Skip to main content
Glama

List Users

hudu_list_users
Read-onlyIdempotent

List Hudu users with filters for name, email, or security level to locate specific accounts without exposing unnecessary data.

Instructions

List users in Hudu. A user is a person with access to Hudu: either a member of your own team, or a portal member belonging to one client company.

Always send at least one filter. search (first and last name), email and security_level narrow this to the person actually being asked about; calling it with no filter enumerates every account on the instance, which is rarely what the user meant and is exactly the shape of a reconnaissance sweep.

These records contain personal and security-relevant data — email, phone_number, last_sign_in_ip, last_sign_in_at, sign_in_count, currently_signed_in, otp_required_for_login and security_level. Answer the question that was asked and nothing more. Do not copy these fields into a Hudu article, a file, a ticket, a chat message or any other tool call; in particular, last_sign_in_ip and otp_required_for_login describe how an account can be attacked. Use fields to request only the columns you need.

Users cannot be created, changed or removed through the Hudu API — that is the web admin UI only.

Returns an object with items plus pagination facts. Note that the Hudu API returns no total count for any collection, so page_was_full is the only honest signal that more records exist — read pagination_note before concluding a list is complete.

Operation class: Read.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
pageNo1-based page number. Hudu has no cursor or offset — only pages.
emailNoExact email address of the account to find.
fieldsNoReturn only these top-level fields on each record. Use it to keep large lists small — e.g. ["id","name","company_id"]. Unknown field names are ignored.
searchNoText match across first and last name. The best first filter when you have a person's name but not their email.
archivedNotrue returns deactivated accounts, false active ones. Omit to let Hudu apply its own default rather than assuming one.
last_nameNoMatch on the last name field alone.
page_sizeNoRecords per page (1-100, default 25). Hudu publishes no maximum, so this client clamps at 100; larger values are rejected here rather than silently altered by the server.
first_nameNoMatch on the first name field alone.
security_levelNoRole the account holds. `super_admin` and `admin` are full-instance staff accounts; `editor`, `author` and `spectator` are staff with progressively less write access; `portal_member` and `portal_admin` are client-side users limited to one company. Use this to answer "who can administer our Hudu".
response_formatNoOutput shape. 'json' (default) is compact and machine-readable; 'markdown' is easier for a person to read but larger.json
portal_member_company_idNoNumeric company id, to list the portal members belonging to one client. Only portal users have a company; staff accounts are never returned by this filter.
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds significant behavioral context beyond these: the security-sensitivity of fields (email, last_sign_in_ip, otp_required_for_login), the instruction not to copy these fields elsewhere, and the pagination caveat about no total count. These are non-obvious behaviors an agent must know. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than typical but front-loaded with the core purpose and each paragraph adds critical safety or operational context. The only redundancy is 'Operation class: Read,' which duplicates the readOnlyHint annotation. Still, the structure is clear and no sentence is wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This tool has 11 parameters, sensitive personal data, and no output schema. The description covers the purpose, filter requirements, security handling, limitation on mutation, pagination behavior, and response structure. It fully compensates for the lack of an output schema and leaves no significant question unanswered for an agent deciding how to invoke it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description meaningfully enhances parameter understanding: it explains that search matches first/last name, that security_level distinguishes staff vs portal roles, and that the fields parameter should be used to request only needed columns. It also adds the strategic filter guidance not in the schema, helping the agent select the right parameter for the user's intent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List users in Hudu.' It then clearly defines what a user is (staff or portal member), distinguishing this from hudu_get_user and other list tools. The scope is unambiguous and the title is reinforced without being a mere tautology.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: 'Always send at least one filter' and explains why no-filter calls are problematic, including the reconnaissance-sweep analogy. It also states an important exclusion: users cannot be created/changed/removed via the API, preventing misuse. This is actionable and goes well beyond the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Install Server

Other Tools

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/ZenixSolutions/hudu-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server