Connect Docker Hub SCIM to ChatGPT: Automate User Provisioning

If you want to connect Docker Hub SCIM to ChatGPT so your AI agents can provision developers, orchestrate offboarding, and audit team access, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between ChatGPT's tool calls and Docker Hub's SCIM (System for Cross-domain Identity Management) endpoints.

If your team uses Claude, check out our guide on connecting Docker Hub SCIM to Claude or explore our broader architectural overview on connecting Docker Hub SCIM to AI Agents.

Giving a Large Language Model (LLM) read and write access to your identity management infrastructure is a massive engineering challenge. You either spend weeks building, hosting, and maintaining a custom MCP server to map JSON arguments into strict SCIM schemas, or you use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for Docker Hub SCIM, connect it natively to ChatGPT, and execute complex identity workflows using natural language.

The Engineering Reality of the Docker Hub SCIM API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools over JSON-RPC, implementing it against a SCIM provider like Docker Hub introduces highly specific protocol complexities.

If you decide to build a custom MCP server for Docker Hub SCIM, you own the entire API lifecycle. Here are the specific integration challenges that break standard CRUD assumptions when working with SCIM endpoints:

The Strict SCIM PATCH Protocol (RFC 7644)

Unlike a standard REST API where you might issue a PATCH /users/123 with a simple JSON object {"active": false}, SCIM mandates a highly formalized operation array. To deactivate a user or change their name, you must construct an Operations array containing objects with op (e.g., replace), path, and value fields. If your MCP server accepts flat JSON from ChatGPT and fails to transform it into this specific schema, Docker Hub will reject the request. Building a custom MCP tool requires hardcoding this translation logic, which becomes brittle as you expose more attributes.

Opaque Schema URNs and Payload Validation

Every SCIM resource requires a schemas array in its payload that defines the structural definition of the data. For Docker Hub, creating a user requires passing specific URNs like ["urn:ietf:params:scim:schemas:core:2.0:User"]. An LLM has no inherent knowledge of these exact string values. If you do not embed these exact requirements into the JSON Schema of your MCP tool definitions, the LLM will hallucinate standard REST payloads, resulting in immediate 400 Bad Request errors.

Index-Based Pagination over Cursors

Standard modern APIs rely on cursor-based pagination (e.g., next_page_token). SCIM relies on a 1-based indexing system utilizing startIndex and count query parameters. When an LLM wants to iterate through hundreds of Docker Hub users, it needs to accurately calculate the next startIndex based on the previous response's itemsPerPage. If your MCP server does not abstract this or strictly enforce the pagination math, the LLM will repeatedly fetch the same page of users.

Rate Limiting and Backoff Mechanics

Identity APIs are strictly rate-limited to prevent abuse. Factual note on rate limits: Truto does not retry, throttle, or apply backoff on rate limit errors. When Docker Hub returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller (or the orchestration layer driving the LLM) is entirely responsible for retry and backoff logic. Truto does not absorb these errors.

Generating a Docker Hub SCIM MCP Server

Truto abstracts away the payload formatting, authentication, and endpoint routing. Tool generation is dynamic and documentation-driven. When you connect an integration, Truto generates MCP tools based on the API's available resources and documented schemas.

You can generate a scoped MCP server for Docker Hub SCIM in two ways: via the Truto UI or programmatically via the REST API.

Method 1: Via the Truto UI

For quick prototyping or manual setup, you can generate the server directly from the dashboard.

1. Log into your Truto account and navigate to Integrated Accounts.
2. Click on your connected Docker Hub SCIM account to open the detail page.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Select your desired configuration. You can optionally filter by specific methods (e.g., only read operations) or apply tag filters if you only want to expose specific resource groups.
6. Click Save and copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Via the Truto API

For production workflows or automated tenant provisioning, you can generate the MCP server programmatically.

You will need the integrated_account_id for the specific Docker Hub SCIM connection. Make a POST request to the Truto API to generate the server URL.

curl -X POST https://api.truto.one/integrated-account/<INTEGRATED_ACCOUNT_ID>/mcp \
  -H "Authorization: Bearer $TRUTO_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Docker Hub SCIM Provisioning Server",
    "config": {
      "methods": ["read", "write", "custom"]
    }
  }'

The API responds with a database record and a secure token URL. This URL handles the JSON-RPC routing and authentication dynamically. Treat this URL as a sensitive credential.

{
  "id": "mcp-7a8b9c0d-1234-5678",
  "name": "Docker Hub SCIM Provisioning Server",
  "config": {
    "methods": ["read", "write", "custom"]
  },
  "expires_at": null,
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f67890"
}

Connecting the MCP Server to ChatGPT

Once you have your Truto MCP URL, you must register it with your LLM client. You can do this through the ChatGPT interface or via a configuration file for custom clients.

Method A: Via the ChatGPT UI

If you are using a ChatGPT Pro, Plus, Business, Enterprise, or Education account, you can add custom connectors directly.

1. In ChatGPT, navigate to Settings -> Apps -> Advanced settings.
2. Toggle Developer mode to ON.
3. Under MCP servers / Custom connectors, click Add new server.
4. Enter a descriptive name (e.g., "Docker Hub Identity").
5. Paste the Truto MCP URL into the Server URL field.
6. Click Save.

ChatGPT will immediately perform a handshake with the Truto server, listing the available Docker Hub SCIM tools.

Method B: Via Manual Config File (SSE Transport)

If you are running a local agent, Claude Desktop, Cursor, or a custom orchestration framework that supports Server-Sent Events (SSE) for MCP, you can route it through a generic SSE client wrapper.

While Truto natively accepts HTTP POST requests for JSON-RPC, you can configure standard local clients using the @modelcontextprotocol/server-sse package to proxy requests to your Truto URL.

{
  "mcpServers": {
    "docker-hub-scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "--url",
        "https://api.truto.one/mcp/a1b2c3d4e5f67890"
      ]
    }
  }
}

graph TD
    A["ChatGPT / Claude Desktop<br>(MCP Client)"] -->|"JSON-RPC 2.0 over HTTP"| B["Truto MCP Router<br>(/mcp/:token)"]
    B -->|"Token Validation<br>Tool Generation"| C["Truto Proxy API Layer"]
    C -->|"SCIM PATCH/POST<br>OAuth Bearer"| D["Docker Hub SCIM API"]

Docker Hub SCIM Hero Tools

Truto dynamically generates snake_case tool names based on the integration label, resource name, and method. Here are the highest-leverage tools available for Docker Hub SCIM.

List All Docker Hub SCIM Users

list_all_docker_hub_scim_users

This tool retrieves a paginated list of users currently provisioned in the organization. It accepts startIndex and count parameters for SCIM-compliant pagination, as well as sorting parameters.

"Fetch the first 50 users from Docker Hub SCIM to check who is currently active on the engineering team."

Get Single Docker Hub SCIM User by ID

get_single_docker_hub_scim_user_by_id

Fetches the complete SCIM profile for a specific user using their unique Docker Hub ID. This is required before issuing updates to ensure you are modifying the correct entity.

"Retrieve the SCIM profile for the user with ID 8a7b6c5d-4e3f-2a1b to check their current group assignments."

Create a Docker Hub SCIM User

create_a_docker_hub_scim_user

Provisions a new user in Docker Hub. If the user already exists by email, Docker Hub assigns them to the organization on the default 'company' team. The tool automatically enforces the required schemas array and userName fields in the body payload.

"Provision a new Docker Hub user for alice.chen@example.com. Set her givenName to Alice and familyName to Chen."

Update a Docker Hub SCIM User by ID

update_a_docker_hub_scim_user_by_id

Updates an existing user. In the SCIM protocol, this is typically used to change a user's name or toggle their active status (activation/deactivation). The LLM will construct the necessary SCIM standard payload based on Truto's injected JSON Schema.

"Deactivate the Docker Hub account for user ID 8a7b6c5d-4e3f-2a1b because they have left the company."

List All Docker Hub SCIM Schemas

list_all_docker_hub_scim_schemas

Returns all SCIM schemas supported by the Docker Hub configuration. This is highly useful for autonomous agents that need to inspect the available attributes and extension URNs before constructing complex creation payloads.

"List all supported SCIM schemas for Docker Hub so I can format the enterprise extension attributes correctly."

For the complete tool inventory and detailed JSON Schema definitions, view the Docker Hub SCIM integration page.

Workflows in Action

By connecting these tools to ChatGPT, you can automate identity lifecycle management through natural language. Here are concrete examples of how an AI agent orchestrates SCIM operations.

Automated Employee Offboarding

When an engineer leaves the company, an IT administrator can ask ChatGPT to revoke their Docker Hub access without logging into the identity provider or writing a cURL script.

"Deactivate bob.smith@example.com in Docker Hub. Find his user ID first, then execute the update to set active to false."

Execution Steps:

1. ChatGPT calls list_all_docker_hub_scim_users, passing a filter query (if supported) or pulling the list to find the record matching bob.smith@example.com.
2. The agent parses the response to extract Bob's SCIM ID (e.g., user-12345).
3. ChatGPT calls update_a_docker_hub_scim_user_by_id, passing id: "user-12345" and the required SCIM schema payload setting "active": false.
4. The agent reports back: "Bob Smith has been successfully deactivated in Docker Hub."

Batch Developer Onboarding

During a hiring surge, a DevOps engineer can instruct the agent to provision multiple accounts and handle edge cases where users might already exist.

"Provision Docker Hub accounts for j.doe@example.com and s.connor@example.com. Check if they already exist first to avoid duplicates."

Execution Steps:

1. ChatGPT calls list_all_docker_hub_scim_users to cross-reference the requested emails against existing identities.
2. The agent determines neither user exists.
3. ChatGPT calls create_a_docker_hub_scim_user for J. Doe, supplying the required schemas array, userName, and name fields.
4. ChatGPT calls create_a_docker_hub_scim_user for S. Connor with the respective data.
5. The agent outputs a summary confirming both users were created and assigned to the default company team.

Security and Access Control

Exposing an enterprise SCIM integration to an LLM requires strict security guardrails. Truto's MCP architecture provides several layers of control to ensure your agents cannot execute destructive operations unless explicitly authorized.

• Method Filtering: When generating the MCP server, you can pass a config.methods array (e.g., ["read"]). This strictly limits the server to get and list tools. Write operations like create or delete are entirely excluded from the generated tool definitions, making it impossible for the LLM to modify data.
• Tag Filtering: You can restrict the MCP server to specific functional areas using config.tags. If you only want the LLM to access schema data and not user data, you can filter accordingly.
• Token URL Security: The generated URL contains a cryptographically hashed token linked to the specific integrated account. This means the server is fully self-contained. Deleting the MCP token from the Truto dashboard instantly invalidates the server.
• API Token Authentication: For elevated security, you can set require_api_token_auth: true during creation. This forces the MCP client to pass a valid Truto API token in the Authorization header, ensuring that URL possession alone is not enough to access the tools.
• Automatic Expiration: You can set an expires_at ISO datetime when generating the server. Truto's infrastructure will automatically delete the token and cleanup the storage entries at the specified time, which is ideal for temporary auditing sessions.

Orchestrating Identity with AI

Connecting Docker Hub SCIM to ChatGPT fundamentally changes how IT and DevOps teams manage identity. Instead of fighting with opaque SCIM schema structures, pagination math, and complex PATCH operations, you can rely on Truto's auto-generated tools to handle the protocol translations.

By leveraging Truto's MCP servers, your agents gain immediate, strictly-governed access to your provisioning workflows. You retain complete control over the token lifecycles and tool availability, while developers and admins gain the ability to manage infrastructure access using conversational prompts.