Skip to content

SimplifyAuth SimplifyAuth

Grounded verification for SailPoint IdentityIQ

Your AI writes the IdentityIQ rule.
This proves it.

An MCP server with one job: an AI that uses it cannot present an incorrect IdentityIQ rule as verified. Every draft passes a seven-stage gate grounded in your own identityiq.jar, sailpoint.dtd, and rule registry — before it ever reaches iiq console import.

Download & install How it works

CONFIRMED REFUTED UNVERIFIABLE ADVISORY

What it checks

One composite gate, seven stages, one verdict from a closed vocabulary. Every draft is scored against your install, and a stage that can't be proven is never dressed up as clean.

  • 1 · XML & import packaging

    DTD, DOCTYPE, CDATA fingerprint, and storage limits read straight from your JAR.

  • 2 · Signature

    Declared type and inputs checked against the rule registry contract.

  • 3 · References

    Imports matched to your classpath; objects matched to your export.

  • 4 · BeanShell parse

    Parsed with bsh.Parser — never executed. A permanent test pins this.

  • 5 · Variable scope

    Every read checked against the injected-variable contract for that rule type.

  • 6 · API existence

    Java reflection incl. inherited members and nested enums; invented API does not survive.

  • 7 · Reviews

    Best practices, security, performance — always labeled advisory, never blocking.

"We could not check" is never allowed to look like "clean." If a layer can't be proven, the gate says so — plainly. unverifiable can never be conflated with refuted or with a clean pass.

Why it matters

The dangerous AI mistakes in IdentityIQ aren't the ones that fail loudly — they're the ones that look exactly like valid rules:

  • a method that doesn't exist on your JAR (identity.getActiveLinks())
  • a one-letter variable typo the runtime never flags (oldvalue vs oldValue)
  • a return that's valid BeanShell but the wrong contract for that rule type

Syntax checking can't catch these — they depend on IdentityIQ contracts a model can't reliably infer from prose. This grounds the model in your install and gates every draft before import.

Evidence

156real rules calibrated — zero unexpected findings
102/102rule types identical across the JAR enum, the DTD, and the live importer
11/11hand-test rules running in live IdentityIQ 8.1
0network calls from the verification engine — test-enforced

Your rules, JARs, and exports never leave your machine.

Get started

uv tool install --from https://docs.simplifyauth.com/download/iiq-rules-mcp-latest.whl iiq-rules-mcp
iiq-rules-activate trial --email you@example.com    # free 7-day trial

Requires Python 3.11+, a JDK (17+ recommended), and your own licensed IIQ installation to point at. Full walkthrough in New-machine setup and How to use. Works with Claude Desktop and any MCP client.

Evaluation and personal learning are free during a 7-day trial; production use requires a commercial license.

iiq-rules-mcp is an independent product of SIMPLIFYAUTH CONSULTANCY SERVICES (OPC) PRIVATE LIMITED, not affiliated with, endorsed by, or sponsored by SailPoint Technologies. SailPoint and IdentityIQ are trademarks of SailPoint Technologies, Inc., used only to describe compatibility.