Auth0 MCP Server

Why it got a B

Auth0's own MCP server (auth0/auth0-mcp-server, npm @auth0/auth0-mcp-server), which manages an Auth0 tenant through the Management API. This grade describes that server, not the separate auth0/agent-skills repo, which ships skills only. Login is the OAuth 2.0 device flow run by init, no scopes are selected by default (you choose them, for example --scopes 'read:*'), and tokens go to the system keychain until logout. Tools list, get, create and update applications, APIs, Actions and forms, deploy Actions, publish forms, create client grants, read logs, and write an app's credentials to a .env file. There is no delete tool, but the server does not ask before it writes: update_application, update_action, deploy_action, update_form and update_resource_server are flagged destructive, and any confirmation is up to your client. --read-only and --tools 'auth0_list_*,auth0_get_*' (also env vars) restrict it, and read-only wins when both are set. Runs locally over stdio, MIT, no advisories on record. Biggest deduction: it is still a beta (v0.1.0-beta.19) with its last commit 91 days before 2026-11-12, so maintenance sits in the 60-180 day band.