identity.getActiveLinks()
Professional-looking. Nonexistent.
The gate reflects over your actual classpath and refuses methods or enum constants that are not present.
Grounded verification for IdentityIQ
Your AI writes the IIQ rule. This proves it.
iiq-rules-mcp checks AI-authored SailPoint IdentityIQ rules against your own JAR, DTD, registry, classpath, and exports—before the rule reaches import or production.
Full features during trial · One active device · Works with Claude Desktop and MCP clients
iiq_verify_rule_artifact
Rule / Correlation
Broken-Method-Test
REFUTED
return application.totallyFakeMethod();
!
Method does not exist
No matching member was found on the reflected Application API in the configured IdentityIQ classpath.
XML
Signature
Scope
API
The problem
AI errors look exactly like valid IIQ code.
Syntax alone is not enough. The expensive mistakes depend on IdentityIQ contracts the model cannot reliably infer from prose.
String previous = oldvalue;
One letter, one runtime failure.
Every variable read is checked against the authoritative inputs for that exact rule type.
return { "user": "jdoe" };
Valid BeanShell. Wrong return shape.
Signature and return contracts are grounded in the rule registry, not guessed from a generic example.
How it works
One artifact. Seven grounded checks.
The composite gate gathers each substrate once, runs the checks in a deterministic order, and returns a closed-vocabulary verdict.
Understand the verdictsXML and packaging
DOCTYPE, CDATA, DTD structure, and storage limits.
Rule signature
Declared type and inputs against the registry contract.
Object references
Named IIQ objects resolved against your optional export.
BeanShell parse
Parsed with bsh.Parser; analyzed code is never executed.
Variable scope
Every read checked against the variables IIQ actually injects.
API existence
Classes, methods, inheritance, and nested enums verified by reflection.
Advisory reviews
Security, maintainability, and performance surfaced separately.
Honest outcomes
“Could not verify” never becomes “clean.”
Every gating stage was positively verified against a named substrate.
A substrate contradicted the artifact and the finding identifies the repair.
The required evidence was unavailable or could not answer the question.
A useful heuristic or review note that never pretends to be a hard failure.
Built for IIQ rule work
Ground the model before, during, and after drafting.
The gate is the final decision point. Supporting tools help the model choose the correct rule type and contract before it writes code.
Choose the right rule type
Search the complete rule-type universe and inspect exact type metadata before drafting.
Read the real signature
Expose injected inputs, expected outputs, and contract notes without relying on memory.
Verify Java APIs
Ask whether a class, method, field, constructor, or enum exists on your configured classpath.
Check object references
Resolve Applications, Rules, Workgroups, and other named objects against your local export catalog.
Validate import shape
Catch malformed XML, invalid attributes, fragile source packaging, and measured storage limits.
Return one auditable verdict
Collect findings, substrate evidence, and licensing status in a consistent response envelope.
Measured evidence
The same model, with and without the gate.
Six real scenarios were run with identical model settings and judged against a live IdentityIQ 8.1 installation. Every result was retained.
| Scenario | Without grounding | With iiq-rules-mcp |
|---|---|---|
| AD correlation | Confirmed | Confirmed |
| HR BuildMap | Confirmed | Confirmed |
| Identity creation | Confirmed with an unsupported signature argument | Confirmed |
| Certification exclusion | Refuted: read a variable IIQ does not inject | Confirmed |
| Web Services OAuth | Confirmed | Confirmed |
| Certification escalation | Refuted: invented an XML attribute rejected by the DTD | Confirmed |
The honest finding: most ungrounded drafts looked fine. Nothing on their face identified which two would fail.
Security boundary
Your IIQ artifacts stay on your machine.
Verification runs locally. You bring the licensed substrates; the product does not redistribute SailPoint software or upload your rule library.
License signup, activation, and periodic renewal send only the licensee email (at signup), the license identifier, and salted device-component hashes—never rule source, JARs, DTDs, exports, paths, or IIQ customer data.
Bring your own substrates
Point the server at your licensed identityiq.jar, WEB-INF/lib, sailpoint.dtd, and optional export.
Never execute analyzed code
BeanShell is parsed only, and SailPoint classes are loaded for reflection without initialization.
No example-rule retrieval
The MCP surface exposes framework facts and verdicts, not a searchable copy of your rule repository.
Fail closed on bad grounding
Missing or contradictory substrates stop confirmation instead of silently weakening the gate.
Start in minutes
Install. Start the trial. Connect your MCP client.
The seven-day trial includes the full product and is limited to one trial per person and device.
01Install
Install the current wheel
Use the signed wheel supplied by SimplifyAuth.
uv tool install --force .\iiq_rules_mcp-1.6.3-py3-none-any.whl
02Activate
Start the full trial
Use the email where purchase and renewal messages should arrive.
iiq-rules-activate trial --email you@example.com
03Connect
Add it to your MCP client
Restart the client fully, then run iiq_grounding_status to confirm the version and substrates.
Request the trial wheelSimple pricing
Choose the term that fits your work.
Individual plans cover one named user on one active device. Enterprise licensing is tailored to your organization and delivery model.
1 month
$39
- All 21 MCP tools
- Full seven-stage verification gate
- Updates during the active term
- Community support
1 yearBEST VALUE
$350
- All 21 MCP tools
- Full seven-stage verification gate
- Updates during the active term
- Community support
Enterprise
Custom agreement
- Team or site-based licensing
- Priority support and invoicing
- Security questionnaire assistance
- Private distribution options
- Commercial terms aligned to your use case
Renewing early never loses paid time: a renewal extends from your current expiry date. Individual purchases are one-time payments through Razorpay.
FAQ
Straight answers before you install.
What do I need from my IdentityIQ installation?
Your licensed identityiq.jar, WEB-INF/lib directory, sailpoint.dtd, and a JDK. An export-clean catalog is optional but enables local object-reference verification.
Does it execute my BeanShell?
No. BeanShell is parsed with bsh.Parser and never interpreted. SailPoint classes are loaded for reflection without class initialization.
What leaves my machine?
No rule source, IIQ JAR, DTD, export, filesystem path, or customer record is sent to SimplifyAuth. Licensing sends only the licensee email (when you start a trial or activate), the license identifier, and salted device-component hashes.
Which IdentityIQ versions are supported?
The current calibration evidence is against IdentityIQ 8.1. Other 8.x releases use the same substrate mechanisms but should be treated as unverified until calibrated against that installation.
What happens when the trial or license expires?
Verification tools stop issuing verdicts and return a clear licensing message. iiq_grounding_status remains available for diagnosis. Renewals extend from the current expiry date.
How do I move the license to a new device?
Run iiq-rules-activate deactivate on the currently licensed device, then activate the IIQR key on the new device. Two self-service migrations are available per calendar year; lost-device cases are handled through support.
Is this a SailPoint product?
No. iiq-rules-mcp is an independent SimplifyAuth product and is not affiliated with, endorsed by, or sponsored by SailPoint Technologies.
Ready to verify
Stop reviewing AI guesses. Start working from grounded verdicts.
Run the full product for seven days, or talk to us about an enterprise agreement for your team.
Talk to sales
Tell us about your team.
Weighing an enterprise agreement, a bulk of individual licenses, or just have a question before you buy? Send us the details and we'll come back with the right fit.
- Reply within one business day
- No obligation, no sales pressure
- Your details stay private