Apono Assist MCP Server – JIT Access Requests
Apono Assist MCP Server brings Apono's just-in-time access request workflow into MCP-compatible AI clients. It lets users request access, check request status, and inspect available resources while keeping access controlled by Apono policies and audit logging.
Overview
Apono Assist MCP Server connects AI clients to Apono's just-in-time access workflows. Apono documents the server as a way to initiate and review access requests directly inside tools such as Cursor, GitHub Copilot, and Claude Desktop. Its purpose is not to bypass approval processes, but to make Apono's existing access controls easier to use from an AI-assisted workflow.
What the MCP server enables
The server exposes Apono access-request capabilities as MCP tools. Documented commands include user_create_request for submitting a just-in-time access request, user_get_request_status for checking the current status of a request, user_get_access_details for retrieving request details and secure Apono Portal links, and user_apono_assist for exploring integrations, resources, and permissions available to the authenticated user. Apono notes that credentials are not exposed to the AI tool; the server returns secure links, commands, or portal references instead.
When to use it
Use Apono Assist when an engineer, operator, or analyst needs short-lived access to infrastructure, databases, cloud resources, or other systems governed by Apono policies. Practical prompts include asking the agent to request access to a named resource for one hour, list available resources, or check the status of an existing request. It is especially useful when access requests are part of incident response, DevOps troubleshooting, or routine privileged-access workflows.
Connection and authentication
Apono documents two implementation types: stdio for local desktop clients and http for web-based clients or cases where the Apono CLI cannot run locally. The local stdio setup is recommended where possible. It requires the Apono CLI, with a documented minimum version of 1.3.1, and users authenticate by running apono login, which opens a browser-based SSO flow. The MCP client then launches the server with the apono mcp command.
Key considerations
Access remains governed by Apono policies, user permissions, and approval workflows. The AI client may ask for tool authorization, and Apono recommends allowing tools deliberately so users keep control over when actions run. For security reasons, Apono Assist only has visibility into the user's own requests and cannot query or duplicate requests made by other users. Apono also documents that Assist does not currently support bundles. For remote HTTP use, a Personal API Token is required and token generation must be explicitly enabled for the organization.
Supported Transports
stdio
Command: apono
Args:
mcp
Frequently Asked Questions
- When should an AI agent use Apono Assist MCP Server?
- Use it when the agent needs to help a user request just-in-time access, inspect accessible resources, retrieve secure access details, or check the status of an Apono access request without leaving the AI client.
- What does this MCP server add to an AI agent's capabilities?
- It gives the agent access to Apono's access-request workflow through documented MCP tools for creating requests, checking request status, retrieving request details, and exploring available integrations, resources, and permissions.
- What can the AI agent access or manage through this server?
- The agent can work with the authenticated user's own access requests and available resources. Apono documents that it cannot query or duplicate other users' requests and that it does not expose credentials directly to the AI tool.
- How is authentication configured for this MCP server?
- For the recommended local stdio setup, install Apono CLI version 1.3.1 or later and run `apono login` to authenticate through the browser-based SSO flow before the MCP client starts `apono mcp`.
- Which transport should be used for this MCP server?
- Use `stdio` for most desktop clients because Apono recommends it when possible and the documented configuration launches `apono mcp` locally. Apono also documents a remote HTTP option for web-based clients, but this YAML includes only the fully documented local stdio command.