# Apono MCP connector The Apono connector brings Apono users, groups, access flows, bundles and activity reports into Claude, ChatGPT, Cursor and any MCP client, so your team can review, create and tidy access policies in plain language. Source: https://elaichi.ai/connectors/apono/ ## Facts | | | | --- | --- | | Application | Apono | | Category | IM | | AI tools | 48 | | Authentication | Connects with an API key | | Needs your own OAuth app | No | | MCP endpoint | https://api.elaichi.ai/mcp | | Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent | | Tools advertised by name | No. 48 tools is past the 30-tool threshold, so clients use `search_tools` and `execute_tool` | ## What you can ask once Apono is connected - Which Apono access flows grant production access this month? - List Apono groups with no members. - Summarize last week's Apono activity reports by requester. ## Connect Apono in Elaichi This happens once for the organization, before any client is involved. 1. Open Connections, choose Add connection, and pick Apono. 2. Optionally set Share with, then press Connect. 3. Paste an Apono API key. One person generates a token in Apono and pastes it once. Everyone else works through Share with, and never sees it. Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which Apono tools are exposed, rename them, or freeze arguments before anyone points a client at it. ## Connect Apono to Claude Endpoint: https://api.elaichi.ai/mcp 1. Open Customize, then Connectors. 2. Press Add. 3. Name it, paste the MCP server URL, then Continue. 4. Sign in and approve. On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves. ## Connect Apono to ChatGPT Endpoint: https://api.elaichi.ai/mcp 1. Open Plugins, then press the + button. 2. Name it and paste the endpoint into Server URL. 3. Leave Authentication on OAuth, then tick the risk acknowledgement. 4. Press Create, then sign in and approve. Works on the web today. The plugin directory lives at chatgpt.com/plugins. ## Connect Apono to Cursor Endpoint: https://api.elaichi.ai/mcp 1. Open `~/.cursor/mcp.json`. 2. Add the endpoint under `mcpServers`. 3. Reload Cursor, then sign in and approve. Set up per machine, so repeat it on each computer you work from. ## Connect Apono to any MCP client Endpoint: https://api.elaichi.ai/mcp 1. Add the endpoint as a remote MCP server. 2. Sign in and approve. The Elaichi Agent already has these tools, with nothing to set up. ## What the consent screen decides Only Read is granted by default, which is not enough to call a Apono tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone. ## What teams do with Apono through Elaichi ### Review who can request what Security. Ask which access flows exist, who they apply to and what they grant, then spot the one that has drifted from policy before it becomes a finding. ### Set up access for a new team IT. Describe the new team's needs and have the agent create the Apono group, bundle the resources they need and draft the access flow that ties them together. ### Pull an activity report before an audit Compliance. Create an Apono activity report for the quarter, fetch the results and get a plain summary of who was granted access to what, ready for the auditor. ### Adjust an on-call bundle in minutes Platform. Update the bundle your on-call engineers request when a new database or cluster comes online, without opening the Apono console. ### Clean up groups after a reorg IT. List every Apono group, find the ones nobody belongs to anymore and remove them, with each deletion recorded in the audit log. ### Check which systems Apono covers Security. Ask which cloud accounts and tools Apono is connected to and which user attributes are available, so you know where an access flow can actually reach. ## Frequently asked questions ### How do I connect Apono to Claude? Connect Apono in Elaichi by pasting an Apono API key, then open Claude, go to Customize, then Connectors, then Add, and paste the endpoint https://api.elaichi.ai/mcp. Apono connects with an API key, so there is no OAuth application to register and no client ID or secret to generate. Once the endpoint is in Claude, sign in to Elaichi and Apono is ready to use. ### Does Apono work with ChatGPT and Cursor as well as Claude? Yes. Once Apono is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client and the Elaichi Agent. You connect Apono once and every client you use picks it up. ### What can an AI agent actually do with my Apono data? With Apono connected, an agent can look up users and groups, list and explain access flows, create or update bundles of resources, and create, fetch or update activity reports. It can also tell you which systems Apono is connected to and which user attributes are available for policies. Because Apono exposes many actions, short concrete asks such as "list access flows for the finance group" work better than long paragraphs. ### Does connecting Apono give the AI access to every access flow and user? No. Every call to Apono runs inside the access of the person who signed in to Elaichi, so the agent sees only what that person's Apono API key can see. Elaichi can narrow that further by hiding actions or whole areas, but it can never widen what Apono itself allows. ### Can my team share one Apono connection? Yes. One person connects Apono in Elaichi and shares the connection with a team, and nobody else ever handles the Apono API key. Each teammate still signs in to Elaichi as themselves, so every change to an access flow, bundle or group is logged under their own name. ### Can I stop an agent from deleting or changing things in Apono? Yes. Restrictions in Elaichi apply per action, so you can allow reading Apono access flows and reports while blocking any create, update or delete. A blocked action is never advertised to Claude, ChatGPT or Cursor at all, so no prompt, however worded, can reach it. ### What happens to an Apono connection when someone leaves? Offboarding a person in Elaichi ends their access to Apono through every client at once, including Claude, ChatGPT, Cursor and the Elaichi Agent. If the Apono connection was shared, it keeps working for everyone else on the team. Disconnecting Apono once in Elaichi removes it from every client for everyone. ## All 48 Apono tools Every tool below is callable through https://api.elaichi.ai/mcp once Apono is connected, subject to the toolbox it is in and the restrictions on the caller. - **List all Apono users** (List). List users in Apono. Returns id, email, first_name, last_name, active status, roles, source_integration_id, source_integration_name, and attributes for each user. - **Get single Apono user by ID** (Get). Get information about a specific user in Apono using id. Returns fields such as id, email, first_name, last_name, active status, roles, and source_integration details. - **List all Apono groups** (List). List groups in Apono. Returns an array of groups with fields id, name, source_id, source_integration_id, and source_integration_name. - **Get single Apono group by ID** (Get). Get details about a specific group in Apono. Requires id. Returns id, name, source_id, source_integration_id, and source_integration_name. - **Create a Apono group** (Create). Create a group in Apono by providing name and members_emails. Returns id, name, source_id, source_integration_id, and source_integration_name in the response. - **Delete a Apono group by ID** (Delete). Delete a specific group in Apono using id. Returns no content on success. - **List all Apono activity reports** (List). List activity reports in Apono. Returns id, name, filters, timeframe, schedule, format, creation_date, and update_date for each report. - **Create a Apono activity report** (Create). Create an Activity Report in Apono. Requires name, filters, and timeframe. Returns id, name, filters, timeframe, schedule, format, creation_date, and update_date in the response. - **Get single Apono activity report by ID** (Get). Get a specific activity report in Apono by id. Returns fields such as id, name, filters, timeframe, schedule, format, creation_date, and update_date. - **Update a Apono activity report by ID** (Update). Update an existing activity report in Apono using id. Returns id, name, selected fields, filters, timeframe, schedule, format, creation_date, and update_date in the response. - **Delete a Apono activity report by ID** (Delete). Delete a specific activity report in Apono. Requires id. Returns a message confirming successful deletion. - **List all Apono attributes** (List). List attributes in Apono. Returns key fields including type, value, source_id, source_integration_id, and source_integration_name for each attribute. - **List all Apono access flows** (List). List access flows in Apono. Returns id, name, active status, triggers, access targets, approver policy, timeframe, and settings for each access flow. - **Create a Apono access flow** (Create). Create an access flow in Apono. Requires name, active, trigger, requestors, access_targets, settings, and request_for_others. Returns id, name, trigger, access_targets details, approver_policy, grant_duration_in_min, and timestamps for creation_date and update_date. - **Get single Apono access flow by ID** (Get). Get details of a specific access flow in Apono using id. Returns id, name, active status, trigger, approver_policy, access_targets, settings, and timeframe fields providing configuration and operational details. - **Update a Apono access flow by ID** (Update). Update an existing access flow in Apono using id. Returns fields such as name, active status, trigger, requestors, access_targets, approver_policy, grant_duration_in_min, timeframe, settings, creation_date, and update_date. - **Delete a Apono access flow by ID** (Delete). Delete an access flow in Apono using id. Returns no content when the deletion is successful. - **List all Apono bundles** (List). List bundles in Apono. Returns id, name, access_targets with integration details and access scopes, creation_date, and update_date for each bundle. - **Create a Apono bundle** (Create). Create a new bundle in Apono. Requires name and access_targets. Returns id, name, access_targets with integration and access_scope details, creation_date, and update_date. - **Get single Apono bundle by ID** (Get). Get details of a specific bundle in Apono by id. Returns id, name, access_targets (with integration and access_scope details), creation_date, and update_date fields in the response. - **Update a Apono bundle by ID** (Update). Update a specific bundle in Apono using id. Returns id, name, access_targets with integration and access_scope details, and timestamps (creation_date, update_date). - **Delete a Apono bundle by ID** (Delete). Delete a specific bundle in Apono using id. Returns no content on success. - **List all Apono connectors** (List). List connectors in Apono. Returns id, name, status, version, last_connected, is_latest_version, cloud_provider_type, and sessions details for each connector. - **Get single Apono connector by ID** (Get). Get details about a specific connector in Apono using id. Returns fields such as name, status, version, last_connected, is_latest_version, cloud_provider_type, and sessions with metadata like connector_version and cloud provider details. - **Update a Apono connector by ID** (Update). Update a specific connector in Apono by id. Requires id. Returns fields including id, name, status, version, last_connected, is_latest_version, cloud_provider_type, and sessions with detailed metadata for the connector. - **Delete a Apono connector by ID** (Delete). Delete a connector in Apono using id. Removes the connector resource permanently and returns no content in the response. - **List all Apono integrations** (List). List integrations in Apono. Returns fields such as id, name, type, category, status, last_sync_time, connector_id, integration_config, secret_store_config, connected_resource_types, custom_access_details, owner, and owners_mapping. - **Get single Apono integration by ID** (Get). Get details about a specific integration in Apono using id. Returns integration fields including name, type, category, connector_id, status, last_sync_time, integration_config, secret_store_config, connected_resource_types, custom_access_details, owner, and owners_mapping. - **Create a Apono integration** (Create). Create a new integration in Apono. Requires name and type. Returns id, name, type, category, status, connector_id, last_sync_time, integration_config, and secret_store_config details. - **Update a Apono integration by ID** (Update). Update an existing integration in Apono using id. Returns fields such as id, name, type, category, status, and configuration details defining the integration’s connection and access settings. - **Delete a Apono integration by ID** (Delete). Delete a specific integration in Apono. Requires id. Returns no content upon successful deletion. - **List all Apono access sessions** (List). List access sessions in Apono. Returns id, name, request_ids, integration details (id and name), credentials_status, and can_reset_credentials fields in the response. - **Get single Apono access session by ID** (Get). Get details of a specific access session in Apono using id. Returns id, name, request_ids, integration details, credentials_status, and can_reset_credentials fields in the response. - **List all Apono available access bundles** (List). List available-access-bundles in Apono. Returns a list of bundles with id and name fields in the response. - **List all Apono delegated access requests** (List). List delegated access requests in Apono. Returns id, status, duration_in_sec, justification, creation_date, revocation_date, access_groups (with integration and resource_types details), requestor, grantee, and bundle. - **Get single Apono delegated access request by ID** (Get). Get delegated access request in Apono using id. Returns id, status, duration_in_sec, justification, creation_date, revocation_date, custom_fields, access_groups, requestor, grantee, and bundle details. - **List all Apono access bundles** (List). List access-bundles in Apono. Returns each bundle with id, name, and details about integration_targets including integration_id, resource_type, tag filters, and permissions. - **Create a Apono access bundle** (Create). Create an access bundle in Apono. Requires name and integration_targets. Returns id, name, and integration_targets with their integration_id, resource_type, and permissions. - **Get single Apono access bundle by ID** (Get). Get details of a specific access-bundle in Apono by id. Returns id, name, and integration_targets including integration_id, resource_type, resource_tag_includes/excludes, and permissions. - **Delete a Apono access bundle by ID** (Delete). Delete an existing access bundle in Apono using id. Returns a message field confirming successful deletion. - **Update a Apono access bundle by ID** (Update). Update an existing access bundle in Apono by id. Returns id, name, and integration_targets with integration_id, resource_type, resource_tag_includes, resource_tag_excludes, and permissions. - **List all Apono access scopes** (List). List access scopes in Apono. Returns access scopes with fields id, name, query, creation_date, and update_date. - **Create a Apono access scope** (Create). Create an access scope in Apono using name and query. Returns id, name, query, creation_date, and update_date in the response. - **Get single Apono access scope by ID** (Get). Get details of a specific access-scope in Apono using id. Returns id, name, query, creation_date, and update_date fields. - **Update a Apono access scope by ID** (Update). Update an existing access scope in Apono using id. Returns id, name, query, creation_date, and update_date fields in the response. - **Delete a Apono access scope by ID** (Delete). Delete an access scope in Apono using id. Returns no content upon successful deletion. - **List all Apono activity** (List). List activity records in Apono. Returns request_id, request_date, requestor_name, requestor_email, integration, resource_type, resources, permissions, justification, status, trigger_type, and access_flow fields in the response. - **List all Apono identities** (List). List attributes for multiple identities in Apono. Returns each identity's email and associated attributes in the response.