Keygen MCP integration for AI agents.
Connect AI agents to Keygen through 76 structured actions, including check in license, create component, ban user, and activate machine. Review authenticatio…
- ACTION CONTRACTS
- 76
- AUTHENTICATION
- API key
- SOURCE STATUS
- Provider-backed
CATALOG SOURCE REVIEWED AUGUST 23, 2026 / ACTION NAMES AND SCHEMAS DERIVED FROM WORKING MACHINES PROVIDER SOURCE
CAPABILITY PROFILE
What the Keygen integration exposes
The Keygen Agent App exposes 76 provider-backed actions for developer tools and security work. Its current contract lets an authorized agent check in a keygen license for policies that require periodic license check-ins, create a machine component in the connected keygen account, and ban a keygen user from authenticating. These operations are called through Working Machines as typed capabilities rather than through browser navigation or copied UI steps.
A connection uses API key. Before execution, the agent can inspect the selected action, its required fields, declared scopes, and expected output contract. Provider credentials remain inside the Working Machines runtime; the calling agent receives the capability and its structured result, not the underlying secret.
For reliable operation, start with the narrowest action that satisfies the task, resolve stable provider identifiers before changing state, and validate the returned object or status after execution. Availability still depends on the connected Keygen account, granted provider permissions, workspace policy, region, plan, and upstream API behavior.
VERIFIED ACTION SAMPLE
Real Keygen capabilities.
Showing 12 of 76 actions. Risk labels are conservative signals based on operation names, not substitutes for provider documentation or runtime policy.
check_in_licenseREADCheck in a Keygen license for policies that require periodic license check-ins.
INPUTS: id
create_componentWRITECreate a machine component in the connected Keygen account.
INPUTS: attributes / relationships / meta
ban_userHIGH IMPACTBan a Keygen user from authenticating.
INPUTS: id
activate_machineREVIEWActivate a machine in the connected Keygen account.
INPUTS: attributes / relationships / meta
attach_license_entitlementsREVIEWAttach entitlements to a Keygen license.
INPUTS: id / entitlementIds
attach_license_usersREVIEWAttach users to a Keygen license.
INPUTS: id / userIds
attach_policy_entitlementsREVIEWAttach entitlements to a Keygen policy.
INPUTS: id / entitlementIds
change_license_groupREVIEWChange the group assigned to a Keygen license.
INPUTS: id / groupId
change_license_ownerREVIEWChange the owner user for a Keygen license.
INPUTS: id / userId
change_license_policyREVIEWMove a Keygen license to another policy.
INPUTS: id / policyId
change_machine_groupREVIEWChange the group assigned to a Keygen machine.
INPUTS: id / groupId
change_machine_ownerREVIEWChange the owner user for a Keygen machine.
INPUTS: id / userId
INPUT CONTRACTS
Know what the action needs before it runs.
check_in_license
idOPTIONAL- The Keygen license resource ID.
create_component
attributesREQUIRED- JSON:API resource attributes to send to Keygen. Use the official attribute names for the target resource.
relationshipsOPTIONAL- JSON:API relationships to send to Keygen. Use standard relationship linkage objects from the Keygen API docs.
metaOPTIONAL- JSON:API meta fields to send to Keygen for this resource or action.
ban_user
idOPTIONAL- The Keygen user resource ID.
activate_machine
attributesREQUIRED- JSON:API resource attributes to send to Keygen. Use the official attribute names for the target resource.
relationshipsOPTIONAL- JSON:API relationships to send to Keygen. Use standard relationship linkage objects from the Keygen API docs.
metaOPTIONAL- JSON:API meta fields to send to Keygen for this resource or action.
PROVIDER-SPECIFIC WORKFLOWS
Jobs this Agent App can support
Inspect Check In License
Check in a Keygen license for policies that require periodic license check-ins. Use this as a bounded discovery step, retain the returned identifier, and avoid expanding the read beyond the task's stated scope.
check_in_licenseControl Create Component
Create a machine component in the connected Keygen account. Resolve the target first, present material changes for confirmation, and make retries idempotent where the provider supports it.
create_componentVerify with Create Component
Create a machine component in the connected Keygen account. Compare the returned provider state with the intended outcome and preserve stable IDs or canonical links in the run record.
create_componentSAFETY BOUNDARY
Operate Keygen with explicit limits
- Authorize Keygen with API key and grant only the provider access required by the selected actions.
- 27 actions are change-capable by name. Confirm the target identity and material parameters before allowing a write.
- Treat `ban_user`, `delete_component`, and `delete_entitlement` as high-impact operations and require an explicit approval boundary.
- No provider scope string is declared on the sampled actions. Verify the connected account's actual permissions in Keygen rather than assuming unrestricted access.
- After a call, inspect the structured result and execution record before reporting that the Keygen task completed successfully.
CONNECTION MODEL
API key
Keygen API token sent with the Authorization Bearer header. Generate an environment or product token from the Keygen dashboard or token API: https://keygen.sh/docs/api/authentication/
Working Machines stores provider credentials behind the execution boundary. An agent can use an authorized connection identity, but catalog discovery alone does not reveal OAuth tokens, API keys, or provider secrets.
- READ SIGNALS
- 22
- WRITE SIGNALS
- 17
- HIGH IMPACT
- 10
- REVIEW SIGNALS
- 27
EVIDENCE AND AVAILABILITY
Provider reference
Action names, input fields, authentication types, and counts on this page are generated from the Working Machines provider catalog. Provider behavior, quotas, object semantics, account eligibility, and regional availability remain governed by Keygen.