MCP admin tools for domain admins
Domain admins get 12 extra read-only MCP tools to look up account facts about users in their own domain, such as storage, limits, aliases and mailing lists. These tools change nothing and cannot read anyone's mail. There is no tick box. The account type gives access, but Send & Save must be off for that agent.
When to use it
Priya looks after acme.in. Priya's assistant, connected through an agent with Send & Save off, answers "Who in my domain expires in the next 30 days, and who is nearly out of mailbox space?" without Priya opening each user in the admin console.
Who can use them
- Domain admins only. Create an agent password in webmail and make the token, the same way as any user. There is no separate tick box: the account type gives access.
- Send & Save must be off. An agent with Send & Save ticked cannot use admin tools. Use a separate agent for admin lookups, and do not connect it to the same assistant as an agent that can send. This stops a crafted email from steering the assistant into mailing out your directory.
- The agent keeps the normal mailbox tools its permissions allow.
What they can and cannot do
- Look up, never change. No admin tool can edit, add, reset or delete anything.
- Your own domain only. A user in another domain is reported as not found.
- Other admins. They appear by name in
admin_search_users, but their details cannot be opened. You can open your own. - No mail access. These tools show account facts. They cannot read anyone's mail.
- Limits. The same limits as other tools apply.
Tools
| Tool | What it shows |
|---|---|
admin_search_users |
Find users by name or email, or list them all: type, active, last login, expiry |
admin_get_user |
Name, type, status, phone, company, created, last login and its IP address |
admin_get_user_storage |
Allowed and used mailbox space. Used space can lag behind. |
admin_get_user_limits |
Limits on folders, mail per day, data per day, contacts, rules, attachment size and recipients |
admin_get_user_expiry |
When the user's account and the domain expire |
admin_list_aliases |
The user's email aliases |
admin_get_user_access |
Which services are on, including POP and IMAP |
admin_get_user_security |
2-step sign-in, alternate email, phone, allowed IP addresses and countries |
admin_list_mailing_lists |
Mailing lists with subscriber and moderator counts |
admin_get_mailing_list |
One list's moderators and subscribers |
admin_get_domain_summary |
Users, inactive users, accounts expiring in 30 days, storage, licences, domain expiry, mailing lists |
admin_list_agent_users |
Who has an agent password: agent name, active or not, created and expiry |
What you can ask
- "Is Priya's IMAP on?"
- "List the subscribers of sales@."
- "Who has connected an AI agent?"
- "Give me a summary of my domain."
Good to know
- Privacy. What these tools return, including colleagues' names, phone numbers, alternate emails and last sign-in addresses, goes to the assistant and its AI provider. Choose a provider with that in mind. See MCP privacy and security.
Common questions
Can a domain admin's assistant read my mail?
No. Admin tools show account facts such as storage, limits and aliases, never mail.
Why can my agent not use admin tools?
Check that the account is a domain admin and that Send & Save is off for that agent. An agent with Send & Save ticked cannot use admin tools.
Can admin tools change a user or reset a password?
No. They only look things up. No admin tool can edit, add, reset or delete anything.