Find Project Members

Description

Lists the members of one AttackForge project. With source "direct" (the default) it lists the users added to the project one by one, which patch_project_members adds, updates and removes; with source "group" it lists the users who reach the project through its linked groups (see find_project_groups), which only patch_project_groups changes.

Preconditions: for "direct", the caller must be an Admin, the project's owner, a Project Coordinator with access to the project, or a member admin of the project; for "group", an Admin, the project's owner, or a Project Coordinator with access to the project. Results are ordered by id and paginated (default 10 per page, max 50).

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool find_project_members and click Add

Example Prompts

• Who is on the team for project X?

• List the members of the ACME project with their access levels and roles.

• Which users have Edit access to this project?

• Who has access to project X through its linked groups?

Parameters

Parameter	Type	Required	Description
project_id	string	Yes	The id (24-hex) of the project whose members you want to list. Obtain it from find_projects.
source	string	No	'direct' (default) for the users added to the project itself, 'group' for the members of the project's linked, non-archived groups. A user can appear in both, and once per group in 'group'.
fields	array	No	Fields to include (id is always returned). Supported values are listed below.
limit	integer	No	Maximum records to return in this page. Default 10, max 50.
skip	integer	No	Number of records to skip (offset). Default 0.

Supported fields values:

Field	Type
id	string
access_level	string
created	string
email	string
first_name	string
group_id	string
group_name	string
last_name	string
modified	string
notifications	array of string
project_role	string
user_id	string
user_status	string

id is the membership record id; patch_project_members takes user_id, not this id. user_status, project_role and notifications are only filled for 'direct', and group_id and group_name only for 'group'. access_level is 'View', 'Upload' or 'Edit'; for 'group' it is the access level the group gives its member.

Example Response

{
  "data": [
    {
      "id": "6855007c1d6a44e61f90db63",
      "user_id": "65a440c08cade68ca7bc7192",
      "first_name": "Jane",
      "last_name": "Smith",
      "email": "[e-mail]",
      "user_status": "Active",
      "access_level": "Edit",
      "project_role": "Pentest Lead",
      "notifications": [
        "All Emails"
      ]
    }
  ],
  "count": 1,
  "total": 1
}