Check Clerk instances, users and domains from a Sazabi thread

Last verified on Nov 8, 2026.

When sign-ins break, the cause is often outside your application code: a production domain whose DNS never verified, a setting that differs between the development and production instance, or an OAuth provider configured with the wrong credentials. Your logs show the symptom. Clerk holds the configuration that explains it.

Connecting Clerk lets the Sazabi agent, part of Sazabi's AI-native observability and security platform, look at both in the same thread. You read the error spike, then ask what the instance is actually configured to do.

What the Sazabi agent can do with Clerk

There are two ways in, and they differ in scope.

MCP connector. Sazabi connects to Clerk's hosted MCP server at https://mcp.clerk.com/mcp using the Clerk account you sign in with and a workspace you choose. The agent acts as you, limited by your workspace Role and the permissions you approve. Clerk's tool reference groups the tools like this:

• list_applications, get_application and create_application for applications, with each instance's publishable key in the results
• get_instance_config and get_instance_config_schema to read configuration and its schema, plus patch_instance_config and put_instance_config to change it, with a dry run available to preview
• list_users to find users with filters, and create_user to add one
• list_domains, get_domain_status and check_domain_dns for the DNS records a domain needs and whether it verified
• clerk_sdk_snippet and list_clerk_sdk_snippets for SDK code patterns

Read access needs scopes such as applications:read, users:read and application_domains:read. Anything that changes state needs a matching :manage scope. Turn on the per-connection read-only option if you want an investigation connector that cannot edit anything.

Sandbox CLI. The clerk CLI is installed in the agent's sandbox, and you supply CLERK_SECRET_KEY to authenticate it. Clerk's CLI reference lists clerk users list, clerk config pull, clerk security (grades an instance against Clerk's security recommendations) and clerk api, an authenticated client for the Backend API.

Questions it answers

• Does the production domain have all the DNS records Clerk requires, and has it verified?
• Which settings differ between the development and production instances?
• Who signed up in the last hour, and did anything unusual happen to those accounts?
• Which OAuth providers does the production instance have credentials for?
• Which Clerk SDK call is the right one for the behavior I am seeing in my code?

A worked example: sign-ins fail on a new custom domain

Your login endpoint starts returning errors right after a release that moved the app to app.example.com. You ask:

Sign-ins on app.example.com fail since 14:05 UTC. In the production Clerk
instance, check the domain status and the DNS records it needs. Then list
the five most recent users so I can tell whether sign-ups still work.

The agent starts with list_applications to find the production instance, then calls list_domains to get the DNS records the domain requires, and get_domain_status for verification. If a record is missing or unverified, it reports which one Clerk expects. check_domain_dns asks Clerk to run a fresh DNS check, which needs application_domains:manage, so it is the one step a read-only connection will refuse. Finally list_users shows whether recent accounts were created.

You still decide what to change. If the records are fine, ask the agent to run get_instance_config and compare the authentication settings with the development instance. Clerk redacts sensitive values when it reads configuration, so the output holds no secret keys.

How it fits with other integrations

Clerk gives the agent the identity layer, while your hosting platform shows the runtime side: pair it with Vercel or Supabase when the failing app lives there. Application telemetry reaches Sazabi through OpenTelemetry, and the security category lists the security-focused integrations. See the integrations index for every method, or pricing for plans.