# Atlan MCP connector

The Atlan connector brings Atlan users, groups, roles and SSO group mappings into Claude, ChatGPT, Cursor and other MCP clients, so your team can manage who has access to the data catalog by asking in plain language.

Source: https://elaichi.ai/connectors/atlan/

## Facts

| | |
| --- | --- |
| Application | Atlan |
| Category | Knowledge Management |
| AI tools | 17 |
| Authentication | Connects with an API key |
| Needs your own OAuth app | No |
| MCP endpoint | https://api.elaichi.ai/mcp |
| Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent |
| Tools advertised by name | Yes |

## What you can ask once Atlan is connected

- List all Atlan groups and their member counts.
- Which Atlan users hold an admin role?
- Add the new analysts to the Atlan governance group.

## Connect Atlan in Elaichi

This happens once for the organization, before any client is involved.

1. Open Connections, choose Add connection, and pick Atlan.
2. Optionally set Share with, then press Connect.
3. Paste an Atlan API key. One person generates a token in Atlan and pastes it once. Everyone else works through Share with, and never sees it.

Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which Atlan tools are exposed, rename them, or freeze arguments before anyone points a client at it.

## Connect Atlan to Claude

Endpoint: https://api.elaichi.ai/mcp

1. Open Customize, then Connectors.
2. Press Add.
3. Name it, paste the MCP server URL, then Continue.
4. Sign in and approve.

On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves.

## Connect Atlan to ChatGPT

Endpoint: https://api.elaichi.ai/mcp

1. Open Plugins, then press the + button.
2. Name it and paste the endpoint into Server URL.
3. Leave Authentication on OAuth, then tick the risk acknowledgement.
4. Press Create, then sign in and approve.

Works on the web today. The plugin directory lives at chatgpt.com/plugins.

## Connect Atlan to Cursor

Endpoint: https://api.elaichi.ai/mcp

1. Open `~/.cursor/mcp.json`.
2. Add the endpoint under `mcpServers`.
3. Reload Cursor, then sign in and approve.

Set up per machine, so repeat it on each computer you work from.

## Connect Atlan to any MCP client

Endpoint: https://api.elaichi.ai/mcp

1. Add the endpoint as a remote MCP server.
2. Sign in and approve.

The Elaichi Agent already has these tools, with nothing to set up.

## What the consent screen decides

Only Read is granted by default, which is not enough to call a Atlan tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone.

## What teams do with Atlan through Elaichi

### Onboard a new analyst into Atlan

Data governance. Create the person's Atlan user, add them to the right groups and set their role in one conversation, instead of clicking through the admin console.

### Keep SSO group mappings in step

IT. Check which identity provider groups map to which Atlan groups, then add, update or remove a mapping when a team is renamed or reorganized.

### Review who holds admin roles in Atlan

Security. List every Atlan user and their groups, then spot people whose role no longer matches their job and change it on the spot.

### Stand up a group for a new domain

Data platform. Create an Atlan group for a new data domain, describe it, and pull in the stewards and consumers who need to be members.

### Clean up access when someone moves teams

People operations. Ask which Atlan groups a person belongs to and remove them from the ones tied to their old team, with the change recorded against your name.

### Answer who can see what in Atlan

Analytics leadership. Get the members of any Atlan group and the roles available in your tenant without asking an administrator to export a list.

## Frequently asked questions

### How do I connect Atlan to Claude?

Connect Atlan in Elaichi first: you paste an Atlan API key from your Atlan tenant, and there is no OAuth application to register and no client ID or secret to generate. Then open Claude, go to Customize, then Connectors, then Add, and paste the Elaichi endpoint, https://api.elaichi.ai/mcp. Sign in as yourself and Atlan is available in your next conversation.

### Does Atlan work with ChatGPT and Cursor as well as Claude?

Yes. Once Atlan is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client and the Elaichi Agent. You connect Atlan once and every client you use picks it up.

### What can an AI agent actually do with my Atlan data?

Through this connector an agent works with the people side of Atlan: users, groups, roles and SSO group mappings. It can create a user and add them to groups, change someone's role, create or update a group and see who is in it, remove members, list the roles in your tenant, and create, update or delete the mappings between your identity provider groups and Atlan groups. It does not manage catalog assets, glossaries or lineage through this connector.

### Does connecting Atlan give the AI access to my whole Atlan tenant?

No. Every request runs under the Atlan API key of the person who connected, so the agent can only do what that key is allowed to do in Atlan. Elaichi can narrow that further by turning off individual actions for a team, and it can never grant more than the key already has.

### Can my team share one Atlan connection?

Yes. One administrator connects Atlan with an API key and shares the connection with a team in Elaichi, and nobody else on the team ever handles the key. Each person still signs in to Elaichi as themselves, so the audit log names who created a user or changed a group, not just the shared connection.

### Can I stop an agent from deleting or changing things in Atlan?

Yes. Restrictions in Elaichi apply per action, so you can allow listing Atlan users and groups while blocking deleting SSO group mappings, removing members or changing roles. A blocked action is never advertised to Claude, ChatGPT or Cursor, so no prompt can reach it.

### What happens to an Atlan connection when someone leaves?

Offboarding a person in Elaichi ends their access to Atlan through every client at once. If they had shared an Atlan connection with a team, it keeps working for everyone else. If you want it gone entirely, disconnecting Atlan once in Elaichi removes it from Claude, ChatGPT, Cursor and every other client.

## All 17 Atlan tools

Every tool below is callable through https://api.elaichi.ai/mcp once Atlan is connected, subject to the toolbox it is in and the restrictions on the caller.

- **Create a Atlan group** (Create). Create a new group in Atlan by wrapping group details in a group object with attributes (alias and isDefault as arrays of strings) and an internal name. Returns: group. Required: group.attributes.alias, group.name. The internal name must be unique, all lowercase, and include only alphanumeric characters and the underscore (_).
- **List all Atlan groups** (List). List all groups in Atlan. Returns group records including id, path, name, attributes (alias, isDefault, description), roles, and createdAt. Supports sorting by a property such as createdAt and column projection to restrict the fields returned.
- **Atlan groups get by name** (Get). Retrieve groups in Atlan by name using a contains (ilike) search on the alias field. Returns a list of matching group records including id, path, name, attributes (alias, isDefault, description), roles, and createdAt. Required: filter.
- **Atlan groups get members** (Get). List users that are members of an Atlan group by providing the group's GUID. Returns each member user's id, username, and email. Required: group_id.
- **Update a Atlan group by ID** (Update). Update an Atlan group's attributes such as description and default group status. Returns: id, path, attributes. Required: id, path. The path must be the internal group name prefixed with /, and all attribute values are arrays of strings.
- **Atlan groups remove users** (Delete). Remove one or more users from an Atlan group by specifying their user GUIDs. Returns an empty 204 response on success. Required: group_id, users.
- **Create a Atlan user** (Create). Invite a user to Atlan by wrapping user details in a users array. Returns an empty 204 response on success. Required: users (each with email, role, and roleId). Role must be one of $admin, $member, or $guest. Look up role GUIDs via GET /api/service/roles.
- **List all Atlan users** (List). List all users in Atlan with support for filtering by username or email. Returns: id, username, email. Default sort is by username.
- **Atlan users get groups** (Get). Retrieve the groups a user is a member of in Atlan. Returns: id, name, path, attributes. Required: user_id.
- **Atlan users add to groups** (Add). Add a user to one or more groups in Atlan. Returns an empty 204 response on success. Required: user_id, groups.
- **Atlan users change role** (Action). Change the workspace role of a user in Atlan. Returns an empty 204 response on success. Required: user_id, roleId. Look up role GUIDs via GET /api/service/roles.
- **List all Atlan roles** (List). List all workspace roles in Atlan. Returns: id, name. The id is the role GUID needed for user creation and role changes. No caller-supplied parameters beyond pagination.
- **Create a Atlan SSO group mapping** (Create). Create a new SSO group mapping in Atlan that links an identity-provider group to an Atlan group. Returns: identityProviderAlias, identityProviderMapper, id, name, config. Required: sso_alias.
- **Get single Atlan SSO group mapping by ID** (Get). Get a single SSO group mapping in Atlan by its map identifier. Returns: identityProviderAlias, identityProviderMapper, id, name, config. Required: sso_alias, id.
- **List all Atlan SSO group mappings** (List). List all SSO group mappings for a given identity provider in Atlan. Returns: identityProviderAlias, identityProviderMapper, id, name, config. Required: sso_alias.
- **Update a Atlan SSO group mapping by ID** (Update). Update an existing SSO group mapping in Atlan, typically to change the mapped SSO group name. Returns: identityProviderAlias, identityProviderMapper, id, name, config. Required: sso_alias, id.
- **Delete a Atlan SSO group mapping by ID** (Delete). Delete an SSO group mapping in Atlan by its map identifier. Returns an empty 204 response on success. Required: sso_alias, id.