Connect O'Reilly to Claude: Sync SCIM User Schemas and Profiles

If you need to connect O'Reilly to Claude to automate SCIM user provisioning, audit learning licenses, or manage identity schemas, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's tool calls and O'Reilly's SCIM (System for Cross-domain Identity Management) API. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL. If your team uses ChatGPT, check out our guide on /connect-o-reilly-to-chatgpt-automate-scim-user-lifecycle/ or explore our broader architectural overview on /connect-o-reilly-to-ai-agents-orchestrate-user-provisioning/.

Giving a Large Language Model (LLM) read and write access to an identity management endpoint is a high-stakes engineering challenge. You have to handle credential lifecycles, strictly adhere to SCIM v2.0 schema requirements, and manage exact-match filter syntax. Every time you need to expose a new capability, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for O'Reilly, connect it natively to Claude Desktop or web clients, and execute complex identity management workflows using natural language.

The Engineering Reality of the O'Reilly SCIM API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools over JSON-RPC, the reality of implementing it against a SCIM API like O'Reilly's is notoriously tricky.

If you decide to build a custom MCP server for O'Reilly, you own the entire API lifecycle. Here are the specific challenges you will face when translating LLM intent into SCIM compliance:

Strict Schema Namespaces and Complex Nesting SCIM APIs are heavily structured. You cannot just pass a flat JSON object like {"firstName": "John", "email": "john@example.com"}. Attributes are nested under specific schema namespaces (e.g., urn:ietf:params:scim:schemas:core:2.0:User). Furthermore, attributes like name are objects requiring familyName and givenName, while emails is an array of objects requiring value and a primary boolean. LLMs are highly prone to hallucinating flatter, REST-style payloads. Your MCP server must provide exhaustive JSON Schemas to force the model into SCIM compliance.

Filter Expression Quirks When listing or searching users, SCIM requires a specific filter syntax outlined in RFC 7644 (e.g., filter=userName eq "test@example.com"). LLMs often default to standard query parameters, attempting to send ?email=test@example.com, which the O'Reilly API will reject. The MCP tool definition must explicitly instruct the LLM on how to construct valid SCIM filter expressions.

Irreversible State Changes SCIM defines standard HTTP methods, but the execution differs. A DELETE request in O'Reilly's SCIM implementation permanently removes the provisioned user. If the goal is simply to revoke access without destroying historical learning data, the correct action is a PATCH or PUT request setting active: false. The LLM has no inherent context for this business logic unless the tool descriptions clearly define the blast radius of each operation.

Truto solves this by dynamically generating MCP tools directly from O'Reilly's documented resources. The LLM receives highly curated JSON Schemas with explicit instructions, ensuring it constructs valid SCIM requests on the first try.

Generating the O'Reilly MCP Server

Truto creates MCP servers dynamically based on your connected O'Reilly account. This server handles authentication and exposes O'Reilly SCIM endpoints as MCP tools. You can create this server via the Truto UI or programmatically via the API.

Method 1: Via the Truto UI

For ad-hoc agent configuration or internal administration, generating the server through the dashboard takes seconds.

1. Log into your Truto dashboard.
2. Navigate to the Integrated Accounts page and select your connected O'Reilly instance.
3. Click the MCP Servers tab.
4. Click Create MCP Server.
5. Select your desired configuration (e.g., limiting the server to read methods, or adding an expiration date).
6. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/abc123xyz...).

Method 2: Via the Truto API

If you are dynamically provisioning AI agents for your own customers, you can generate MCP servers programmatically. Send a POST request to the /integrated-account/:id/mcp endpoint.

curl -X POST https://api.truto.one/admin/integrated-accounts/{integrated_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "O-Reilly-SCIM-Agent",
    "config": {
      "methods": ["read", "write"]
    }
  }'

The API returns a secure, cryptographically hashed URL:

{
  "id": "mcp_abc123",
  "name": "O-Reilly-SCIM-Agent",
  "config": {
    "methods": ["read", "write"]
  },
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f6..."
}

This URL alone contains the necessary authentication payload for the MCP connection - no additional OAuth configuration is required on the client side.

Connecting the MCP Server to Claude

Once you have the O'Reilly MCP server URL, you need to provide it to your client. The connection process depends on how you are running Claude.

Option A: Via the Claude UI (or ChatGPT UI)

If you are using enterprise web clients that support remote MCP connectors (like Claude for Enterprise or ChatGPT Developer Mode):

For Claude:

1. Open Claude and navigate to Settings -> Integrations.
2. Click Add MCP Server (or Custom Connector).
3. Paste the Truto MCP URL generated in the previous step.
4. Click Add.

For ChatGPT:

1. Navigate to Settings -> Apps -> Advanced settings.
2. Enable Developer mode.
3. Under Custom connectors, select Add new server.
4. Name the server "O'Reilly" and paste the Truto MCP URL.
5. Save and connect.

Option B: Via Manual Configuration File (Claude Desktop)

If you are running Claude Desktop locally or configuring an open-source agent framework, you will configure the connection via a JSON file. Truto provides an SSE (Server-Sent Events) transport utility to connect local clients to the remote HTTP endpoint.

Open your claude_desktop_config.json file (typically located at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS) and add the following:

{
  "mcpServers": {
    "oreilly_scim": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/a1b2c3d4e5f6..."
      ]
    }
  }
}

Restart Claude Desktop. The application will initialize the connection, call the tools/list protocol method, and dynamically load the O'Reilly SCIM capabilities.

Core O'Reilly MCP Tools for Claude

Truto auto-generates tools based on O'Reilly's API documentation. The schemas explicitly instruct Claude on how to handle SCIM formatting requirements. Here are the highest-leverage hero tools for managing O'Reilly user identities.

1. List All O'Reilly SCIM Users (list_all_o_reilly_scim_users)

This tool retrieves a paginated list of SCIM users. It is critical for auditing active licenses and finding specific users based on SCIM filter expressions. Truto's schema instructs Claude to pass SCIM-compliant strings for the filter argument.

"Audit our O'Reilly account. List all active users by sending a SCIM filter where active eq true. Tell me how many licenses we are currently consuming."

2. Get Single O'Reilly SCIM User By ID (get_single_o_reilly_scim_user_by_id)

When Claude needs to inspect a specific user's attributes, group memberships, or external IDs, it uses this tool. It requires the internal O'Reilly SCIM id, which Claude typically fetches first via a search filter.

"Fetch the full SCIM profile for the user ID 987654321. I need to see their givenName, familyName, and the primary email address associated with the account."

3. Create a O'Reilly SCIM User (create_a_o_reilly_scim_user)

This tool provisions a new user in O'Reilly. Claude uses the provided JSON Schema to construct the complex payload, ensuring that the schemas array is populated and the name object is correctly nested.

"Provision a new O'Reilly learning account for Alice Smith. Her email is alice.smith@acmecorp.com. Ensure she is set to active and use her employee ID 'EMP-104' as the externalId."

4. Update a O'Reilly SCIM User By ID (update_a_o_reilly_scim_user_by_id)

This tool maps to the SCIM PUT method. It acts as a full replacement of the user record. Claude must provide the complete user object - any missing attributes will be overwritten as null.

"We need to do a full profile update for user 987654321. Replace their current profile data with the new JSON payload I provide, ensuring their externalId is updated to reflect the new HR system migration."

5. O'Reilly SCIM Users Partial Update (o_reilly_scim_users_partial_update)

This tool maps to the SCIM PATCH method, allowing Claude to update specific attributes without supplying the full user record. It is ideal for soft deactivations (setting active: false). Truto's schema warns Claude that only add and replace operations are supported.

"Deactivate the user account with ID 987654321. Execute a partial update to set their active status to false. Do not delete the account."

6. Delete a O'Reilly SCIM User By ID (delete_a_o_reilly_scim_user_by_id)

This tool permanently removes a user from O'Reilly. Because this action destroys historical data, it should be used cautiously. Truto's tool description explicitly warns the LLM that this action is irreversible.

"We need to execute a hard wipe for compliance reasons. Permanently delete the SCIM user with ID 987654321 from the O'Reilly system."

For the complete list of available O'Reilly operations, including schema retrieval and service provider configs, visit the O'Reilly integration page.

Workflows in Action

Connecting O'Reilly to Claude via MCP turns the LLM into an autonomous identity and access management administrator. Here is how Claude orchestrates multi-step SCIM operations based on natural language prompts.

Scenario 1: Automated Offboarding and License Reclamation

When an employee leaves the company, IT needs to revoke access to O'Reilly learning resources immediately without destroying their historical course data.

"Offboard John Doe from O'Reilly. His email is john.doe@acmecorp.com. Deactivate his account to reclaim the license, but do not delete his profile."

Step-by-step execution:

1. Claude calls list_all_o_reilly_scim_users passing the argument filter: "userName eq \"john.doe@acmecorp.com\"" to locate the user's internal ID.
2. Claude extracts the id (e.g., 554433221) from the response payload.
3. Claude calls o_reilly_scim_users_partial_update targeting that ID, passing a PATCH operation to set active: false.
4. Claude reads the 200 OK response and informs the user that the account has been successfully deactivated and the license freed.

Scenario 2: Batch Engineering Team Provisioning

When a new cohort of engineers is hired, provisioning them manually is tedious. Claude can handle the entire batch logic.

"Provision O'Reilly accounts for the three new engineers: sarah@acme.com, david@acme.com, and elena@acme.com. Make sure they are all active."

sequenceDiagram
    participant User
    participant Claude as Claude Desktop
    participant Truto as Truto MCP Server
    participant OReilly as "Upstream API (O'Reilly)"

    User->>Claude: "Provision 3 new engineers..."
    Claude->>Truto: Call create_a_o_reilly_scim_user (Sarah)
    Truto->>OReilly: POST /scim/v2/Users
    OReilly-->>Truto: 201 Created (ID: 101)
    Truto-->>Claude: Result: Success
    
    Claude->>Truto: Call create_a_o_reilly_scim_user (David)
    Truto->>OReilly: POST /scim/v2/Users
    OReilly-->>Truto: 201 Created (ID: 102)
    Truto-->>Claude: Result: Success
    
    Claude->>Truto: Call create_a_o_reilly_scim_user (Elena)
    Truto->>OReilly: POST /scim/v2/Users
    OReilly-->>Truto: 201 Created (ID: 103)
    Truto-->>Claude: Result: Success
    
    Claude-->>User: "All 3 engineers have been provisioned successfully."

Step-by-step execution:

1. Claude parses the prompt and iterates over the provided names.
2. Claude constructs the strict SCIM JSON schema required for creation (nesting the emails, setting the schemas array).
3. Claude calls create_a_o_reilly_scim_user sequentially for each user.
4. Claude returns a summary of the newly provisioned IDs back to the user.

Security and Access Control

Exposing identity management endpoints to an LLM requires strict boundary setting. Truto's MCP servers provide several layers of security configuration at the token generation stage to restrict what Claude can do.

• Method Filtering (config.methods): Restrict the server to specific HTTP operation types. By configuring an MCP server with methods: ["read"], you guarantee the model can only use list and get operations. Truto drops all write tools from the server payload entirely, preventing Claude from ever seeing or attempting a create or delete operation.
• Tag Filtering (config.tags): Limit the exposed tools by business domain. If O'Reilly resources are tagged in Truto (e.g., ["identity", "analytics"]), you can restrict the MCP server to only expose tools relevant to that tag group.
• Secondary Authentication (require_api_token_auth): By default, possessing the MCP URL grants access. For highly sensitive environments, setting this flag requires the connecting client to also pass a valid Truto API token in the Authorization header.
• Ephemeral Servers (expires_at): Generate time-bound access. By setting a strict ISO timestamp, the MCP server and its associated tools will auto-destruct when the time elapses. This is perfect for giving an AI agent temporary access during a scheduled IT audit.

Handling O'Reilly Rate Limits

When automating bulk user management, AI agents can easily generate requests faster than the upstream API allows. It is critical to understand how this infrastructure handles throttling.

Truto does not retry, throttle, or apply automatic backoff on rate limit errors.

If Claude dispatches too many requests and O'Reilly returns an HTTP 429 Too Many Requests response, Truto passes that error directly back to the caller. However, Truto normalizes the upstream rate limit telemetry into standardized IETF headers, regardless of how O'Reilly formats them natively.

Your client will receive standard headers:

• ratelimit-limit: The total requests allowed in the current window.
• ratelimit-remaining: The number of requests left.
• ratelimit-reset: The time when the quota refreshes.

Because the MCP standard returns API responses to the LLM context, Claude can read the error message indicating a 429. Depending on the agent framework managing Claude, it is the client's responsibility to pause execution, read the standardized reset headers, and apply backoff before resuming the tool call.

Moving Forward

Identity management is one of the most tedious, error-prone tasks for IT and HR teams. By connecting O'Reilly to Claude using a managed MCP server, you eliminate manual SCIM XML/JSON crafting and allow an AI agent to handle the lifecycle management conversationally.

Because Truto dynamically derives tools directly from API documentation, Claude always has the most accurate schema - preventing hallucinations and stopping bad data before it hits your directory.