# update_mcp_server_user_access

Grant or revoke individual user access to an MCP server. Changes take effect immediately and override the default access setting for the selected users; use list_mcp_server_user_access first if you need the current state.

Agent View of the PolicyLayer registry record for `update_mcp_server_user_access`. HTML page: https://policylayer.com/tools/codeswhat-portkey-admin-mcp/update-mcp-server-user-access

## Facts

- Tool: `update_mcp_server_user_access`
- Server: Portkey Admin (`codeswhat/portkey-admin-mcp`) — https://policylayer.com/tools/codeswhat-portkey-admin-mcp.md
- Homepage: https://github.com/CodesWhat/portkey-admin-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 0
- Recommended policy verdict: Rate-limited

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "update_mcp_server_user_access",
    "arguments": {}
  }
}
```

## Why update_mcp_server_user_access is rated Medium

This tool creates or modifies user access permissions to MCP servers. While it affects authorization rather than data, it is reversible (access can be granted or revoked), making it a Write operation rather than Destructive. The severity is high because misconfiguration could grant unauthorized access to sensitive systems or revoke legitimate access, creating security and availability risks.

From the tool's own definition: "Tool explicitly performs 'Grant or revoke individual user access' and 'Changes take effect immediately', indicating it modifies access control state for users."

## Use case

AI agents use update_mcp_server_user_access to create or update resources in Portkey Admin, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Portkey Admin environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Portkey Admin:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "update_mcp_server_user_access": {
      "limits": [
        {
          "counter": "update_mcp_server_user_access_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on Portkey Admin (155)

- `cancel_log_export` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/cancel-log-export.md
- `delete_api_key` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-api-key.md
- `delete_collection` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-collection.md
- `delete_config` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-config.md
- `delete_guardrail` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-guardrail.md
- `delete_integration` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-integration.md
- `delete_integration_model` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-integration-model.md
- `delete_mcp_integration` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-mcp-integration.md
- `delete_mcp_server` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-mcp-server.md
- `delete_prompt` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-prompt.md
- `delete_prompt_label` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-prompt-label.md
- `delete_prompt_partial` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-prompt-partial.md
- `delete_provider` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-provider.md
- `delete_rate_limit` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-rate-limit.md
- `delete_secret_reference` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-secret-reference.md
- `delete_usage_limit` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-usage-limit.md
- `delete_user` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-user.md
- `delete_user_invite` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-user-invite.md
- `delete_virtual_key` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-virtual-key.md
- `delete_workspace` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/delete-workspace.md
- `remove_workspace_member` — Destructive — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/remove-workspace-member.md
- `run_prompt_completion` — Execute — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/run-prompt-completion.md
- `start_log_export` — Execute — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/start-log-export.md
- `test_mcp_server` — Execute — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/test-mcp-server.md
- `download_log_export` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/download-log-export.md
- `get_analytics_group_metadata` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-analytics-group-metadata.md
- `get_analytics_group_models` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-analytics-group-models.md
- `get_analytics_group_users` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-analytics-group-users.md
- `get_api_key` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-api-key.md
- `get_cache_hit_latency` — Read — https://policylayer.com/tools/codeswhat-portkey-admin-mcp/get-cache-hit-latency.md
- …and 125 more: https://policylayer.com/tools/codeswhat-portkey-admin-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=codeswhat-portkey-admin-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/codeswhat-portkey-admin-mcp