Duo MCP Server — Tool Authorization
flowchart LR Tools["111 Duo MCP tools
admin · auth · device · dng
oidc · passport · logsync · intel"] --> Rubric{"onboarding
auto-tier rubric"} Rubric --> T1["T1 · birthright
Read 47 · LogSync 5"]:::t1 Rubric --> T2["T2 · requestable
Write 19 · Auth 4"]:::t2 Rubric --> T3["T3 · JIT · .adm
Admin 13 · DNG 6 · Intel 7"]:::t3 Rubric --> T4["T4 · JIT+alert · .adm
IAMData 6 · Secrets 4"]:::t4 T1 & T2 & T3 & T4 --> PEP["agentgateway 0.12.0
Duo Authorization Connector (ext_authz PDP)"] PEP -->|"sponsor groups ∩ allowed(group,tool)
default-deny"| Srv[("Duo MCP server
mcp_server_id: duo")] classDef t1 fill:#101b16,stroke:#2c623a,color:#e6edf3; classDef t2 fill:#1b2838,stroke:#3d6ea5,color:#e6edf3; classDef t3 fill:#201a10,stroke:#a98f2a,color:#e6edf3; classDef t4 fill:#25161a,stroke:#7a3038,color:#e6edf3;
| AD group | Tier | Provisioning | Scope | Tools |
|---|---|---|---|---|
| SG-MCP-Duo-Read | T1 | birthright | GET-only across admin/auth-status/device/dng-status/oidc/passport | 47 |
| SG-MCP-Duo-LogSync | T1 | birthright | aggregate Log Sync metrics/rollups/summary (no per-user PII) | 5 |
| SG-MCP-Duo-Write | T2 | requestable | non-destructive mutations: create/update user·group·policy·integration·device, enroll, sync · SoD ≠ Admin | 19 |
| SG-MCP-Duo-Auth | T2 | requestable | auth-challenge / verify / token-exchange actions (push, passcode, OIDC code) | 4 |
| SG-MCP-Duo-Admin | T3 | JIT · .adm | destructive: delete user·group·policy·integration·token·device, revoke sessions · SoD ≠ Write | 13 |
| SG-MCP-Duo-DNG | T3 | JIT · .adm | Duo Network Gateway config mutation (SSH/RDP/web relays) | 6 |
| SG-MCP-Duo-Intel | T3 | JIT · .adm | security-posture / diagnostics / adoption analytics (tenant recon surface) | 7 |
| SG-MCP-Duo-IAMData | T4 | JIT+alert · .adm | per-user behavioral log mining + raw-record export (exfil surface) | 6 |
| SG-MCP-Duo-Secrets | T4 | JIT+alert · .adm | credential material: integration secrets + bypass-code read/issue · break-glass | 4 |
Gateway-exposed tool names are duo_<toolname> (mcp_server_id duo + self-prefixed name → duo_duo_admin_*, cf. splunk_splunk_*). Expand a group for its exact tool set:
SG-MCP-Duo-Read T1 birthright · 47 tools
duo_dng_get_health, duo_dng_get_status, duo_dng_list_rdp_servers, duo_dng_list_relays, duo_dng_list_ssh_servers, duo_dng_list_web_applications, duo_duo_admin_get_admin, duo_duo_admin_get_authentication_attempts, duo_duo_admin_get_endpoint, duo_duo_admin_get_group, duo_duo_admin_get_group_users, duo_duo_admin_get_info, duo_duo_admin_get_integration, duo_duo_admin_get_phone, duo_duo_admin_get_policy, duo_duo_admin_get_settings, duo_duo_admin_get_telephony_credits, duo_duo_admin_get_token, duo_duo_admin_get_user, duo_duo_admin_get_user_devices, duo_duo_admin_list_activity_logs, duo_duo_admin_list_admin_logs, duo_duo_admin_list_admins, duo_duo_admin_list_auth_logs, duo_duo_admin_list_desktop_authenticators, duo_duo_admin_list_directory_syncs, duo_duo_admin_list_endpoints, duo_duo_admin_list_groups, duo_duo_admin_list_integrations, duo_duo_admin_list_offline_enrollment_logs, duo_duo_admin_list_phones, duo_duo_admin_list_policies, duo_duo_admin_list_telephony_logs, duo_duo_admin_list_tokens, duo_duo_admin_list_users, duo_duo_admin_list_webauthn, duo_duo_auth_auth_status, duo_duo_auth_check, duo_duo_auth_enroll_status, duo_duo_auth_ping, duo_duo_auth_preauth, duo_duo_device_get_devices, duo_duo_device_list_caches, duo_duo_oidc_get_auth_url, duo_duo_oidc_health_check, duo_duo_passport_get_user_sessions, duo_duo_passport_list_sessions
SG-MCP-Duo-LogSync T1 birthright · 5 tools
duo_duo_logsync_metrics_prometheus, duo_duo_logsync_report_rollups, duo_duo_logsync_report_summary, duo_duo_logsync_report_telephony, duo_duo_logsync_stats
SG-MCP-Duo-Write T2 requestable · 19 tools
duo_duo_admin_create_admin, duo_duo_admin_create_group, duo_duo_admin_create_integration, duo_duo_admin_create_phone, duo_duo_admin_create_policy, duo_duo_admin_create_user, duo_duo_admin_resync_token, duo_duo_admin_send_sms_activation, duo_duo_admin_sync_user_from_directory, duo_duo_admin_update_admin, duo_duo_admin_update_group, duo_duo_admin_update_integration, duo_duo_admin_update_policy, duo_duo_admin_update_user, duo_duo_auth_enroll, duo_duo_device_activate_cache, duo_duo_device_add_devices, duo_duo_device_create_cache, duo_duo_logsync_ingest
SG-MCP-Duo-Auth T2 requestable · 4 tools
duo_duo_auth_auth, duo_duo_auth_send_push, duo_duo_auth_verify_passcode, duo_duo_oidc_exchange_code
SG-MCP-Duo-Admin T3 JIT · .adm · 13 tools
duo_duo_admin_delete_admin, duo_duo_admin_delete_bypass_code, duo_duo_admin_delete_group, duo_duo_admin_delete_integration, duo_duo_admin_delete_phone, duo_duo_admin_delete_policy, duo_duo_admin_delete_token, duo_duo_admin_delete_user, duo_duo_admin_delete_webauthn, duo_duo_device_delete_cache, duo_duo_device_delete_devices, duo_duo_passport_revoke_session, duo_duo_passport_revoke_user_sessions
SG-MCP-Duo-DNG T3 JIT · .adm · 6 tools
duo_dng_create_rdp_server, duo_dng_create_ssh_server, duo_dng_create_web_application, duo_dng_delete_rdp_server, duo_dng_delete_ssh_server, duo_dng_delete_web_application
SG-MCP-Duo-Intel T3 JIT · .adm · 7 tools
duo_duo_adoption_report, duo_duo_compare_policies, duo_duo_diagnose_auth_failure, duo_duo_diagnose_integration, duo_duo_enrollment_trend, duo_duo_explain_policy, duo_duo_security_posture
SG-MCP-Duo-IAMData T4 JIT+alert · .adm · 6 tools
duo_duo_logsync_analytics, duo_duo_logsync_export_csv, duo_duo_logsync_report_anomalies, duo_duo_logsync_report_failures, duo_duo_logsync_search, duo_duo_logsync_user_baseline
SG-MCP-Duo-Secrets T4 JIT+alert · .adm · 4 tools
duo_duo_admin_create_user_bypass_codes, duo_duo_admin_get_integration_secret, duo_duo_admin_get_user_bypass_codes, duo_duo_admin_list_bypass_codes
Secrets (T4) — get_integration_secret and bypass-code read/issue never sit in a birthright read group; they are break-glass, JIT+alert, and must not overlap Read. IAMData (T4) — mining per-user behavioral logs or exporting raw auth records (logsync search/analytics/export) is the exfil surface, so it is JIT+alert, distinct from the aggregate LogSync metrics anyone can read. Admin (T3) — destructive deletes and session revokes bind to an .adm identity and must not overlap Write (separation of duties: the account that can create is not the account that can destroy). A human on their daily account — or an agent acting on-behalf-of them — inherits ≤ sponsor, so the tier wall holds for both.
Lane: personal lab · grayskull-track — reference architecture; SSOT is duo-authz-connector/policy/mcp-authz-intent.yaml, rendered to rendered/duo-mcpgw-policy.json. Duo group→tool policy is applied at Applications → MCP Servers (UI-only until Duo ships a policy API).