LastPass MCP Server
for AI Agents

Retrieve audit event logs from the LastPass Business account

Retrieve shared folder data containing permission sets from the LastPass Business account

Retrieve shared folder data to look up a specific policy by ID

Retrieve a list of all shared folders in the LastPass Business account

Retrieve detailed information about all shared folders including sites and permissions

Retrieve detailed account data for users in the LastPass Business account via the getuserdata command, with optional filtering by username, admin status, or disabled status and pagination support for large directories.

Add or remove users from groups in bulk

Update a user's primary email address in the LastPass Business account via the Enterprise API updateemail command, triggering a confirmation email to the new address.

Return the authentication type and identity for the current LastPass connection. LastPass provisioning API uses account-level credentials (CID + provisioning hash) rather than user-bound credentials — there is no "current user" concept. The auth_type is api_key. The name reflects the CID account number. Confirms credentials are valid via a getuserdata probe.

List all groups in the LastPass Business account, mapped to the StackOne IAM unified group schema. Wraps cmd=getuserdata and extracts the Groups object. Groups are identified by name (LastPass has no numeric group ID). Returns group name; created_at, updated_at, description, and roles are not exposed by the API.

Retrieve a single LastPass group by its name (used as ID), mapped to the StackOne IAM unified group schema. Wraps cmd=getuserdata and extracts the named group from the Groups object by key.

Return the single LastPass Business account organization, mapped to the StackOne IAM unified organization schema. LastPass is a single-tenant product — one account = one organization identified by the CID (Company ID). Performs a getuserdata auth probe to confirm credentials. Returns id and name derived from the CID; created_at and updated_at are not exposed by the API.

Retrieve the single LastPass Business account organization by its CID. LastPass has one organization per account — pass the CID from unified_list_organizations as the id. Performs a getuserdata auth probe to confirm credentials.

List users and groups that have access to LastPass shared folders, mapped to the StackOne IAM unified resource_users schema. Wraps cmd=getsfdata. Each entry represents a user or group permission on a specific shared folder, with role derived from the permission flags (can_administer → admin, give → editor, readonly → viewer). Pass resource_id to filter to a specific shared folder by its ID (client-side, getsfdata returns all folders).

Return the LastPass resource types available for IAM permission checks. LastPass exposes one resource type — shared_folder — representing shared vaults that users and groups can be granted access to. Performs a getuserdata auth probe to confirm credentials.

Return the two stable LastPass account-level IAM roles — admin and basic — synthesized from the admin flag on user records. LastPass has no native roles API. Shared-folder permission roles (can_administer, give, readonly) are surfaced per resource via unified_list_resource_users. Performs a getuserdata auth probe so 401/403 surfaces when credentials are bad.

Retrieve a single synthesized LastPass IAM role by its stable key. Only "admin" and "basic" are valid — any other id is rejected with a 400. Performs a getuserdata auth probe so 401/403 surfaces when credentials are bad.

List all users in the LastPass Business account, mapped to the StackOne IAM unified user schema. Wraps the LastPass Provisioning API cmd=getuserdata. Returns identity, admin status, disabled/active status, created date, last login, and group memberships. Roles are synthesized from the admin flag (admin or basic). Supports optional filtering by email address (applied client-side).

Retrieve a single LastPass user by their email address (used as ID), mapped to the StackOne IAM unified user schema. Wraps cmd=getuserdata with username filter for server-side lookup.

Distribute credential entries (sites) to users in the LastPass Business account

Delete multiple users from the LastPass Business account in a single call

Deactivate a user account while preserving their vault data

Re-enable a previously disabled user account

Resend an invitation email to a user who has not yet accepted

Disable multifactor authentication for a user

Send a master password reset email to a user

Require a user to change their master password on next login via the LastPass Enterprise API requiremasterpasswordchange command.