Connect PasskeyBridge to Claude
Add the read-only PasskeyBridge MCP connector to Claude, approve it with an administrator passkey, what each tool returns, and how to revoke it.
Overview
The PasskeyBridge connector is a remote MCP server at https://mcp.passkeybridge.io/mcp. It lets Claude read your organization's PasskeyBridge security data. Every tool is read-only: none of them changes data in PasskeyBridge.
Claude connects with OAuth 2.0 (authorization code with PKCE S256, dynamic client registration). Each connection is approved by one administrator of one organization, with a passkey.
Before you start
- You are an administrator of a PasskeyBridge organization, with an active membership.
- You have a passkey registered in PasskeyBridge. The consent page refuses an administrator who has none.
Connect
- In Claude, go to Customize > Connectors, select + Add, then Add custom connector.
- Enter a name, for example PasskeyBridge, and the remote MCP server URL
https://mcp.passkeybridge.io/mcp. Select Continue, keep the authentication settings Claude detects, and select Add. - Claude opens
app.passkeybridge.io/connect/mcp. Sign in to PasskeyBridge if asked. - Check the consent page. It shows the client's name, your organization, the host it sends you back to, what the client will be able to read, what it never receives, and when the request expires. If you are an administrator of more than one organization, choose one under Organization. None is selected at first, and Approve with passkey stays unavailable until you choose. The approval covers only the organization you choose.
- Select Approve with passkey and confirm with your passkey, or select Deny.
- Claude lists the PasskeyBridge tools.
On a Claude Team or Enterprise plan, an Owner first adds the connector under Organization settings > Connectors: select Add, hover over Custom, select Web, and enter the same URL. Each member then goes to Customize > Connectors, finds the connector, and selects Connect.
A consent request is valid for 5 minutes. After that, start again from Claude.
Data Claude can read
Tools that need an approval:
| Tool | Returns |
|---|---|
Signal summary (pkb_get_signal_summary) | Counts of identity signals by event type, result and processing status over a window of 1 to 720 hours (default 24) |
List audit events (pkb_list_audit_events) | Time, action, actor type, resource type and result, over 1 to 720 hours (default 168), at most 50 rows |
List fired alerts (pkb_list_alerts) | Severity, time, channel type, measured value and whether the alert was acknowledged, at most 50 rows |
Identity posture findings (pkb_get_posture_findings) | Check, category, severity, status, score impact and remediation text from the latest scan; email addresses in the text are redacted |
Passkey coverage (pkb_get_passkey_coverage) | Organization-level member counts and percentages |
Pending recovery requests (pkb_list_pending_recovery_requests) | Recovery requests waiting for guardian approval, as opaque references, without the account owner or the guardians |
Public tools, which need no approval and return no customer data: service status (pkb_get_service_status), credential status (pkb_get_credential_status), DID resolution (pkb_resolve_did) and the audit-chain checkpoint (pkb_get_chain_checkpoint).
Small counts. Passkey coverage withholds any count from 1 to 4, and any other count from which one of those could be worked out; a withheld count is null and the result carries suppressed: true. Pending recovery requests returns no rows when 1 to 4 requests are pending.
Approval length and revoking
- An approval lasts at most 90 days. After that, approve again.
- Any administrator can revoke an approval under Settings, AI connectors. The client's next tool call is refused.
- Every tool call re-checks that the approving user is still an administrator with an active membership. If not, the call is refused.
- The organization's audit log records
mcp.grant.created,mcp.grant.activated,mcp.tool_callandmcp.grant.revoked.
Troubleshooting
| What you see | What to do |
|---|---|
| The consent page refuses because you have no passkey | Register a passkey in PasskeyBridge, then connect again from Claude |
| The consent page says the request has expired or was already used | The request is valid for 5 minutes and can be used once. Start again from Claude |
| Claude reports the connector is not authorized | The approval was revoked or has expired. Connect again |
A count is null | It is withheld because it is from 1 to 4, or would reveal such a count |
Support: support@passkeybridge.io. Privacy: https://passkeybridge.io/privacy. Security: https://passkeybridge.io/security#ai-connector.