Getting access to HG MCP Server — admin
0. Who is this documentation for?
What this doc covers
You look after the people in your organization. This page shows you how to get them in, how to make one of them an admin, how to remove someone, and what to do when it does not go smoothly.
Prerequisites
You are an admin of your organization.
More info
There are two ways to become an admin. If you are the first person from your company to sign up, the organization is created for you and you are made its admin automatically. Otherwise, ask an existing admin to promote you.
Everything below is written for the screens. All of it can also be done from an MCP client, using the admin tools, see section 4 for how to get access to them.
1. Getting people into your organization
Two ways in. One you start, one they start.
Either way they arrive as a member. To make someone an admin, see step 2.
| Route | What you do | How to do so |
|---|---|---|
| Invite someone | You send the invitation and it puts them straight into your organization. There is no approval step. Note that any member can invite people, being an admin is not required for this. | Settings → Teams → the team they should join. Click Invite Team Member, enter their work email address and send. If it is not picked up, the member list offers Resend Invitation. |
| They sign up themselves | They request access themselves and are matched to an organization by their email address domain, then choose whether to join it or to create a separate one. Only if they choose to join does anything reach you. That request arrives in your queue, where you approve it. A request expires after 72 hours, after which the person must sign up again. If there is a problem with their domain, or they are matched to the wrong organization, contact HG. | Settings → Onboarding. Under Pending Join Requests, click Approve on their row. The row shows their name, email, any justification they wrote, and the date and time the request times out. |
2. Promoting a member to admin
Admins are appointed by other admins, there is no request or approval step, and HG is not involved.
| To… | Do this |
|---|---|
| Promote a member to admin | Find them in the member list and change their role to admin. They have full admin control from that moment. |
| Demote an admin back to member | The same screen, in reverse. You cannot change your own role, another admin does that for you. |
3. Removing someone
Removing a person is the same screen as adding one.
| To… | Do this |
|---|---|
| Remove a member | Settings → Teams → the team they are in. Find them in the member list and remove them. |
| Remove them from the organization entirely | Removing someone from one team leaves them in the organization if they still belong to another. Check every team they are in. |
A team must always keep at least one admin. If the person you are removing is the team’s only admin, the removal is refused with “Cannot remove the last admin from the team”. Promote another member to admin first, then remove them.
To take away someone’s admin rights without removing them, demote them instead, see step 2.
4. Accessing the admin tools
Everything on this page can also be done from your LLM, using the admin tools: inviting someone, removing someone, setting or removing an integration credential. They are documented tool by tool in User management, and the admin-key model, its security boundaries and the audit trail are covered in Admin operations overview.
The catch is how you connect. The sign-in you normally use to add the HG MCP Server connector to your LLM gives you member-level access only, whatever your role, so none of the admin tools will appear. To reach them you need a second connection, made with an admin-scoped API key and the endpoint address instead of signing in.
The two ways to connect, and which one works here:
Signing in (OAuth), the Authorize screen a client shows you. This is the default, and it is what you get unless you deliberately do otherwise. Member-level access, no admin tools.
Endpoint address and an admin API key, configured in the client instead of signing in. The only route to the admin tools.
The two levels do not mix. An admin key sees only the admin tools, not the company and contact tools. If you want both, keep two connections and use whichever fits the task.
You need an admin key
| Step | How to do so |
|---|---|
| Create the key | Click MCP in the sidebar, then create a key and set its scope to Admin. The Admin option is selectable only if you are an org admin — it is greyed out otherwise, and a request that reaches the server anyway is refused. A non-admin cannot mint one. |
| Copy it | Copy it when it appears. It also stays visible in the key list on the same page, so you can come back for it. |
| Connect your client with the key | Use the endpoint address shown on the same page, together with the key. |
Two things to expect
| What happens | |
|---|---|
| The key follows your role, not the other way round | If you stop being an org admin the key is not revoked. Over MCP the admin tools simply disappear from the tool list and it carries on as an ordinary user key; the admin REST endpoints reject it. Losing access to the organization altogether does revoke it. |
| There is no bulk action | Each tool handles one person, or one credential, per call, so doing something for fifty people means fifty calls. Inviting the same address twice is safe: it returns the invitation already in flight rather than sending a second one. |
5. Troubleshooting
If someone cannot get in by signing up, invite them instead. An invitation does not go through the sign-up route at all, it puts the person straight into your organization, so it steps around whatever stopped them. Unless their address itself is being refused, this resolves the situation faster than diagnosing it. See section 1.
| If… | What to do |
|---|---|
| A colleague’s work address is not being accepted | Nothing you can change from your side. Send the exact address to your HG contact so the domain can be confirmed. |
| Their sign-up link has expired | Ask them to sign up again, a fresh link is sent each time. |
| A colleague says they signed up and heard nothing | Check Pending Join Requests first. If they are not there, ask which address they used: a sign-up refused for using a personal address produces no email and appears in no queue, so there is nothing for either of us to find. |
| A colleague cannot sign in with Google or Microsoft | Their company blocks third-party sign-in for those accounts. It is a policy on their side, not a fault in HG MCP Server, and HG cannot lift it. Tell them to use the email and password route instead: sign up with the work address, then set a password when the claim email arrives. The same applies to you when connecting a client: if the sign-in flow will not complete, connect with an endpoint and key instead. |
| You cannot tell how far someone has got | Your queue shows only requests waiting on you. For the earlier steps, whether they have verified their address, reach out to your HG contact. |