Admin MCP

The Admin MCP lets you manage MCP Hero from your AI assistant — you describe the change in natural language, your assistant calls the right management tool. It's an alternative surface to the dashboard, not a replacement.

When to use it

The dashboard is faster for visual tasks (clicking through roles, scanning the audit log). Reach for the Admin MCP when:

You'd rather describe the change than hunt for it ("disable destructive tools on Mixpanel for the user role")
You want to do something bulk across many MCPs, roles, or tools
You want to script setup ("create a bi-team role with read-only access to Mixpanel, MongoDB, and Snowflake")
You're already in your AI client and don't want to switch tabs

Both surfaces talk to the same API, so changes made in one show up immediately in the other.

Connecting your AI client

Open the Admin MCP page in the sidebar.

Copy the Admin MCP server URL at the top of the page (it ends in /admin-mcp).
Add it as a custom MCP to your AI client. The flow is the same as for the gateway MCP — see step 3 of Getting started. Use the URL on this page, not the gateway URL.
Sign in with the same Google account you use for the dashboard.

Once connected, your AI client sees the Admin MCP's management tools alongside its other MCP tools. Ask it what admin tools do you have? to confirm.

Admin MCP calls have a per-person rate limit. If you go over it, the call returns an error that says how many seconds to wait. See Rate limits on the Concepts page.

What you can do

The Admin MCP exposes management tools across six areas. Open the Admin MCP page in the dashboard for the full, current list — every tool's name, description, and annotations are shown there, and that page stays in sync as MCP Hero ships new tools.

The categories at time of writing:

Upstream management — list, add, remove, start, connect, disconnect, refresh tools. Like on the dashboard, a newly added MCP starts stopped until you start it.
Tool customization — view/set/remove default arguments per upstream tool.
Audit — search the audit log with filters, including arguments and policy decisions that aren't shown in the dashboard table.
User management — list members, add or remove members, change a member's role.
Role management — list, create, delete, rename roles.
Access policies — set or clear every access rule a role can have: per-MCP, per-tool, annotation-based, argument checks.

Your AI client is not shown an MCP's credentials. Reading an MCP's settings says whether a token or an OAuth client secret is set, not what it is:

Every header and environment variable value reads [hidden], unless it is made only of Variables you reference as ${NAME}, such as ${GITHUB_TOKEN} or Bearer ${API_TOKEN}. Those show as written.
In the URL, the command and its arguments, what may hold a credential reads [hidden]: the part before @ in a URL (user name and password), a password-like parameter or flag value, an environment variable set on the command line, a header passed as an argument, and anything shaped like a key.

A credential typed in clear into a URL or an argument is hidden only when it looks like one. Keep credentials in Variables: reading an MCP's settings never shows a Variable's value.

Authentication

Only members with an admin role can connect. If a non-admin tries, the connection is refused.

The same Google sign-in flow that secures the dashboard secures the Admin MCP — there's no separate token to manage. If your role changes from admin to something else, your existing Admin MCP session stops working as soon as the role change is saved.