Find Groups

Description

Lists AttackForge Groups matching the optional filter. A group is a named set of users; linking a group to a project gives its members access to that project, and naming a group as a project member admin lets its members manage the project's members. Use this to discover the ids patch_project_groups, patch_project_member_admins, patch_group, find_group_members, patch_group_members, find_group_member_admins, patch_group_member_admins, find_group_project_requests, patch_group_project_requests, archive_group and restore_group take - call find_project_groups instead to see which groups a project is already linked to. Call count_groups when only a total is needed, and create_group to add a group. Callers who can create projects or action project requests see every group; other callers see only the groups they belong to. Archived groups are left out unless an administrator sets include_archived. Group membership is not returned. Results are ordered by id and paginated (default 10 per page, max 50).

Custom-field values are requested separately via custom_field_keys, subject to the tenant's per-role custom-field access.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool find_groups and click Add

Example Prompts

• List the groups in AttackForge.

• Find the group called Red Team.

• Who is the primary contact for the ACME group?

• Which group should I link to project X to give the SOC team access?

• Which groups are in the EMEA region? Include the region custom field.

• Show me the archived groups.

Parameters

Parameter	Type	Required	Description
filter	object	No	A MongoDB-style filter. Supported fields are listed below.
fields	array	No	System fields to include on each group (id is always returned). Supported values are listed below. Fields the caller may not see are dropped rather than rejected.
custom_field_keys	array	No	Custom field keys to include (discover via get_field_structure(model="group")). Keys the caller is not permitted to view are dropped rather than rejected.
include_archived	boolean	No	Include groups that have been archived. Defaults to false. Administrators only - ignored for any other caller. Combine with the is_archived filter field to list only the archived groups, and pair it with restore_group to bring one back.
limit	integer	No	Maximum records to return in this page. Default 10, max 50.
skip	integer	No	Number of records to skip (offset). Default 0.

Supported filter fields (any caller):

Field	Type	Description
id	ObjectId('<24 hex>')	the group id
name	string	the group name
owner	string	the free-text owner recorded on the group
primary_contact_email	string	email address of the group's primary contact
primary_contact_name	string	name of the group's primary contact
primary_contact_number	string	phone number of the group's primary contact
custom_fields	array of { key: string, value: string or array }	the group's custom fields; discover keys via get_field_structure(model="group")

Supported filter fields (administrators only - anyone else is rejected):

Field	Type	Description
is_archived	boolean	whether the group has been archived

Supported fields values:

Field	Type
id	string
created	string
modified	string
name	string
owner	string
primary_contact_email	string
primary_contact_name	string
primary_contact_number	string
auto_add_project_request	boolean - whether a project request created by a member of the group is automatically shared with the group. Administrators only.
enable_project_team_notifications	boolean - whether the group's members receive the project team notification emails of the projects the group is linked to. Administrators only.
is_archived	boolean. Administrators only.

Example Response

{
  "data": [
    {
      "id": "65b1f0a28cade68ca7bc71a4",
      "name": "Red Team",
      "owner": "Security Operations",
      "primary_contact_name": "Jane Smith",
      "primary_contact_email": "[e-mail]",
      "auto_add_project_request": false,
      "enable_project_team_notifications": true,
      "is_archived": false,
      "custom_fields": [
        {
          "key": "region",
          "value": "EMEA",
          "label": "Region"
        }
      ]
    }
  ],
  "count": 1,
  "total": 1
}