Patch Group Project Requests

Description

Gives the members of an AttackForge Group access to project requests, or takes it away. This is a write operation: it adds the group to, or removes it from, the groups whose members can access each project request, where every member has access at their own project request access level (see find_group_members). This is not the project request's linked_group_ids, a separate field that patch_project_request changes and this tool leaves alone.

One call can mix up to 50 add and remove operations, one per project request, and the call is refused without changing anything if any operation cannot be applied. Discover project requests with find_project_requests and the group's current ones with find_group_project_requests. A group with auto_add_project_request set is also added automatically to every project request one of its members creates; such a project request can be removed here like any other.

The shape of args is declared inline (see Building args for Write Tools), so no preparatory call is needed.

Preconditions: the caller must be an administrator, the group must exist and not be archived, and project requests must be enabled for the tenant (frontend.enable_project_requests). No email is sent. On success the project request ids are returned, sorted by outcome.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool patch_group_project_requests and click Add

Example Prompts

• Give the Red Team group access to the ACME Web App Pentest project request.

• Take the Contractors group's access to project request X away.

• Share every pending project request with the SOC group.

Parameters

Parameter	Type	Required	Description
args	object	Yes	The group-project-requests patch payload - see the keys below.

args keys:

Key	Type	Required	Description
group_id	string	Yes	Id (24-hex) of the group whose project request access is changed. Source: find_groups. The group must not be archived.
operations	array	Yes	1 to 50 operations, at most one per project request - see the keys below.

operations item keys:

Key	Type	Required	Description
type	string	Yes	'add' to give the group's members access to the project request at their project request access level, 'remove' to take it away.
project_request_id	string	Yes	Id (24-hex) of the project request. For 'add', the project request must exist (source: find_project_requests); one the group already has access to is reported as unchanged. For 'remove', the group must currently have access to it (source: find_group_project_requests).

unchanged lists the project requests asked to be added that the group already had access to. It is not an error and the call should not be retried.

Example Response

{
  "group_id": "65b1f0a28cade68ca7bc71a4",
  "added": [
    "6855012e1d6a44e61f90dba2"
  ],
  "removed": [],
  "unchanged": []
}