Connect Atlan to ChatGPT: Manage User Roles and Group Governance

If you need to connect Atlan to ChatGPT to automate user provisioning, audit workspace groups, or orchestrate SSO identity mappings, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's tool calls and Atlan's REST APIs. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

If your team uses Claude, check out our guide on connecting Atlan to Claude or explore our broader architectural overview on connecting Atlan to AI Agents.

Giving a Large Language Model (LLM) read and write access to an active data governance platform like Atlan is an intense engineering challenge. You must handle complex identity resolution, strictly formatted resource payloads, and multi-step dependency graphs (like looking up role GUIDs before creating users). Every time an LLM attempts an operation, your custom server must accurately parse and execute the specific nuances of the Atlan API.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Atlan, connect it natively to ChatGPT, and execute complex governance workflows using natural language.

Stop writing boilerplate API integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds. :::

The Engineering Reality of the Atlan API

A custom MCP server is a self-hosted integration layer that translates an LLM's JSON-RPC tool calls into vendor-specific HTTP requests. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against the Atlan API introduces strict integration challenges.

If you decide to build a custom MCP server for Atlan, you own the entire API execution lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with Atlan's identity APIs:

Role GUID Translation

When an LLM attempts to create a user in Atlan, it natively wants to pass a role string like $admin or $member. However, Atlan's API rejects string-based role assignments in user creation payloads. The API strictly requires the underlying roleId (a unique GUID). Your custom MCP server must implement logic to explicitly instruct the LLM to first execute GET /api/service/roles, parse the response to map the string role to the correct GUID, and then pass that GUID into the user creation payload. If your server doesn't enforce this dependency chain in its schema definitions, the LLM will hallucinate invalid role strings and the API will reject the request.

Polymorphic Group Attributes

Atlan's group creation and update endpoints utilize a highly specific nested object structure for attributes. Standard boolean or string fields are represented as arrays of strings. For example, setting an alias and a default flag requires the payload: attributes: { alias: ["Marketing Data"], isDefault: ["false"] }. Building an MCP tool schema that correctly forces an LLM to wrap single values into string arrays requires manual JSON Schema overrides. If the LLM passes isDefault: false directly, the payload fails validation.

Strict Internal Naming Conventions and Paths

Atlan groups require an internal name and a corresponding path. The internal name must be globally unique, entirely lowercase, and contain only alphanumeric characters and underscores. The path attribute must exactly match the internal name prefixed with a forward slash (e.g., /marketing_data). Your MCP server must either enforce these strict string validation rules via regex in the JSON Schema or intercept the LLM's input and sanitize it before transmitting the request to Atlan.

Raw Rate Limit Transparency

Atlan enforces strict rate limits on its API to ensure platform stability. When integrating via Truto, it is critical to understand that Truto does not retry, throttle, or apply backoff on rate limit errors. When Atlan returns an HTTP 429 Too Many Requests, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller (your application or the LLM framework) is entirely responsible for reading the ratelimit-reset header and implementing its own retry or backoff logic.

The Managed MCP Approach with Truto

Instead of forcing your engineering team to build, host, and maintain custom JSON-RPC routers and schemas for Atlan, Truto handles the infrastructure.

When you connect an Atlan instance to Truto, Truto dynamically derives MCP tool schemas directly from the documented integration resources. It reads the specific query and body parameters, maps them to JSON Schema, injects necessary LLM instructions (like "always return pagination cursors unchanged"), and exposes a secure /mcp/:token endpoint.

How to Create the Atlan MCP Server

Truto scopes each MCP server to a single integrated account (a connected Atlan instance). The generated server URL contains a cryptographic token that securely authenticates the request and routes it to the specific tenant.

You can generate this server using the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

For internal ops teams or one-off AI agent configurations, you can spin up a server in seconds from the dashboard.

1. Navigate to the Integrated Accounts page in your Truto dashboard and select the connected Atlan account.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration (e.g., restrict to read methods only, or filter by specific tags like users).
5. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/abc123xyz...).

Method 2: Via the Truto API

For platforms provisioning AI agents programmatically for end-users, you can generate MCP servers via a simple API call. The endpoint dynamically creates the token, stores the configuration, and returns the active URL.

Request:

curl -X POST https://api.truto.one/integrated-account/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Atlan Governance Agent",
    "config": {
      "methods": ["read", "write", "custom"]
    }
  }'

Response:

{
  "id": "mcp_srv_987654",
  "name": "Atlan Governance Agent",
  "config": { "methods": ["read", "write", "custom"] },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

How to Connect the MCP Server to ChatGPT

Once you have the secure Truto MCP URL, you need to register it as a tool provider for ChatGPT. You can connect it natively through the ChatGPT interface, or via a configuration file if you are running a local ChatGPT-compatible agent client.

Method 1: Via the ChatGPT UI

If you are using ChatGPT (Pro, Plus, Team, or Enterprise accounts with Developer mode enabled):

1. Open ChatGPT and navigate to Settings → Apps → Advanced settings.
2. Enable the Developer mode toggle.
3. Under MCP servers / Custom connectors, click to add a new server.
4. Provide a Name (e.g., "Atlan Governance Tools").
5. Paste the Truto MCP URL into the Server URL field.
6. Click Save. ChatGPT will immediately handshake with the URL, fetch the available Atlan tools, and make them available in your session.

Method 2: Via Manual Config File

If you are using a local agent framework, Cursor, or a desktop client that utilizes standard MCP configuration files, you establish the connection using the Server-Sent Events (SSE) transport adapter.

Add the following configuration to your glama.json or equivalent agent config file:

{
  "mcpServers": {
    "atlan_governance": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Note: Because Truto embeds the routing and authentication token directly into the URL, you do not need to pass additional bearer tokens in the environment variables unless you explicitly enabled require_api_token_auth.

Hero Tools for Atlan Governance

Truto auto-generates tools from the Atlan API. Here are the highest-leverage tools available for orchestrating governance and identity operations.

1. list_all_atlan_roles

Retrieves the core workspace roles available in the Atlan instance. This tool is a critical prerequisite for modifying user access, as it provides the specific role GUIDs (id) needed for creation and update payloads.

"Fetch all the workspace roles in Atlan and give me the exact ID for the $admin role."

2. create_a_atlan_user

Invites a new user to the Atlan workspace. The LLM must pass an array of users containing the email, the string role, and the specific roleId retrieved from the roles list.

"Invite john.doe@company.com to Atlan as a member. Look up the member role ID first, then execute the user creation."

3. create_a_atlan_group

Provisions a new group in Atlan. This tool handles the strict formatting requirements of the Atlan API, enforcing that the internal name is lowercase and the attributes (like alias and isDefault) are passed as arrays of strings.

"Create a new Atlan group called 'Data Engineering Core'. Set its internal name to 'data_eng_core' and make sure the alias is applied correctly."

4. atlan_groups_get_members

Audits a specific group by returning a list of all assigned users, including their IDs, usernames, and email addresses. Requires the group's unique GUID.

"Get the group ID for 'Marketing Data', then list out all the email addresses of the users currently in that group."

5. atlan_users_add_to_groups

Assigns an existing user to one or more Atlan groups. Essential for JML (Joiner, Mover, Leaver) automation workflows where users need access to specific data domains.

"Add the user with the email sarah.smith@company.com to the 'Finance Analytics' group."

6. create_a_atlan_sso_group_mapping

Binds an external Identity Provider (IdP) group (like Okta or Entra ID) to an internal Atlan group. This allows enterprise IT teams to manage access via SSO dynamically.

"Create an SSO group mapping linking our Okta group 'okta-data-stewards' to the internal Atlan group 'data_stewards'."

To view the complete inventory of Atlan tools, including update operations, removal endpoints, and detailed schema parameters, visit the Atlan integration page.

Workflows in Action

When you expose these granular tools to ChatGPT, the LLM can chain them together to solve complex governance requests that would normally require manual clicks through the Atlan admin console.

Workflow 1: Onboarding a New Data Steward

When an IT admin asks ChatGPT to provision a new user and assign them to a specific domain group, the agent orchestrates multiple API calls to resolve identities and apply permissions.

"Invite alex.cho@ourcompany.com to Atlan as a member, and immediately add him to the 'Data Stewards' group."

Execution Steps:

1. The agent calls list_all_atlan_roles to find the specific GUID for the $member role.
2. It calls create_a_atlan_user using the retrieved role GUID and the provided email address.
3. It calls atlan_groups_get_by_name using a contains search on the alias "Data Stewards" to retrieve the group's GUID.
4. It calls atlan_users_add_to_groups using the new user's ID and the target group ID.

sequenceDiagram
    participant User as ChatGPT User
    participant ChatGPT as ChatGPT (MCP Client)
    participant Truto as Truto MCP Server
    participant Atlan as Atlan API

    User->>ChatGPT: "Invite alex.cho..."
    ChatGPT->>Truto: call list_all_atlan_roles
    Truto->>Atlan: GET /api/service/roles
    Atlan-->>Truto: [{ name: "$member", id: "guid-123" }]
    Truto-->>ChatGPT: Returns role GUID
    
    ChatGPT->>Truto: call create_a_atlan_user
    Truto->>Atlan: POST /api/service/users
    Atlan-->>Truto: 204 Success (User ID: u-456)
    Truto-->>ChatGPT: Returns User ID
    
    ChatGPT->>Truto: call atlan_groups_get_by_name
    Truto->>Atlan: GET /api/service/groups?search=Data Stewards
    Atlan-->>Truto: [{ name: "data_stewards", id: "grp-789" }]
    Truto-->>ChatGPT: Returns Group ID
    
    ChatGPT->>Truto: call atlan_users_add_to_groups
    Truto->>Atlan: POST /api/service/users/u-456/groups
    Atlan-->>Truto: 204 Success
    Truto-->>ChatGPT: Success response
    ChatGPT-->>User: "Alex has been invited and added to Data Stewards."

Workflow 2: Auditing and Pruning Group Access

Governance requires strict offboarding. A compliance manager can ask ChatGPT to audit a highly privileged group and remove unauthorized users.

"Check who is currently in the 'Production Admin' group. If you see 'temp.contractor@company.com', remove them from the group immediately."

Execution Steps:

1. The agent calls atlan_groups_get_by_name to resolve the internal GUID for "Production Admin".
2. It calls atlan_groups_get_members using that GUID to retrieve the roster of active users.
3. The LLM analyzes the returned array and identifies the target user's GUID.
4. It calls atlan_groups_remove_users passing the group GUID and the targeted user GUID to strip their access.

Security and Access Control

Giving an LLM write access to your primary data governance platform requires strict security boundaries. Truto provides four key configuration options at the MCP token level to constrain the agent's blast radius:

• Method Filtering (config.methods): Restrict the server to specific operation types. Setting this to ["read"] ensures the agent can list groups and users but cannot create, update, or delete them.
• Tag Filtering (config.tags): Limit the tools exposed to the LLM based on functional tags. You can configure the server to only expose tools tagged with users and completely hide tools related to SSO mappings.
• Expiration (expires_at): Assign a strict Time-to-Live (TTL) for the server. Useful for temporary contractor access or time-boxed audit workflows; the server automatically destroys itself when the timestamp passes.
• API Token Authentication (require_api_token_auth): By default, the cryptographic MCP URL is the only auth required. Enabling this flag forces the client to also pass a valid Truto API token via a standard Bearer header, adding a mandatory second layer of authentication.

Connect Atlan to ChatGPT today and stop writing integration boilerplate. Generate a secure, managed MCP server for your AI agents with Truto.

Stop writing boilerplate API integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds. :::