Cloud Admin Manage Tool
admin_manageSuspend compromised teams, adjust billing, force-rotate user sessions, and browse cross-team security signals for incident response and platform-wide security review.
Instructions
Platform super-admin operations — suspend tenants, adjust billing, force-rotate user sessions, browse cross-team security signals. Restricted to users with is_super_admin=true (HTTP 403 for all other callers regardless of team role). Every write is audit-logged with the calling super-admin's id, target id, and reason.
When to use: incident response (suspend a compromised team, revoke leaked sessions), customer-success billing adjustments, or platform-wide security review. Do NOT use for routine tenant operations — those have team-scoped tools.
Actions (pass alongside action):
team_suspend (DESTRUCTIVE — disables tenant logins) — team_id (UUID), reason (string). Existing API tokens for the team are invalidated; users see a 403 on all API calls.
team_billing (read) — team_id. Returns current invoice + plan summary, including next-cycle estimate.
billing_credit (write — moves money) — team_id, amount (positive integer cents), reason (string). Adds to the team's CreditLedger; reflects in the next invoice.
billing_refund (DESTRUCTIVE — issues a real Stripe refund) — team_id, amount (cents). Refunds against the most recent successful charge; partial refunds supported.
security_overview (read) — recent suspicious activity across all teams: failed logins, token leaks, abuse signals.
user_revoke_sessions (DESTRUCTIVE) — user_id (UUID). Invalidates ALL sessions and Sanctum/Passport tokens for the user; they must re-authenticate everywhere.
user_send_password_reset (write) — user_id. Emails a password-reset link with a 60-minute one-time token.
Cloud note: feedback management (feedback_list/feedback_update) lives under platform support tooling, not exposed via MCP. Errors: 401, 403 (not super-admin), 404, 422, 429, 503 (Stripe down for billing actions).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform: team_suspend, team_billing, billing_credit, billing_refund, security_overview, user_revoke_sessions, user_send_password_reset | |
| deadline_ms | No | Optional: max wall-clock time (ms) the tool may spend. If exceeded during the call, returns a DEADLINE_EXCEEDED error. Minimum 100 ms. Leave unset for no deadline. | |
| team_id | Yes | UUID of the team to suspend or reactivate | |
| reason | No | Reason for suspension (required when suspending) | |
| amount_cents | Yes | Amount in cents (negative to add credit, e.g. -1000 = €10 credit) | |
| description | No | Description for the balance transaction | Admin credit |
| payment_intent_id | Yes | Stripe payment_intent ID to refund (e.g. pi_...) | |
| user_id | Yes | UUID of the user whose tokens to revoke |