MCP admin tools

When a platform administrator connects an AI assistant through MCP, it gets everything a Pro user's assistant has plus a set of administrator tools that work across other people's accounts. By the end of this page you will know what those tools are, what to ask for, how they are recorded, and the actions that are deliberately left to the admin panel.

How users connect a client, and what the ordinary tools do, is covered in AI & MCP. Connecting as an admin works the same way — see Connect an AI assistant.

How admin tools differ

• They are named apart. Every cross-account tool starts with admin_. The ordinary tools still act on your own account: list_labs returns your labs, admin_list_labs returns everyone's.
• They appear only for administrators. A connection is given admin tools when the signed-in account is a platform admin. Nobody else sees them.
• They are recorded like everything else. Each call lands in your history — the MCP page's Activity tab and the assistant's my_history. Your history shows your account only; there is no tool that reads another person's MCP activity, for admins either.
• The scope rule still applies. Requests outside labs and their resources are refused for admins exactly as they are for users.

Admin connections also see labs still in alpha, and four template tools users do not have: transfer_template_owner, set_template_free_plan, publish_template and unpublish_template (listing a template on the LabStore). See Share and publish.

These act on other people's accounts

An assistant with admin tools can change organizations you do not belong to and approve work that affects other users. Connect admin clients deliberately, approve only clients you started, and disconnect them when you are done.

Users and labs

What you can ask

• "Find the user ravi and show me their plan and labs."
• "List every running lab on the platform."
• "Which users are using the most storage?"
• "run_command keeps failing for several people — is the platform able to run commands at all?"

Tool	What it does
admin_find_user	Finds an account by username or email
admin_list_labs	Labs across the platform, not just yours
admin_storage_usage	Storage use across users
admin_exec_health	Checks whether running commands inside labs works platform-wide. It runs nothing in anyone's lab

admin_exec_health is the one to reach for when commands fail the same way for more than one lab or person — it tells a platform problem apart from a lab problem in one call.

Account-level changes — plans, limits, blocking, impersonation — stay in the admin panel. See Users.

Organizations and departments

What you can ask

• "List all organizations and their owners."
• "Create an organization called Acme Labs owned by priya@example.com."
• "Add a department called Data Science under acme-labs."
• "Make Ravi the owner of acme-labs."
• "What would tearing down acme-labs remove?"

Tool	What it does
admin_list_entities	Every organization and department
admin_entity_get	One organization's or department's details
admin_entity_storage	Its storage use
admin_create_org	Create an organization
admin_create_department	Create a department under one
admin_update_entity	Change its details or limits
admin_set_entity_owner	Change its owner
admin_add_entity_member / admin_remove_entity_member	Add or remove a member in any organization
admin_teardown_preview	Lists everything a teardown would destroy — labs, devices, addresses, domains, service users, grants, storage and child departments. Destroys nothing

Teardown itself is not available to assistants

An assistant can preview a teardown but cannot run one. Tearing down an organization is done by hand in Admin Panel → Organizations → Manage → Danger → Teardown…, with the typed confirmation. Do not archive an organization as a step towards deleting it. See Tearing down an organization.

Who owns what, and platform totals

What you can ask

• "Who owns shop.selfmade.one?"
• "Which account has the address 203.0.113.24?"
• "How many domains, addresses and devices are in use across the platform?"

Tool	What it does
admin_who_owns_domain	The account or organization holding a domain
admin_who_owns_address	The owner of a private network address
admin_domain_stats	Domain counts across the platform
admin_address_stats	Address allocation across the platform
admin_device_stats	VPN device counts across the platform

Storage

What you can ask

• "Show me the ten heaviest storage users."
• "How much storage does acme-labs use against its limit?"

Tool	What it does
admin_storage_usage	Usage across users
admin_entity_storage	Usage for one organization or department

Changing limits and moving accounts between storage pools is done on Storage quotas.

Certificate re-issue review

Users can ask their assistant to request a replacement for a broken certificate. Those requests queue for an administrator. Your assistant can help you review the queue.

What you can ask

• "Show me the certificates that are expired or failing to renew."
• "What re-issue requests are pending? Explain each one."
• "Approve the pending requests for the shop and blog domains; reject the rest."
• "Queue the stale leftover certificates for cleanup — but show me the list first."
• "Is there an approved batch waiting to be applied?"

Tool	What it does
admin_ssl_list	Every certificate on the platform, with status and expiry
admin_ssl_cert_details	One certificate's domains and history
admin_ssl_requests	Re-issue requests, filtered by state; can also show what would be queued as leftover cleanup
admin_ssl_decide	Approve or reject pending requests. Reports a result for each request
admin_ssl_request_delete	Remove a request from the queue
admin_ssl_queue_residue	Queues every certificate that is failing only because of names no lab uses any more. They land already approved — review the list first
admin_ssl_apply_status	Whether an approved batch is waiting, and how the last one went

Good to know

• Approving does not replace anything. It moves the request to Approved, where it waits for you.
• Approval re-checks the request. If the certificate has recovered, or a domain no longer points at the platform, the request is closed as stale. That is the right outcome, not an error.
• Batches are not all-or-nothing. Read the per-request results; three of five succeeding is still a successful call.

Applying is a dashboard action

There is deliberately no tool that applies an approved batch, for anyone. When the queue is ready:

1. Open Admin Panel → Platform → SSL Queue.
2. Go to the Approved tab and check the list.
3. Click Apply Approved.

Ask your assistant to prepare and approve the batch, then apply it yourself. See Certificates and VPN.

Next

• AI & MCP — what every connected assistant can do
• Certificates and VPN — the SSL Queue in the admin panel
• Organizations — managing organizations by hand