Skip to main content

Authenik8 Project Planner (MCP)

Coming Soon

The MCP integration is not ready yet. It stays locked until it passes a proven end-to-end acceptance.

Authenik8 Project Planner is the Authenik8 MCP app for ChatGPT. It knows the current Authenik8 contract: the identity engine's security invariants, the generated project presets, the OpenAPI surface, the installable browser client sources, and the Lovable integration boundary. It plans and validates your project before you build, and it is read-only: it never writes a repository, deploys anything, or handles credentials.

What you can do with it​

  • Plan a project (plan_authenik8_project) and validate the plan (validate_project_spec) before generating anything.
  • Generate the Lovable integration workflow (generate_lovable_integration), which returns the full contract and the installable @authenik8/api-client and @authenik8/contracts sources. Building the Lovable frontend does not require a generated project or a client export step.
  • Validate declared Lovable boundary decisions (validate_lovable_integration) against the security contract before release.
  • Read the underlying contract at any time through the app's resources: the core engine invariants, the OpenAPI 3.1 document, the Lovable prompt sequence, the frontend contract, and the security rules.

Connect it to ChatGPT​

  1. Open ChatGPT and enable Developer mode in your workspace settings.
  2. Go to Workspace settings → Apps → Create, choose the Authenik8 Project Planner connector (server name authenik8-project-planner), and complete the OAuth sign-in.
  3. Start a chat, make the app and Lovable available to the chat, and paste the prompt below.

Starter prompt​

You are planning an Authenik8 project. Authenik8 is an open-source identity
and authorization backend foundation generated by create-authenik8-app; the
identity engine is authenik8-core. Use your Authenik8 tools and resources.

1. Read the Authenik8 product and core resources (threat model, requirements,
   session control, agent identity).
2. Validate this plan with validate_project_spec, then report any issues:
   <paste your project plan here>
3. If the plan targets a Lovable frontend, generate the Lovable integration
   workflow with generate_lovable_integration.
4. Install the returned @authenik8/api-client and @authenik8/contracts
   sources verbatim into the frontend; never rewrite them.

Invariant: Authenik8 is the only identity and backend authority. Never
suggest Lovable Cloud auth, Supabase auth, a second users or sessions store,
browser token storage, or frontend route guards as authorization.

The app's tools cover product information, feature discovery, project planning, plan validation, contract retrieval, Lovable integration generation, and Lovable integration validation.

The boundary holds because of the client​

The app serves the real browser client, not instructions to reimplement one. The client keeps access tokens in memory, rotates refresh tokens through HttpOnly cookies, bootstraps CSRF, and coordinates across tabs. A frontend built against it cannot quietly grow a second auth system, because every protected call still goes through the Authenik8 API and is authorized there.

What it never does​

  • Never writes a repository or mutates a generated project
  • Never accepts shell commands, filesystem paths, or deployment credentials
  • Never handles production authentication traffic

The app plans and validates intent. The generated API and client remain the only runtime path for identity, sessions, and authorization. The one manual step is deploying the backend: generate the fullstack preset with create-authenik8-app on your host and set WEB_ORIGIN to the exact frontend origin.