Connect Amplitude SCIM to Claude: Sync Groups and Directory Roles

If your IT or DevOps team needs to connect Amplitude SCIM to Claude to automate user onboarding, manage permission groups, or audit directory roles, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's function calls and Amplitude's SCIM REST API. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL. If your team uses ChatGPT, check out our guide on connecting Amplitude SCIM to ChatGPT or explore our broader architectural overview on connecting Amplitude SCIM to AI Agents.

Giving a Large Language Model (LLM) read and write access to your identity management infrastructure is an engineering challenge. SCIM (System for Cross-domain Identity Management) is a standardized protocol, but every vendor implements its schema constraints and patch operations slightly differently. You have to handle API token lifecycles, map SCIM RFC 7643 JSON schemas to MCP tool definitions, and deal with strict validation rules. Every time you need to expose a new directory operation, you have to update your custom server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Amplitude SCIM, connect it natively to Claude Desktop, and execute complex identity management workflows using natural language.

The Engineering Reality of the Amplitude SCIM API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools via JSON-RPC 2.0, the reality of implementing it against specialized B2B APIs is painful. SCIM APIs are designed for automated identity providers (IdPs) like Okta or Azure AD - not for non-deterministic AI agents.

If you decide to build a custom Amplitude SCIM MCP server, here are the specific integration challenges you will face:

Email as the Primary Identifier Standard SCIM implementations typically assign a system-generated UUID to every user record. Amplitude SCIM deviates from this by using the user's email address (case-insensitive) as the primary id. If an LLM assumes standard SCIM behavior and attempts to query or patch a user using an internal UUID, the request will fail. Your MCP server must explicitly inject schema descriptions that instruct the LLM to pass email addresses into id parameters.

Complex JSON Patch Operations Modifying groups or partially updating users in SCIM requires using the HTTP PATCH method with a specific Operations array. For example, to add a user to a group, the payload must look exactly like this: {"schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [{"op":"add","path":"members","value": [{"value":"user@company.com"}]}]}. LLMs are notoriously bad at guessing deeply nested, protocol-specific payload structures. Without highly enriched JSON Schema definitions provided by the MCP server, Claude will likely hallucinate a standard REST PUT payload (e.g., {"members": ["user@company.com"]}) which Amplitude will reject with a 400 Bad Request.

Implicit Invite Workflows In Amplitude SCIM, creating a user does not just silently create a database record - it triggers an email invitation. The user sits in a pending state until they accept. Furthermore, groups are ignored during the user creation phase; you must create the user first, and then execute a secondary group update operation to add them to a permission group. An LLM needs explicit tool descriptions to understand this multi-step state machine.

Rate Limits and 429 Handling When automating bulk directory audits, AI agents can easily trip rate limits. It is critical to understand that Truto does not retry, throttle, or apply backoff on rate limit errors. When Amplitude SCIM returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit info into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller (your LLM orchestration framework or Claude itself) is strictly responsible for interpreting these headers and executing retry/backoff logic.

How Managed MCP Servers Work for Amplitude SCIM

Instead of writing custom Express.js or Python API wrappers to translate Claude's tool calls into SCIM requests, Truto handles the translation dynamically.

Truto derives MCP tool definitions directly from the underlying API documentation and schemas. When Claude connects to the Truto MCP URL, it sends an initialize request. Truto responds with a tools/list payload containing exactly how to call Amplitude SCIM operations.

When Claude executes a tool (e.g., update_a_amplitude_scim_group_by_id), Truto intercepts the JSON-RPC call, maps the flat arguments into the required SCIM query parameters and nested body structures, injects the correct authentication headers, executes the request against Amplitude, and returns the result to Claude.

Creating the Amplitude SCIM MCP Server

You can generate an MCP server for your connected Amplitude SCIM account in two ways: via the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

1. Log into your Truto dashboard and navigate to the integrated account page for your Amplitude SCIM connection.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration. You can optionally filter tools by method (e.g., read-only) or set an expiration date for the server.
5. Click Create and copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Via the Truto API

If you are provisioning AI workspaces dynamically, you can generate the MCP server via a REST call.

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Amplitude SCIM Directory Admin",
    "config": {
      "methods": ["read", "write"]
    }
  }'

The API validates the configuration, stores a hashed token in Cloudflare KV, and returns the secure url you will use to connect Claude.

Connecting the MCP Server to Claude

Once you have your Truto MCP URL, connecting it to Claude takes seconds. You can do this through the Claude UI or via a local configuration file.

Method 1: Via the Claude UI (Claude for Enterprise / Team)

1. In your Claude environment, navigate to Settings -> Integrations.
2. Click Add MCP Server or Add custom connector.
3. Paste the Truto MCP URL you generated.
4. Save the configuration. Claude will immediately handshake with the server and load the Amplitude SCIM tools.

Method 2: Via Manual Configuration File (Claude Desktop)

For local development with Claude Desktop, you must configure the MCP server using the official Server-Sent Events (SSE) transport wrapper provided by the MCP specification.

Open your claude_desktop_config.json file (located at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows) and add the following:

{
  "mcpServers": {
    "amplitude_scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/YOUR_TRUTO_TOKEN"
      ]
    }
  }
}

Restart Claude Desktop. The Amplitude SCIM tools will now appear as an available integration in your prompt interface.

Amplitude SCIM Hero Tools

Truto automatically generates a comprehensive suite of tools for Amplitude SCIM. Here are the highest-leverage operations for AI-driven identity management.

list_all_amplitude_scim_users

Fetches a list of all users in the Amplitude organization, including both joined and pending (invited) users. This tool supports standard SCIM filtering.

Contextual usage notes: The SCIM filter syntax is strict. Instruct the LLM to use exact matches, such as userName eq "jane@acme.com". The response includes the id (which is the email), userName, name, and active status.

"Check if anyone with the domain @partneragency.com currently has an active user account or pending invite in Amplitude."

get_single_amplitude_scim_user_by_id

Retrieves the full SCIM profile for a specific user, including the permission groups they belong to.

Contextual usage notes: Do not let the LLM guess UUIDs. The id parameter for this tool must be the user's email address.

"Pull the full Amplitude profile for alex.smith@company.com and tell me exactly which groups he is a member of."

create_a_amplitude_scim_user

Provisions a new user in Amplitude by sending them an email invitation.

Contextual usage notes: The id and userName must both be the user's email address. Group memberships passed in this payload are ignored by Amplitude's SCIM implementation. You must use the group update tool to assign roles after creation.

"Invite new_hire@company.com to Amplitude. Her name is Sarah Connor."

amplitude_scim_users_partial_update

Executes a SCIM PATCH operation to partially update a user's record. This is the primary method for de-provisioning users.

Contextual usage notes: To remove a user from the organization or revoke a pending invite, the LLM must construct a patch operation setting active to false. The email itself cannot be changed once created.

"Revoke the Amplitude invitation for contractor@external.com immediately by setting their active status to false."

list_all_amplitude_scim_groups

Retrieves a list of all permission groups defined in Amplitude.

Contextual usage notes: This tool is critical for discovery. Before an LLM can add a user to "Product Managers", it must first list the groups to find the exact internal id of that group. The response includes the group id, displayName, and an array of members.

"List all available Amplitude SCIM groups and show me the IDs for any groups related to Data Science or Analytics."

update_a_amplitude_scim_group_by_id

Executes a SCIM PATCH operation to add or remove members from a specific permission group.

Contextual usage notes: The LLM must pass the correct group id (obtained from listing groups) and an Operations array containing the email addresses of the users to add or remove.

"Add dev.team@company.com to the group with ID '12345' using a SCIM add operation."

For a complete list of all available tools, endpoints, and schema requirements, view the Amplitude SCIM integration page.

Workflows in Action

By chaining these tools together, Claude can execute complex, multi-step identity lifecycles entirely through natural language.

Workflow 1: Zero-Touch Employee Onboarding

When a new employee joins, an IT admin needs to invite them to Amplitude and assign them to the correct departmental group.

"We just hired Marcus. Please invite him to Amplitude (marcus.jones@company.com, Marcus Jones). Once invited, find the 'Marketing Analysts' group and add him to it."

Step-by-step execution:

1. Claude calls create_a_amplitude_scim_user with the schema, email, and name. Amplitude sends the invite.
2. Claude calls list_all_amplitude_scim_groups applying a filter (or scanning the list) to find the ID for "Marketing Analysts".
3. Claude calls update_a_amplitude_scim_group_by_id using the located group ID, passing a PATCH operation to add marcus.jones@company.com to the members path.

Result: The admin receives a confirmation that Marcus was invited and successfully mapped to the correct group, bypassing the need to log into the Amplitude admin console.

sequenceDiagram
    participant Admin as IT Admin (Claude)
    participant MCPServer as "MCP Server"
    participant Amplitude as "Amplitude SCIM"
    
    Admin->>MCPServer: create_a_amplitude_scim_user (marcus.jones@...)
    MCPServer->>Amplitude: POST /Users
    Amplitude-->>MCPServer: 201 Created (Pending Invite)
    MCPServer-->>Admin: Success
    
    Admin->>MCPServer: list_all_amplitude_scim_groups
    MCPServer->>Amplitude: GET /Groups
    Amplitude-->>MCPServer: 200 OK (List of groups)
    MCPServer-->>Admin: Group ID: 98765
    
    Admin->>MCPServer: update_a_amplitude_scim_group_by_id (98765, add member)
    MCPServer->>Amplitude: PATCH /Groups/98765
    Amplitude-->>MCPServer: 200 OK
    MCPServer-->>Admin: Workflow Complete

Workflow 2: Automated Access Auditing and Offboarding

Security teams frequently need to audit who has access to specific tools and quickly revoke access for departing contractors.

"List everyone in the 'External Contractors' Amplitude group. If contractor_beta@vendor.com is in there, revoke their Amplitude access completely."

Step-by-step execution:

1. Claude calls list_all_amplitude_scim_groups to find the "External Contractors" group ID.
2. Claude calls get_single_amplitude_scim_group_by_id to retrieve the list of members for that specific group.
3. Claude parses the member list. Upon finding contractor_beta@vendor.com, it calls amplitude_scim_users_partial_update.
4. The agent passes a PATCH operation setting "active": false for that specific user email.

Result: Claude audits the group, identifies the target, and de-provisions the user entirely from the Amplitude instance in seconds, generating an audit trail of the actions taken.

Security and Access Control

When exposing corporate directories to AI agents, least-privilege access is non-negotiable. Truto provides several mechanisms to lock down your MCP servers at the infrastructure level:

• Method Filtering: You can configure an MCP token to only allow specific operations. Setting methods: ["read"] ensures the LLM can only execute list and get operations, making the server strictly read-only for safe directory auditing.
• Tag Filtering: If your integration configuration groups resources by functional tags, you can restrict the MCP server to only expose tools associated with specific tags.
• require_api_token_auth: By default, possession of the cryptographic MCP URL grants access. Enabling require_api_token_auth forces the client to also pass a valid Truto API token in the Authorization header, adding a strict second layer of identity verification.
• expires_at: You can set an exact ISO datetime for the MCP server to self-destruct. This is highly effective for granting temporary break-glass access to an AI agent for a specific incident response window.

Wrapping Up

Connecting Amplitude SCIM to Claude transforms how IT and RevOps teams manage identity and analytics access. By leveraging a managed MCP server, you remove the heavy lifting of OAuth token management, SCIM specification mapping, and API lifecycle maintenance.

Instead of wrestling with JSON Patch payloads and rate limit architectures, your engineering team can focus on building intelligent, automated compliance and onboarding workflows. Your AI agents get secure, deterministic access to the tools they need to act as an extension of your IT administration team.