This server lets you manage Adobe Enterprise user license assignments—especially Acrobat/PDF product profiles—through MCP tools backed by Adobe's User Management API.
List users in the Adobe organization, paginated.
Get a specific user's details, including current group/product-profile memberships.
List assignable product profiles, filtered client-side to type == "PRODUCT_PROFILE".
Assign a license by adding a user to a specified product profile.
Remove/revoke a license by removing a user from a specified product profile.
Use either local env credentials or per-request gateway headers with stateless OAuth Server-to-Server token exchange.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@adobe-admin-console-mcp assign Acrobat Pro license to jane@example.com"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Adobe Admin Console MCP server for Claude — exposes Adobe's User Management API (UMAPI) as MCP tools, focused on Acrobat / PDF license (product profile) assignment for Enterprise organizations.
Tech stack: Python 3.12 + uv + FastMCP (Starlette/uvicorn)
Related requirement: PRD-15546 (Onboarding step 16, Acrobat / PDF license assignment). See the full research in vendor-mcp-template/prd/AdobeAdminConsole.md.
The MCP Gateway built for MSPs: visible, controlled, and your data stays where it belongs.
Get started at connect.mspbots.ai →
MSPbots Connector gives your AI clients one MCP URL to reach your entire MSP stack (RMM, PSA, documentation, security, finance), and gives you control over who can call which tool and a record of everything that was called.
Hosted service: connect.mspbots.ai · Free to use.
Visible | Every tool call is logged: who, which vendor, when. Usage dashboard, CSV export, SIEM streaming. |
Controlled | Role-based, per-tool allowlist. Deny by default. |
Protected | Credentials encrypted per record. AI clients never see your vendor passwords or tokens. |
MSP-native | Built for the MSP stack only: RMM, PSA, documentation, security, finance. |
Sign up at connect.mspbots.ai.
Connect your vendors. Pick from 150+ connectors and authorize each one on the vendor's own page, or bring your own API keys. No extra vendor accounts needed.
Set access. Create roles and decide which tools each role may call. Nothing is allowed until you allow it.
Add your MCP URL to your AI client. Copy the URL from your Connector dashboard into Claude, ChatGPT, Cursor, VS Code, Gemini, Codex, or any MCP-capable client.
Ask your AI to do real work, and watch every call appear in the audit log.
Unified gateway
One MCP URL for all your AI clients
150+ connectors across the MSP stack
Custom MCP servers supported, free
Authorization happens on each vendor's own page; the AI never sees passwords or tokens
Bring your own credentials: use the vendor API keys you already have
Multiple accounts per app; connect once, reuse across AI clients
Tool search: finds the right action for the task
One sign-in; vendor credentials are injected behind the scenes and OAuth tokens refresh automatically
Visibility
Audit log for every tool call (who, which vendor, when)
Usage dashboard: call volume, top vendors, error rate, per-user activity
Export audit logs to CSV, or stream to Loki, Graylog, or LogScale (SIEM)
Optional recording of tool arguments and result summaries (off by default, enabled per organization)
Control
Per-role, per-tool allowlist, deny by default
owner / admin / member roles
SCIM provisioning with Entra ID, Okta, JumpCloud, and Google Workspace
Security
Credentials encrypted one record at a time (AES-256-GCM, per-record key)
AI clients authenticate with OAuth 2.1 + PKCE
Vendor responses are scanned for prompt-injection patterns and returned as structured data. This is one layer of defense, not a guarantee against every attack.
Static egress IP for customer firewall and API allowlisting
Free.
Links: connect.mspbots.ai · mspbots.ai
Related MCP server: adobe-custom
cd adobe-admin-console-mcp
uv sync
# stdio mode (for Claude Desktop / CLI), single shared credential set from env
ADOBE_CLIENT_ID=xxxx ADOBE_CLIENT_SECRET=xxxx ADOBE_ORG_ID=xxxx@AdobeOrg uv run adobe-mcpThis service is stateless: it never stores or persists Adobe credentials. Credentials are
either supplied once via environment variables (local dev, AUTH_MODE=env), or per-request via
HTTP headers (AUTH_MODE=gateway, production).
Adobe uses OAuth Server-to-Server (JWT/Service Account auth is deprecated). On every tool
call, this service exchanges the caller's client_id + client_secret for a short-lived Adobe
IMS access_token (~24h TTL) and uses it immediately — the token is not cached across
requests, even though Adobe's own docs suggest doing so, in order to fully comply with the
"no persisted credentials" requirement. This adds one extra IMS round trip per call.
AUTH_MODE=gateway)Header | Type | Required | Default | Allowed values | Description | Example |
| string | Yes | None | None | Client ID of the Adobe Developer Console Project, used to exchange for an access_token and as |
|
| string | Yes | None | None | The corresponding Client Secret, used only within this request to exchange for an access_token; not persisted and not logged |
|
| string | Yes | None | None | Adobe organization ID (Enterprise tenant identifier) |
|
Missing any of the three headers on a /mcp request returns 401 with a required_headers list.
AUTH_MODE=env, local dev only)Variable | Default | Description |
| — | Adobe Developer Console Project Client ID |
| — | Adobe Developer Console Project Client Secret |
| — | Adobe organization ID, e.g. |
|
| UMAPI base URL |
|
|
|
|
|
|
|
| HTTP server port |
|
| HTTP server bind address |
Get credentials: create a Project with User Management API enabled in the Adobe Developer Console (Enterprise organizations only — this API is not available for Teams / Education / individual Adobe IDs).
{
"mcpServers": {
"adobe-admin-console": {
"command": "uv",
"args": ["run", "--directory", "/path/to/adobe-admin-console-mcp", "adobe-mcp"],
"env": {
"ADOBE_CLIENT_ID": "xxxx",
"ADOBE_CLIENT_SECRET": "xxxx",
"ADOBE_ORG_ID": "xxxx@AdobeOrg"
}
}
}
}ADOBE_CLIENT_ID=xxxx ADOBE_CLIENT_SECRET=xxxx ADOBE_ORG_ID=xxxx@AdobeOrg uv run adobe-mcpADOBE_CLIENT_ID=xxxx ADOBE_CLIENT_SECRET=xxxx ADOBE_ORG_ID=xxxx@AdobeOrg \
MCP_TRANSPORT=http AUTH_MODE=env uv run adobe-mcp
curl http://localhost:8080/healthMCP_TRANSPORT=http AUTH_MODE=gateway uv run adobe-mcpBase URL: https://usermanagement.adobe.io/v2/usermanagement
Tool | Description | Parameters |
| List the users of the organization (paginated) |
|
| Get details of the specified user (including current product/group membership) |
|
| List assignable product profiles (e.g. Acrobat Pro / Standard); the client filters by |
|
| Add the user to the specified Product Profile, completing the license assignment |
|
| Remove the user from the specified Product Profile, reclaiming the license |
|
Rate limits (enforced by Adobe, not this service — expect 429 + Retry-After if exceeded):
Endpoint category | Per-client | Global |
List / get users | 25 req/min | 100 req/min |
List groups / product profiles | 5 req/min | 100 req/min |
Assign / remove license (action) | 10 req/min | 100 req/min |
curl -X POST http://localhost:8080/mcp \
-H "x-adobe-client-id: your_client_id" \
-H "x-adobe-client-secret: your_client_secret" \
-H "x-adobe-org-id: 1234567890ABCDEF@AdobeOrg" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","method":"tools/list","id":1}'curl -X POST http://localhost:8080/mcp \
-H "x-adobe-client-id: your_client_id" \
-H "x-adobe-client-secret: your_client_secret" \
-H "x-adobe-org-id: 1234567890ABCDEF@AdobeOrg" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{
"jsonrpc": "2.0",
"method": "tools/call",
"id": 2,
"params": {
"name": "adobe_assign_license",
"arguments": {"email": "user@example.com", "product_profile": "Acrobat Pro DC - Enterprise"}
}
}'curl -i -X POST http://localhost:8080/mcp \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","method":"tools/list","id":1}'
# HTTP/1.1 401 Unauthorized
# {"error":"Missing credentials","required_headers":["x-adobe-client-id","x-adobe-client-secret","x-adobe-org-id"]}No dedicated "list product profiles" endpoint — adobe_list_product_profiles calls the
generic groups endpoint and filters client-side.
No official Adobe sandbox for UMAPI — it requires a real Enterprise organization with at least one product profile to test against (Teams/Education/individual accounts cannot enable this API).
Token exchange happens on every tool call (no caching), which adds latency but keeps the service fully stateless per the SOP requirement.
Assign a license by adding a user to a product profile (e.g. an Acrobat Pro profile).
Rate limit: 10 requests/min per client, 100/min globally.
Args:
email: The user's email address to grant the license to.
product_profile: The exact product profile name (see adobe_list_product_profiles).
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | |||
| product_profile | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavior. It includes a rate limit (10 requests/min per client, 100/min globally) which is useful. However, it does not disclose side effects (e.g., consuming a license seat, irreversibility) or permission requirements, leaving a significant gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the main action, followed by a rate-limiting note and concise parameter explanations. No wasted words; the example and cross-reference earn their place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple two-parameter tool with an output schema present, the description covers purpose, rate limit, and parameter semantics. It lacks error-case behavior or idempotency notes, but for this complexity level it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no parameter descriptions (0% coverage), but the description explicitly explains both parameters: email is the user's email to grant the license, and product_profile must be the exact name, referencing adobe_list_product_profiles. This adds clear semantics beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Assign a license by adding a user to a product profile'), names the resource (license) and mechanism (adding to profile), and gives an example (Acrobat Pro profile). This distinguishes it from sibling tools like adobe_remove_license and adobe_list_users.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: whenever a license needs to be granted. It also provides a cross-reference to adobe_list_product_profiles for obtaining the exact profile name, which is helpful prerequisite guidance. However, it does not explicitly exclude cases (e.g., user already has a license) or directly compare with adobe_remove_license.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Get a single user's details, including current group/product profile memberships.
Rate limit: 25 requests/min per client, 100/min globally.
Args:
email: The user's email address (or Adobe username string).
| Name | Required | Description | Default |
|---|---|---|---|
| Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the transparency burden. It discloses a rate limit and that the input can be an email or Adobe username, but it doesn't mention error behavior, permissions, or explicitly state it's a read-only operation (though 'get' implies it). The rate limit adds some behavioral context, but other aspects are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with three sentences covering purpose, rate limit, and parameter usage. It's front-loaded with the main action and does not include excessive detail, though the rate limit might be optional for tool selection.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-get tool, the description provides the core purpose and a key parameter detail, and the output schema presumably handles return structure. However, it lacks explicit guidance on alternative tools and edge-case behavior, so it's not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description expands on the schema's bare 'email' parameter by explaining it can be an Adobe username string as well, adding meaningful semantics beyond the schema. This is the only parameter, and the description compensates for the 0% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'gets a single user's details' with a specific verb and resource, and distinguishes from sibling 'adobe_list_users' by focusing on a single user. The inclusion of 'group/product profile memberships' adds specific scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for retrieving one user's information, contrasting with the 'list' sibling tools, but it doesn't explicitly tell the agent when to choose this over others or mention any exclusions. This is implied usage based on the word 'single'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List product profiles available for license assignment (e.g. Acrobat Pro/Standard).
Adobe's API returns all groups (user groups and product profiles together);
this tool filters the response down to entries where type == "PRODUCT_PROFILE",
since Adobe has no dedicated "list product profiles only" endpoint.
Rate limit: 5 requests/min per client, 100/min globally.
Args:
page: Page number to fetch, zero-indexed (default: 0).
| Name | Required | Description | Default |
|---|---|---|---|
| page | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully discloses behavior: it filters API responses to type=='PRODUCT_PROFILE' due to Adobe's API limitation, and provides rate limits (5/min per client, 100/min globally). This is valuable insight beyond a simple listing operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: a clear one-line purpose, followed by necessary behavioral notes and parameter details. Every sentence earns its place without unnecessary fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with one optional parameter and an existing output schema, the description covers the essential aspects: purpose, filtering logic, rate limits, and parameter semantics. No significant gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only a default value with no description. The description's Args section adds meaning: 'Page number to fetch, zero-indexed (default: 0)', which is essential for correct usage. This fully compensates for the 0% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List product profiles available for license assignment' with examples (Acrobat Pro/Standard), using a specific verb+resource. It distinguishes from sibling tools like adobe_list_users by focusing on product profiles.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The tool's purpose for license assignment is clear and the context implies when to use it. However, it does not explicitly state alternatives or when-not-to-use scenarios, though the filtering note provides helpful context about the API's behavior.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List users in the Adobe organization.
Rate limit: 25 requests/min per client, 100/min globally.
Args:
page: Page number to fetch, zero-indexed (default: 0). Check the
response's "lastPage" field to know whether to fetch the next page.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full responsibility for behavioral disclosure. It adds valuable context by disclosing rate limits and pagination mechanics beyond a simple 'list users' statement. It does not cover auth or error behavior, but for a simple list operation this is reasonably transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and well-structured: a one-line summary, a rate-limit note, and an Args block. Every sentence earns its place without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a low-complexity tool with one optional parameter and an output schema present. The description covers rate limits and pagination semantics comprehensively, and the output schema handles return value documentation. No significant gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides only a 'page' integer with no description (0% coverage), but the description fully explains it: zero-indexed, default 0, and how to use the 'lastPage' field to continue pagination. This adds critical meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List users in the Adobe organization' with a specific verb ('List') and resource ('users'), and it naturally distinguishes from siblings like adobe_get_user (single user retrieval) and adobe_list_product_profiles (different resource).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides concrete usage context, including rate limits (25/min client, 100/min global) and pagination instructions referencing the 'lastPage' field. It implies this is the tool for enumerating users, but does not explicitly mention alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Revoke a license by removing a user from a product profile.
Rate limit: 10 requests/min per client, 100/min globally.
Args:
email: The user's email address to revoke the license from.
product_profile: The exact product profile name (see adobe_list_product_profiles).
| Name | Required | Description | Default |
|---|---|---|---|
| Yes | |||
| product_profile | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It adds a rate limit (10/min per client, 100/min globally) and implies the action is a removal, but it does not mention side effects, idempotency, or error behavior (e.g., if the user is not in the profile).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the primary action, then a rate limit note, then an Args section. Every sentence contributes value, and the structure is easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core purpose, rate limit, and parameter meanings, and references a sibling tool for obtaining valid values. Given that an output schema exists, return values need not be explained. However, it omits edge-case behavior such as handling missing users, which prevents a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains both parameters: email is 'the user's email address to revoke the license from' and product_profile is 'the exact product profile name (see adobe_list_product_profiles).' This adds meaningful usage guidance beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Revoke a license by removing a user from a product profile,' which is a specific verb+resource statement that clearly differentiates it from siblings like adobe_assign_license. It conveys both the action and the mechanism.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context by noting the exact product profile name should be sourced from adobe_list_product_profiles, which is a useful usage hint. However, it does not explicitly contrast with alternatives or state when not to use it, though the purpose makes the primary use case evident.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0adobe_assign_licenseadobe_get_useradobe_list_product_profilesadobe_list_usersadobe_remove_licenseScored across 5 tools
Each tool has a clearly distinct purpose: listing users, getting user details, listing product profiles, assigning licenses, and removing licenses. There is no overlap or ambiguity in their intended functions.
All tool names follow a consistent 'adobe_' prefix with a verb_noun pattern: list_users, get_user, list_product_profiles, assign_license, remove_license. The naming is uniform and predictable.
With 5 tools, the server is well-scoped for its purpose of managing Adobe admin console users and licenses. Each tool serves a necessary function, and the count is within the ideal 3-15 range.
The tool set covers the core license management lifecycle: read users, read profiles, assign and revoke licenses. Minor gaps exist such as no user creation or deletion, but these may be outside the server's intended scope, so the coverage is nearly complete.
Create, schedule, and publish social posts, manage accounts, and read analytics as MCP tools.
One MCP endpoint for your company's tools, with per-person sign-in, policy and audit.
