Admin MCP Server

Connect AI assistants to Front via the Admin MCP server

Front's Admin MCP server (mcp.frontapp.com/admin-mcp) lets AI agents manage your Front configuration through a single OAuth-authenticated endpoint. Agents can set up AI teammates, author knowledge, build rules, and manage inboxes, tags, templates, teammates, and more. Agents authenticate as a specific Front admin, and can only reach what that admin can manage. The Admin MCP server is separate from the Front MCP server, which works with conversation data on behalf of any teammate.

This article covers how to connect any MCP-compatible client to the Admin MCP server using an OAuth app you create yourself in the Front developer settings. For the user-facing overview and use case inspiration for Front admins, see the general Help Center article on the Admin MCP server.

Looking for examples before you build?

The MCP space in the Front Community has workflow walkthroughs, sample prompts, and more. You can also start up discussions about the Admin MCP server with fellow users and our team.

Overview

The connected agent can only manage what the authorizing admin can manage. Company admins can work across the whole company, while workspace admins can only change the workspaces they administer and don't see tools for company-level resources such as AI teammates, knowledge bases, or custom fields. Changes made through the Admin MCP server show in your audit log under the admin who authorized the connection.

Incompatibility list

Some AI assistants do not support confidential connections. These clients cannot connect to the Front Admin MCP server:

• Any client that requires Dynamic Client Registration (DCR)

Use cases

A few patterns this surface unlocks:

• Set up an Autopilot AI teammate end to end. Have your AI assistant read an inbox's resolved conversations to learn what to automate, then create the AI teammate, write its instructions, tone, and playbooks, connect a knowledge source, and build the rule that routes conversations to it.
• Tune AI teammates after launch. Pull improvement opportunities and Replies Hub data, figure out whether a failure is a knowledge gap or a guidance problem, then edit the article, playbook, or instructions that caused it. Simulation sets and success criteria let you track whether a fix worked.
• Author and publish knowledge. Create knowledge bases, categories, and articles, edit them in bulk, and publish them so AI teammates can answer from them.
• Build and maintain workspace configuration. Create or update rules (including branching rules and SLA or CSAT recipes), inboxes, tags, message templates, views, custom fields, task templates, shifts, and teammate groups by describing what you need instead of clicking through settings.
• Connect AI teammates to your other systems. Build custom application connectors, test their requests against the third-party API, and attach them to playbooks.

Set up the Admin MCP server connection

Connecting an AI assistant to Front's Admin MCP server has two general steps: create a Front developer app with the Front Admin MCP feature, and then connect your AI client using the app's credentials.

1. Set up the Front developer app with the Front Admin MCP feature

1. Create a developer app and give it an appropriate name (e.g. "Claude Admin MCP Connector").
2. Click Add feature in the Features tab and select Front Admin MCP.

   📘

   If Front Admin MCP isn't in the list, refresh the page.

3. Note the Client ID and Client secret.
4. Add a redirect URL that corresponds to the AI assistant you're sending data to. For example, as of this writing, the Claude documentation instructs you to use https://claude.ai/api/mcp/auth_callback for most versions of Claude. If you're using Claude Code or similar CLI, you should enter http://localhost/callback. This URL will allow you to connect to a randomly generated local port.
5. Under Resource permissions, select the resources available to the Admin MCP server and whether the agent can read or write each one. Besides the resources you may know from the Front MCP server, the Admin MCP feature includes ai_agents, ai_resources (playbooks, tones, and knowledge sources), applications, macros, and task_templates.

   👍

   Request the narrowest set that covers your use case. An agent that only audits or reports on your configuration needs read. Only grant write on the resources your agent will actually change.

   📘

   Remember that despite the permissions selected in the OAuth client, agents connecting to the Admin MCP server will be further limited by the subset of data and permissions that the admin who connects the agent has access to.

   📘

   If you change the resource permissions after the initial setup, you must disconnect and re-authorize your connection with your AI assistant ("Connect your AI Assistant" steps) before the new permissions take effect.

6. Save the app.
   

2. Connect your AI assistant

Once the app is configured, connect from your MCP client so that you and your team can view the Front Admin MCP server. Once it is set up for your company, individual admins can find the server in the list of connectors and authorize it for their own accounts, without configuring the server URL and credentials described in this section.

The exact configuration syntax for initial configuration varies by AI client, but every client will need:

• The Admin MCP server URL: https://mcp.frontapp.com/admin-mcp
• Your app's client_id and client_secret
• The OAuth scope the app should request. Either leave this blank or supply feature:admin_mcp if you need to input a value
• If your AI assistant requests information about our OAuth URLs, use the following values:
  

  URL	Value
  Authorization	https://app.frontapp.com/oauth/authorize
  Token & refresh URL	https://app.frontapp.com/oauth/token

Example for Claude (Web and Desktop)

1. Open Settings and navigate to the Connectors tab (or the Customize page).
2. Click + and then Add custom connector.
3. Enter the server URL: https://mcp.frontapp.com/admin-mcp
4. Click Advanced settings and enter your OAuth Client ID and Client Secret.
5. Click Add and complete the OAuth authentication flow.

   📘

   You may have to close out Claude and re-open it before it sees the new MCP server and has you authorize permissions.

Example for Claude Code

1. In Front, make sure your developer app contains the http://localhost/callback redirect URL.
2. In your terminal, run the following command and enter your client secret when prompted:

   📘

   Including MCP_CLIENT_SECRET is optional. If you don't include it, Claude should prompt you for it after. If it fails to do so, then include it inline.

   👍

   You can name the server something other than front-admin. If you connect to more than one Front company, give each connection a unique name, such as front-admin-<company name>.

   MCP_CLIENT_SECRET=<your-client-secret> claude mcp add --transport http --client-id <your-client-id> --client-secret front-admin https://mcp.frontapp.com/admin-mcp

3. Exit Claude and re-open it in your terminal so that it pulls the latest list of servers.
4. Run /mcp to see a list of MCP servers.
5. Select the server you added and choose to Authenticate it.
6. Authorize in your browser.

Example for ChatGPT

1. In ChatGPT settings, turn on developer mode.
2. In Plugins, click + and enter the server URL: https://mcp.frontapp.com/admin-mcp
3. Open the advanced OAuth settings and enter your OAuth Client ID and Client Secret.
4. Copy the callback URL ChatGPT shows and add it as a redirect URL in your Front developer app.
5. Complete the OAuth authentication flow.

Example for generic MCP server config (confirm with your client's docs on exactly how you structure and pass these properties) - Not recommended for most users

{
  "mcpServers": {
    "front-admin": {
      "url": "https://mcp.frontapp.com/admin-mcp",
      "transport": "streamable-http",
      "oauth": {
        "client_id": "<your-client-id>",
        "client_secret": "<your-client-secret>",
        "scopes": ["read", "write"]
      }
    }
  }
}

Tips for authorization

When the client first connects, each admin will be redirected to Front to log in and consent. The resulting token is bound to that specific Front admin, and they can only manage what their Front role allows. AI teammates can't authorize the Admin MCP server.

Which tools you'll see

Not every admin sees every tool. Workspace admins don't see tools for company-level resources, and some tools only appear when your plan or account includes the matching feature. For example, shift tools need the Shifts feature, simulation tools need Autopilot, and connector-building tools need custom application connectors.

Getting access to new tools

When Front adds a tool that needs a permission your connection doesn't have yet, the tool appears in your AI assistant, but calling it returns a missing required scopes error. That's because a connection keeps the permissions that were approved when it was first authorized; it doesn't pick up new ones on its own.

Rate limits

The Admin MCP server allows 200 tool calls per minute per company, on every plan. Every admin, AI assistant, and developer app at your company shares this limit, and every tool call counts the same regardless of which tool it is.

How to handle a limit

When your company goes over the limit, the call fails with an MCP error that says how long to wait:

Admin MCP is limited to 200 tool calls per minute per company. Retry after Xs.

Wait the stated time before retrying. Earlier retries will simply be rejected again.

Tool reference

Identity and feedback

Conversations

These tools let an admin study an inbox's history before automating it. They return only what the admin can see in Front, and always search across all inboxes the admin can access.

AI teammates

Knowledge

Rules

Workspace configuration

AI teammate evaluation and testing

Custom application connectors

These tools build the custom applications whose requests AI teammates can call from playbooks. They require custom application connectors on your plan.

Troubleshooting

401 Unauthorized on every request

The token is invalid, expired, or has been revoked. Common causes:

• The admin revoked the app's access in Front's connected apps settings.
• A company admin uninstalled the OAuth app entirely.
• The access token expired and the refresh flow didn't fire. Re-authenticate to mint a new token.

missing required scopes on a tool

Your connection doesn't have a permission this tool needs. This usually happens after Front adds a tool. See Getting access to new tools.

This token cannot access the Admin MCP Server

The connection is using a developer app set up for the Front MCP server. Create a separate developer app with the Front Admin MCP feature and connect with its credentials.

The Admin MCP Server requires an admin requester

Only company admins and workspace admins can use the Admin MCP server. Have an admin authorize the connection instead.

A tool is missing or refuses a workspace

Workspace admins only see workspace-level tools and can only change workspaces they administer. Some tools also depend on your plan or features enabled for your company. See Which tools you'll see.

A tool stops working after an admin's Front access changes

Permissions are enforced at call time against the admin's current Front role. If the admin lost admin rights or access to a workspace after authorizing, tools that need that access will fail.

Admin MCP is limited to 200 tool calls per minute per company

Your company went over its shared rate limit. Wait the number of seconds in the error before retrying. If this happens during normal use, look for a polling loop that's tighter than it needs to be, or several agents running at once, since everyone at your company shares the limit. For more details, see the rate limits section.

Feedback & community discussions

To share feedback about tools you'd like to see in the Admin MCP server, please add an idea in our community or vote on an existing one. You can also ask your AI assistant to send feedback directly with the send_feedback tool.

To discuss Admin MCP server use cases and workflows, please create a post in or subscribe to our discussion space.