MCP / AI
Admin MCP Tools

Admin MCP Tools

Two tools expose a narrow slice of the admin domain to MCP clients (Claude Code, Claude Desktop): admin_list_users and admin_approve_user. Implementation: services/mcp/src/lkwiz_mcp/tools/admin.py.

⚠️

This is a small subset of the full admin surface. There's no MCP tool for rejecting a user, changing roles, enabling/disabling accounts, managing workspaces, or reading platform metrics — those require the web app or the Admin REST API directly.

Both tools require the caller's role to be admin (same JWT-derived role every other MCP tool uses) — a non-admin caller gets a tool error ("Admin role required").

admin_list_users

admin_list_users(status: str = "all") -> str

Lists platform users.

Parameters

NameTypeDefaultNotes
statusstring"all""pending" → unapproved only. "approved" → approved only. Anything else returns everyone.

Returns (JSON-encoded string):

{
  "users": [
    {
      "user_id": "user_123",
      "email": "jane@example.com",
      "name": "Jane Doe",
      "role": "member",
      "approved": false,
      "created_at": "2026-07-10T09:00:00+00:00"
    }
  ],
  "total": 1
}

Note the shape difference from the REST List users endpoint: this tool returns a raw approved boolean rather than a computed status string, has no last_login field, and adds a total count.

admin_approve_user

admin_approve_user(user_id: str) -> str

Approves a pending user — in DynamoDB only.

Returns:

{
  "user_id": "user_123",
  "email": "jane@example.com",
  "approved": true,
  "approved_at": "2026-07-17T12:00:00+00:00",
  "approved_by": "user_456"
}
⚠️

This tool does not call Cognito and does not send a Slack notification. Unlike the REST Approve user endpoint, admin_approve_user only flips approved: true in DynamoDB. Cognito's custom:approved attribute — which is what the API's authorizer actually checks before minting an authenticated session — is left untouched. A user "approved" only through this MCP tool still cannot obtain a working session: they need to also be approved via the REST endpoint or the admin web UI before they can log in.

Deviations from REST

AspectREST (admin_service)MCP (tools/admin.py)
DB accessboto3 Table resource (native types)raw boto3 DynamoDB client (attribute-value dicts)
"All users" filterentity_type == "User"sk == "PROFILE"
List shapecomputed status, last_loginraw approved boolean, total count, no last_login
Approve side effectsDynamoDB + Cognito enable/attrs + Slack DMDynamoDB only
Reject / role / enable-disable / workspaces / metricsFull REST surface — see Admin APINot available via MCP

See also

  • Admin feature guide — product behavior, the self-demotion gap, the enable/disable UI quirk, and the metrics fields that are always zero.
  • Admin API reference — the full REST surface, including everything not available over MCP.
Examples MCP ToolsOverview