
  • MCP Apps widgets and owner-filtered component views
  • Sandboxed code mode for the Management long tail
  • Real XAA, OBO, and agent-grant credential strategies
  • Native framework adapters and a Python core

Independent working prototype; not an official Auth0 or Okta product. The package is not published to npm and the @auth0/ name is aspirational.

See the control loop

Plan it. Approve it on your phone. Verify every step.

Try the live tenant →My accessReceipt trailArchitecture map