Count Users

Description

Returns the number of AttackForge users matching the optional filter. Use this when you only need a total (for reporting, paging decisions, or sanity checks) and do NOT need the user records themselves - call find_users for that. Administrators count every user; any other caller only ever counts their own user record, so the result is 0 or 1. Deleted users are excluded unless include_deleted is set.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool count_users and click Add

Example Prompts

• How many users are there in AttackForge?

• How many consultants do we have?

• How many users have not logged in this year?

• How many accounts are blocked?

• How many users have MFA turned off?

• How many deleted users are there?

Parameters

Parameter	Type	Required	Description
filter	object	No	A MongoDB-style filter. Supported fields are listed below.
include_deleted	boolean	No	Include users that have been deleted. Defaults to false. Administrators only - ignored for any other caller. Combine with the is_deleted filter field to count only the deleted users.

Supported filter fields (any caller):

Field	Type / Values
id	ObjectId('<24 hex>')
email	string
first_name, last_name	string
username	string
custom_field_<key>	value of the user custom field <key>. Only keys configured to display in tables and viewable by the caller are accepted; discover keys via get_field_structure(model="user")

Supported filter fields (administrators only - anyone else is rejected):

Field	Type / Values
created, modified	ISO-8601 datetime
account_expiry	ISO-8601 datetime
email_verified	boolean
exempt_global_inactivity_policy	boolean
failed_logins	integer
force_password_change	boolean
is_deleted	boolean
last_active_on_app, last_active_on_ssapi	ISO-8601 datetime
last_logged_in	ISO-8601 datetime
last_login_type	one of 'local', 'sso'
mfa_enabled	boolean
role	one of 'admin', 'projectoperator', 'librarymod', 'consultant', 'client'
status	one of 'Active', 'Blocked', 'Invited'

Any other field is rejected. profile is not filterable. A caller who is not an administrator is always restricted to their own user record, whatever the filter says.

mfa_enabled is on for a user unless it has been explicitly set to false - users where it has never been set have it enabled. Matching on true covers both, so { mfa_enabled: { $eq: true } } needs no special handling.

Example Response

{
  "count": 42
}