Manage your account from Claude
Admin MCP is ModGate managing itself — an MCP server exposing your own account (agents, servers, audit log, quota) as tools an AI agent can call, protected by the exact same OAuth 2.1 and continuous-authorization pipeline that secures every other MCP server on ModGate. Included on every plan, including Free.
1. What it actually does
Instead of clicking through the dashboard to check on your account, you can just ask Claude — "show me the last 10 things that happened," "revoke that agent that's been acting weird," "how close am I to my monthly limit." Claude calls a real tool, through a real OAuth-protected request, against your actual account. It's not a simulated or read-only preview — the tools genuinely revoke agents and force reauthentication when asked.
That's also why it's worth trying even if you don't plan to use it day-to-day: it's the clearest demonstration of what ModGate actually does. Letting an AI agent take a real, consequential action — cutting off another agent's access — safely, is the whole product.
2. Connect from the dashboard (recommended)
The fastest path: go to Admin MCP in your dashboard sidebar and click Connect Admin MCP. This provisions a dedicated server and agent identity for your tenant and shows you the MCP URL to connect a client to, plus a button to generate a short-lived test token so you can try it immediately from a terminal.
3. Available tools
| Tool | What it does |
|---|---|
| list_agents | List every agent identity for your tenant, including revoked ones. |
| get_agent | Full detail on one agent — scopes, delegation settings, continuous-auth policy. |
| revoke_agent | Revoke an agent immediately. Its tokens are rejected on next use; any delegation chain it belongs to breaks at that link. |
| force_reauth_agent | Force an agent to re-authenticate without revoking it outright — every outstanding token goes stale immediately. |
| get_audit_log | Query recent audit events — token issuance/rejection, tool calls, revocations, delegation activity. |
| list_protected_servers | List the MCP servers registered behind your tenant, with endpoints and status. |
| get_quota | Current monthly authentication usage against your plan limit, and when it resets. |
4. Connecting a real MCP client manually
Most MCP clients complete OAuth automatically when you point them at your MCP URL. If yours needs a client explicitly bound to your agent identity, register one directly rather than relying on automatic registration:
POST https://api.modgate.io/oauth/register
Content-Type: application/json
{
"client_name": "My MCP client",
"redirect_uris": ["https://your-redirect-uri"],
"tenant_id": "YOUR_TENANT_ID",
"agent_id": "AGENT_ID_FROM_DASHBOARD"
}Then complete the standard PKCE authorization code flow against /oauth/authorize and /oauth/token — see the OAuth 2.1 setup guide for the full flow.
5. Why this is locked down tighter than a typical MCP server
Admin MCP can take real account-control actions — revoke_agent and force_reauth_agent aren't read-only. Two things enforce that only trusted, explicitly scoped callers reach it:
- It only ever runs behind ModGate's own OAuth-protected proxy — there's no direct public endpoint.
- Every request must carry a token bound to a real agent identity with an explicit scope grant for this server — a generic, unscoped token is rejected before any tool runs.
Questions? We answer personally.
[email protected] →