---
title: Kron PAM MCP Server
slug: kronpam-reference-guide-3-9-0/kron-pam-mcp-server
docTags: 
createdAt: 2026-10-12T10:17:27.075Z
---

The Kron PAM MCP Server provides a standardized and secure interface to Kron PAM log data for artificial intelligence (AI) clients. The server implements the Model Context Protocol (MCP) specification, so AI agents and developer tools can query and analyze security events through a single interface.

The MCP Server provides governed, read-only access to Kron PAM logs. Human users and AI agents can retrieve operational and security data without changing Kron PAM. This model supports audit, compliance, and troubleshooting workflows.

**Key Capabilities**

•     **Token-based authentication** — Each user generates a time-bound access token from the Kron PAM interface and sends it as a bearer token in every request.

•     **Read-only access** — The server rejects every create, update, and delete operation, so an AI client never changes data in Kron PAM.

•     **Scoped authorization** — The server filters queries by the portal functions of the requesting user, so users can access only the data that their roles permit.

•     **Full auditability** — The server writes every request to the MCP audit trail, which administrators review on the **MCP Server Logs** page.

**Supported Log Sources**

The MCP Server exposes structured query endpoints for the log types listed in the following table.

**Table 1. Log Sources Available Through the MCP Server**

| **Log Source**                     | **Content**                                                                      |
| ---------------------------------- | -------------------------------------------------------------------------------- |
| User Authentication Logs           | Login attempts and authentication results for Kron PAM users.                    |
| Session Logs                       | Privileged sessions, including their start times, end times, and target devices. |
| HTTP Proxy Logs                    | Requests that pass through the Kron PAM HTTP proxy.                              |
| Activity (Event) Logs              | Commands and events that users run during their sessions.                        |
| TACACS+ and RADIUS Accounting Logs | Accounting records that network devices send to Kron PAM.                        |



This section documents the configuration files of Claude Desktop, Codex, and Antigravity. Other clients follow the same logic: the client configuration stores the address of the MCP endpoint, the transport method, and the authentication header.

:::hint{type="info"}
Every client connects over HTTPS. Kron PAM does not support plain HTTP connections to the MCP Server.
:::

### Request Flow

An MCP request passes through five stages:

1.    The AI client sends a structured MCP query to the MCP endpoint of Kron PAM.

2.    The client includes the access token in the Authorization: Bearer \<token> header.

3.    The MCP Server validates the token and confirms that the token matches the current token of the user.

4.    The server applies the authorization filters of the user and runs the read-only query.

5.    The server returns the response in a structured format and writes the request to the audit trail.