adobe-admin-console-mcp

English | 中文

Adobe Admin Console MCP server for Claude — exposes Adobe's User Management API (UMAPI) as MCP tools, focused on Acrobat / PDF license (product profile) assignment for Enterprise organizations.

Tech stack: Python 3.12 + uv + FastMCP (Starlette/uvicorn)

关联需求：PRD-15546（Onboarding step 16，Acrobat / PDF license assignment）。完整调研见 vendor-mcp-template/prd/AdobeAdminConsole.md。

Quick Start

cd adobe-admin-console-mcp
uv sync

# stdio mode (for Claude Desktop / CLI), single shared credential set from env
ADOBE_CLIENT_ID=xxxx ADOBE_CLIENT_SECRET=xxxx ADOBE_ORG_ID=xxxx@AdobeOrg uv run adobe-mcp

Related MCP server: N-central MCP Server

Authentication

This service is stateless: it never stores or persists Adobe credentials. Credentials are either supplied once via environment variables (local dev, AUTH_MODE=env), or per-request via HTTP headers (AUTH_MODE=gateway, production).

Adobe uses OAuth Server-to-Server (JWT/Service Account auth is deprecated). On every tool call, this service exchanges the caller's client_id + client_secret for a short-lived Adobe IMS access_token (~24h TTL) and uses it immediately — the token is not cached across requests, even though Adobe's own docs suggest doing so, in order to fully comply with the "no persisted credentials" requirement. This adds one extra IMS round trip per call.

Gateway mode HTTP headers (AUTH_MODE=gateway)

Missing any of the three headers on a /mcp request returns 401 with a required_headers list.

Env mode variables (AUTH_MODE=env, local dev only)

Get credentials: create a Project with User Management API enabled in the Adobe Developer Console (Enterprise organizations only — this API is not available for Teams / Education / individual Adobe IDs).

Claude Desktop Setup

{
  "mcpServers": {
    "adobe-admin-console": {
      "command": "uv",
      "args": ["run", "--directory", "/path/to/adobe-admin-console-mcp", "adobe-mcp"],
      "env": {
        "ADOBE_CLIENT_ID": "xxxx",
        "ADOBE_CLIENT_SECRET": "xxxx",
        "ADOBE_ORG_ID": "xxxx@AdobeOrg"
      }
    }
  }
}

Transport Modes

stdio (Claude Desktop / CLI)

ADOBE_CLIENT_ID=xxxx ADOBE_CLIENT_SECRET=xxxx ADOBE_ORG_ID=xxxx@AdobeOrg uv run adobe-mcp

HTTP — single-tenant (env mode)

ADOBE_CLIENT_ID=xxxx ADOBE_CLIENT_SECRET=xxxx ADOBE_ORG_ID=xxxx@AdobeOrg \
MCP_TRANSPORT=http AUTH_MODE=env uv run adobe-mcp
curl http://localhost:8080/health

HTTP — gateway / multi-tenant (production)

MCP_TRANSPORT=http AUTH_MODE=gateway uv run adobe-mcp

Tool List

Base URL: https://usermanagement.adobe.io/v2/usermanagement

Rate limits (enforced by Adobe, not this service — expect 429 + Retry-After if exceeded):

Test Examples

tools/list (gateway mode)

curl -X POST http://localhost:8080/mcp \
  -H "x-adobe-client-id: your_client_id" \
  -H "x-adobe-client-secret: your_client_secret" \
  -H "x-adobe-org-id: 1234567890ABCDEF@AdobeOrg" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'

tools/call — assign an Acrobat license

curl -X POST http://localhost:8080/mcp \
  -H "x-adobe-client-id: your_client_id" \
  -H "x-adobe-client-secret: your_client_secret" \
  -H "x-adobe-org-id: 1234567890ABCDEF@AdobeOrg" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{
    "jsonrpc": "2.0",
    "method": "tools/call",
    "id": 2,
    "params": {
      "name": "adobe_assign_license",
      "arguments": {"email": "user@example.com", "product_profile": "Acrobat Pro DC - Enterprise"}
    }
  }'

Missing headers → 401

curl -i -X POST http://localhost:8080/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'
# HTTP/1.1 401 Unauthorized
# {"error":"Missing credentials","required_headers":["x-adobe-client-id","x-adobe-client-secret","x-adobe-org-id"]}

API Reference

• UMAPI documentation

• OAuth Server-to-Server authentication

• Adobe Developer Console

Known Limitations

• No dedicated "list product profiles" endpoint — adobe_list_product_profiles calls the generic groups endpoint and filters client-side.

• No official Adobe sandbox for UMAPI — it requires a real Enterprise organization with at least one product profile to test against (Teams/Education/individual accounts cannot enable this API).

• Token exchange happens on every tool call (no caching), which adds latency but keeps the service fully stateless per the SOP requirement.