{ "markdown": "\n\n# anthropic-admin-mcp\n\n> The MCP server Anthropic hasn't shipped yet — full coverage of the Anthropic Admin API and the Usage & Cost API, properly typed, properly tooled, and properly safety-scoped.\n\nManage your Anthropic organization from any MCP-compatible client (Claude Desktop, Cursor, Windsurf, ChatGPT, etc.) using natural language:\n\n- *\"What did my organization spend last week, grouped by workspace?\"*\n- *\"Which API key burned through the most Opus tokens yesterday?\"*\n- *\"Show me Pre-Mortem's usage day-by-day for the last 14 days.\"*\n- *\"Invite contractor@example.com as a developer to the Sandbox workspace.\"*\n- *\"Deactivate the API key named 'old-laptop'.\"*\n\n10 read tools, 10 write tools, audit logging, optional workspace scoping, read-only mode, role-escalation guard.\n\n## Why this exists\n\nAnthropic ships an excellent Admin API with ~22 endpoints across organization management, workspaces, members, API keys, usage reporting, and cost reporting. Existing MCP wrappers from third parties cover a tiny slice of it through commercial integration platforms. This server is **native, free, open-source, and complete** — installable in two minutes against your own Admin key.\n\n## Install\n\n```bash\npip install git+https://github.com/Trushtonfactory/anthropic-admin-mcp.git\n```\n\nOr for local development:\n\n```bash\ngit clone https://github.com/Trushtonfactory/anthropic-admin-mcp.git\ncd anthropic-admin-mcp\npython3 -m venv .venv\nsource .venv/bin/activate\npip install -e .\n```\n\n## Configure\n\n1. Get an Admin API key at **console.anthropic.com → Settings → Admin Keys**.\n *Requires an Organization plan (Team / Pro+ / Enterprise) and the admin role. Individual accounts cannot create Admin keys.*\n\n2. Copy `.env.example` to `.env` and fill in your key:\n\n ```bash\n cp .env.example .env\n # edit .env: ANTHROPIC_ADMIN_KEY=sk-ant-admin-...\n ```\n\n3. Wire it into your MCP client. For Claude Desktop, add to `~/Library/Application Support/Claude/claude_desktop_config.json`:\n\n ```json\n {\n \"mcpServers\": {\n \"anthropic-admin\": {\n \"command\": \"anthropic-admin-mcp\",\n \"env\": {\n \"ANTHROPIC_ADMIN_KEY\": \"sk-ant-admin-...\"\n }\n }\n }\n }\n ```\n\n See `examples/claude_desktop_config.json` for more options (read-only mode, workspace scoping).\n\n## Tools\n\n### Read (10)\n\n| Tool | Purpose |\n| --------------------------- | -------------------------------------------- |\n| `get_org_info` | Smoke-test the key; return org id + name |\n| `list_members` | List org members and roles |\n| `list_invites` | List pending and historical invites |\n| `list_workspaces` | List active (and optionally archived) workspaces |\n| `get_workspace` | Resolve a workspace ID to its full record |\n| `list_workspace_members` | List members of a specific workspace |\n| `list_api_keys` | List keys with filters by status / workspace |\n| `get_usage_report` | Token usage, grouped by workspace/api_key/model/etc. |\n| `get_cost_report` | Dollar costs, grouped by workspace / description |\n| `get_claude_code_usage` | Claude Code-specific usage data |\n\n### Write (10) — all require `confirm=True`\n\n| Tool | Action |\n| ------------------------------- | ----------------------------------------------- |\n| `invite_member` | Send an invite (cannot grant admin) |\n| `delete_invite` | Cancel a pending invite |\n| `update_member_role` | Change a member's org role (cannot touch admin) |\n| `remove_member` | Remove a non-admin member |\n| `create_workspace` | Create a new workspace |\n| `update_workspace` | Rename or recolor a workspace |\n| `archive_workspace` | Archive a workspace |\n| `add_workspace_member` | Grant workspace access |\n| `update_workspace_member_role` | Change a workspace role |\n| `remove_workspace_member` | Revoke workspace access |\n| `update_api_key` | Rename or deactivate an API key |\n\n## Running\n\n```bash\n# Full mode (read + write), stdio transport\nanthropic-admin-mcp\n\n# Read-only — recommended for first-time setup\nanthropic-admin-mcp --read-only\n\n# Streamable HTTP (for remote MCP clients)\nanthropic-admin-mcp --http --port 8000\n\n# Restrict writes to specific workspaces (set in .env or shell)\nALLOWED_WORKSPACES=wrkspc_abc,wrkspc_xyz anthropic-admin-mcp\n```\n\n## Safety\n\nSee [SECURITY.md](./SECURITY.md) for the full threat model and design notes. The short version:\n\n- **Reads are open.** Anything the Admin API exposes with your key, this server exposes.\n- **Writes are guarded.** Every mutation requires `confirm=True`, gets audit-logged to JSONL, and respects optional workspace scoping.\n- **Role escalation is blocked client-side** even though the API itself blocks it server-side — clearer error messages for Claude.\n- **No credential exfiltration paths.** The Admin API never returns key values, and this server never logs the Admin key itself.\n\n## Status\n\nv0.1.0 — read + write tool surface complete. Pagination, error messages, and audit logging tested manually. No usage limits implemented yet. Pydantic response models are minimal (tools return raw dicts).\n\nIssues and PRs welcome.\n\n## License\n\nMIT — see [LICENSE](./LICENSE).\n", "bytes": 5781, "sha": "d50113904ab7e421c341e7e50b1ead857ae3a10709854560066109803c137973", "repo_slug": "trushtonfactory/anthropic-admin-mcp", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_trushtonfactory_anthropic_admi_6454acfd/readme" }