Find Group Members

Description

Lists the members of one AttackForge Group. Each member holds a project access level, which is the access they get to the projects the group is linked to, a project request access level, and flow and custom action sharing settings. Use this to read the current members before changing them with patch_group_members - call find_groups to discover group ids, and find_group_member_admins to see who may manage the members. Former members are left out.

Preconditions: the caller must be an Admin or a member admin of the group; only an Admin can list the members of an archived group. Results are ordered by id and paginated (default 10 per page, max 50).

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool find_group_members and click Add

Example Prompts

• Who is in the Red Team group?

• List the members of the ACME group with their project access levels.

• Which members of the SOC group can action project requests?

• Is Jane Smith a member of the Contractors group?

Parameters

Parameter	Type	Required	Description
group_id	string	Yes	The id (24-hex) of the group whose members you want to list. Obtain it from find_groups.
fields	array	No	Fields to include (id is always returned). Supported values are listed below.
limit	integer	No	Maximum records to return in this page. Default 10, max 50.
skip	integer	No	Number of records to skip (offset). Default 0.

Supported fields values:

Field	Type
id	string
created	string
custom_action_sharing	string
email	string
first_name	string
flow_sharing	string
last_name	string
modified	string
project_access_level	string
project_request_access_level	string
user_id	string
user_status	string

id is the membership record id; patch_group_members takes user_id, not this id. project_access_level is the access the member has to the projects the group is linked to: 'None', 'View', 'Upload' or 'Edit'. project_request_access_level is the access the member has to the project requests shared with the group: 'None', 'View', 'Edit' or 'Action'. flow_sharing and custom_action_sharing say whether the member may share their flows and custom actions with the group: 'All' or 'None'. user_status is the status of the member's user account, e.g. 'Active', 'Blocked' or 'Invited'.

Example Response

{
  "data": [
    {
      "id": "65b1f1d38cade68ca7bc71c2",
      "user_id": "65a440c08cade68ca7bc7192",
      "first_name": "Jane",
      "last_name": "Smith",
      "email": "[e-mail]",
      "user_status": "Active",
      "project_access_level": "Edit",
      "project_request_access_level": "View",
      "flow_sharing": "None",
      "custom_action_sharing": "None"
    }
  ],
  "count": 1,
  "total": 1
}