Workspaces and the admin area
Understand workspace access before you connect a user or administrator agent.
A workspace is where your users work together. Projects belong to a workspace, and the app checks a user's membership before returning its data.
Let's say you have a workspace for your design team and another for your customers. Connecting an agent to the design workspace should only give it access to that workspace's projects.
User connections
A User MCP connection selects one workspace during consent. The app checks the account, session and current workspace access on every tool call.
To connect to another workspace, create another connection and select that workspace. Changing a workspace ID in a tool request doesn't give the agent extra access.
Workspace owners and application administrators
A workspace owner manages a workspace. An application administrator manages the application across users and workspaces. Those are different roles.
Owning a workspace doesn't automatically allow an account to connect to the Admin MCP. Admin connections require the application's current administrator role.
Granting admin access
Use the admin setup documented in your kit's repository. The exact mechanism differs: Supabase uses trusted application metadata, Convex uses its application admin checks, and Better Auth kits keep admin roles in their existing auth data.
Assign the role through trusted server-side administration. A normal account should not be able to make itself an administrator by editing its profile.
Admin MCP
The Admin MCP can list users and workspaces across the application. All eight admin MCPs are read-only in v5.
An admin token is accepted only at the admin resource. Use a separate User MCP connection when the same administrator wants to work with one workspace's projects.
See tools and permissions for the exact tool names and scopes.