Patch Project Member Admins

Description

Adds, updates or removes the member admins of an existing AttackForge project. This is a write operation. A member admin is a user, or every member of a group, allowed to add, update and remove the project's direct members (see patch_project_members) up to an access level limit, without otherwise being able to change the project. A Project Coordinator who is a member admin is the exception: they manage the project in full, with no limit.

One call can mix up to 50 operations, one per user or group, each naming user_id or group_id; the call is refused without changing anything if any operation cannot be applied. Discover the current member admins with find_project_member_admins, users with find_users and groups with find_groups.

The shape of args is declared inline (see Building args for Write Tools), so no preparatory call is needed.

Preconditions: the caller must be an Admin, the project's owner, or a Project Coordinator with access to the project. On success the user and group ids are returned, sorted by outcome.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool patch_project_member_admins and click Add

Example Prompts

• Let Jane manage the members of project X, up to Upload access.

• Make the Red Team group member admins of the ACME project.

• Allow Bob to invite new users to this project.

• Remove the SOC group as member admins of project X.

Parameters

Parameter	Type	Required	Description
args	object	Yes	The project-member-admins patch payload - see the keys below.

args keys:

Key	Type	Required	Description
project_id	string	Yes	Id (24-hex) of the project whose member admins are changed. Source: find_projects.
operations	array	Yes	1 to 50 operations, at most one per user or group - see the keys below.

operations item keys:

Key	Type	Required	Description
type	string	Yes	'add', 'update' or 'remove'.
user_id	string	No	Id (24-hex) of a user, whose member admin settings the operation changes. Give user_id or group_id but not both. To add, the user must exist and not be deleted (source: find_users); to update or remove, the user must be a member admin of the project (source: find_project_member_admins).
group_id	string	No	Id (24-hex) of a group, whose members all become member admins. Give user_id or group_id but not both. To add, the group must exist and not be archived (source: find_groups); to update or remove, the group must be a member admin of the project (source: find_project_member_admins).
access_level_limit	string	No	'View', 'Upload' or 'Edit': the highest project access level this member admin may grant to the members they add or update. Defaults to 'View' on a new member admin; omit to leave it unchanged on an existing one. Not accepted on 'remove'.
add_user_method	string	No	How this member admin finds the users they add in the AttackForge UI: 'email' requires typing the user's email address, 'list' lets them pick from the list of users. Defaults to 'email' on a new member admin; omit to leave it unchanged on an existing one. Not accepted on 'remove'.
allow_user_invite	boolean	No	Whether this member admin may invite people who have no AttackForge account yet, from the AttackForge UI. Defaults to false on a new member admin; omit to leave it unchanged on an existing one. Not accepted on 'remove'.

An 'update' must supply at least one of access_level_limit, add_user_method or allow_user_invite. Adding a user or group that is already a member admin updates only the keys supplied. unchanged lists the member admins that already had the settings asked for - it is not an error and the call should not be retried.

Example Response

{
  "project_id": "685500711d6a44e61f90db4e",
  "added": [
    "65b1f0a28cade68ca7bc71a4"
  ],
  "updated": [],
  "removed": [
    "65a440c08cade68ca7bc7192"
  ],
  "unchanged": []
}