Users, groups & permissions

This page covers looking up people, managing user accounts and groups, and inspecting permission schemes (the rules that decide who can do what on a project). It is heavily admin-gated: of the 57 tools listed below, 29 — marked [ADMIN] in the tables — only work, and only even appear to the agent, when your MCP server deployment has an admin token (JIRA_ADMIN_TOKEN) configured. If you only have the standard token you can still look people up, check who's assignable to a project, find groups by name, and read permission and notification schemes; creating, changing or deleting an account or group, and anything touching seats, credentials, avatars, anonymization or a scheme's grants, needs the admin token. The [ADMIN] markings are generated from the server's own registry — read them rather than any summary if the two ever disagree.

Example prompts

Works without an admin token:

"Look up the Jira account for jsmith."
"Who can be assigned to PROJ-123?"
"Search for users with 'chen' in their name or email."
"Find people across the PROJ and OPS projects who could pick up this ticket."
"Would 'Summer2026!' pass our password policy for a new account?"
"How many duplicate user accounts do we have from the LDAP sync?"

Needs an admin token:

"Create a new Jira account for our new hire, Priya Patel."
"Add jsmith to the Developers group."
"What does the Developers permission scheme grant?"
"Reset dwilson's password."
"Remove ex-employee mjones's Jira Software license."
"Permanently delete the old test account qa-bot." (the agent will ask you to confirm first)
"Anonymize the account for a user who submitted a data-erasure request."
"List all our permission schemes."

What's available

Looking up people (mostly no admin token needed)

Tool	What it does
`get_user`	Get a single user by username or key
`list_users`	List all users on the instance, page by page
`search_users`	Find users by a username or query substring
`get_users_picker`	Find users for a typeahead picker by query
`find_assignable_users`	Find users assignable to a specific issue or project
`find_bulk_assignable_users`	Find users assignable across multiple projects at once
`find_users_with_browse_permission`	Find users with permission to browse a given issue or project
`find_users_with_permission`	Find users holding all of the given permissions on a project or issue
`get_user_avatars`	Get all avatars (system and custom) available for a user
`get_user_columns`	Get a user's configured default issue-list columns
`get_user_properties`	Get the property keys stored on a user
`get_user_property`	Get a single user property's value by key
`get_user_a11y_settings`	Get a user's accessibility personal settings (e.g. underlined links, status patterns)
`check_password_policy_create_user`	Check if a candidate password would pass policy for a new account
`check_password_policy_update_user`	Check if a candidate new password would pass policy for an existing user
`get_duplicated_users_count` `[ADMIN]`	Get the count of duplicated user accounts (an LDAP/directory-sync diagnostic)
`get_duplicated_users_list` `[ADMIN]`	Get the mapping of duplicated user accounts (an LDAP/directory-sync diagnostic)
`get_user_anonymization_progress` `[ADMIN]`	Get the progress of a scheduled anonymization task
`get_user_anonymization_rerun_validation` `[ADMIN]`	Check (dry run) whether a past anonymization can safely be re-run
`get_user_anonymization_validation` `[ADMIN]`	Check (dry run) whether a user can safely be anonymized

User accounts: create, edit & credentials (mostly admin)

Tool	What it does
`create_user` `[ADMIN]`	Create a new Jira user account — the new account can log in and takes a licensed seat, even if you don't name any applications. Requires `confirm:true`
`update_user` `[ADMIN]`	Update an existing user's name, email, display name, active status, or licenses. Requires `confirm:true` only when granting licenses or setting `active:true` (reactivating a disabled account)
`update_user_password` `[ADMIN]`	Change a user's password. Requires `confirm:true`
`delete_user` `[ADMIN]`	Permanently delete a user account — irreversible. Requires `confirm:true`
`add_user_to_application` `[ADMIN]`	Add a user to an application (grant a license/seat). Requires `confirm:true`
`remove_user_from_application` `[ADMIN]`	Remove a user from an application (revoke a license/seat). Requires `confirm:true`
`set_user_columns`	Set a user's default issue-list columns, replacing the full list
`reset_user_columns`	Reset a user's default issue-list columns to the system default. Requires `confirm:true`
`set_user_property`	Set the value of a named property on a user (arbitrary JSON)
`delete_user_property`	Delete a named property from a user. Requires `confirm:true`
`delete_user_session` `[ADMIN]`	Forcibly terminate all of a user's active sessions. Requires `confirm:true`

User avatars (all admin)

Tool	What it does
`store_temporary_user_avatar` `[ADMIN]`	Upload image bytes as a temporary avatar (step 1 of the upload/crop flow)
`create_user_avatar_from_temporary` `[ADMIN]`	Convert a temporary avatar into a real, selectable custom avatar
`update_user_avatar` `[ADMIN]`	Assign an existing (system or custom) avatar to a user by id
`delete_user_avatar` `[ADMIN]`	Delete a custom user avatar by id. Requires `confirm:true`

User anonymization (all admin)

Tool	What it does
`schedule_user_anonymization` `[ADMIN]`	Schedule irreversible anonymization of a user's identity and disable the account. Requires `confirm:true`
`schedule_user_anonymization_rerun` `[ADMIN]`	Schedule a re-run of a previous anonymization, e.g. after a partial failure. Requires `confirm:true`
`delete_stale_user_anonymization_task` `[ADMIN]`	Delete a stuck anonymization task lock so a new one can run. Requires `confirm:true`

Groups (writes admin, lookups open)

Tool	What it does
`add_user_to_group` `[ADMIN]`	Add a user to a group. Requires `confirm:true`
`remove_user_from_group` `[ADMIN]`	Remove a user from a group. Requires `confirm:true`
`create_group` `[ADMIN]`	Create a new group
`delete_group` `[ADMIN]`	Delete a group. Requires `confirm:true`
`get_groups_picker`	Find groups matching a query string, typeahead-style
`get_group_user_picker`	Find users and groups matching a query in one call, with highlighting

Permission & notification schemes (6 of the 13 tools require `JIRA_ADMIN_TOKEN`)

A permission scheme is Jira's rulebook for who can view, edit, assign, or administer issues on a project. A notification scheme controls who gets emailed when things happen on a project.

Tool	What it does
`admin_list_permission_schemes`	List all permission schemes on the instance
`admin_get_permission_scheme`	Get a single permission scheme by ID
`admin_create_permission_scheme` `[ADMIN]`	Create a new permission scheme
`admin_update_permission_scheme`	Update a permission scheme's name or description
`admin_delete_permission_scheme` `[ADMIN]`	Permanently delete a permission scheme by ID. Requires `confirm:true`
`admin_get_permission_scheme_grants`	Get all grants of a scheme — which users/groups/roles hold which permissions
`admin_get_permission_scheme_grant`	Get a single permission grant by ID from a scheme
`admin_create_permission_scheme_grant` `[ADMIN]`	Grant a permission in a scheme to a holder (user, group, project role, etc.). Requires `confirm:true`
`admin_delete_permission_scheme_grant` `[ADMIN]`	Delete a permission grant from a scheme. Requires `confirm:true`
`admin_get_permission_scheme_attribute` `[ADMIN]`	Get a permission scheme attribute by key
`admin_set_permission_scheme_attribute` `[ADMIN]`	Update or insert a permission scheme attribute. Requires `confirm:true`
`admin_list_notification_schemes`	List all notification schemes on the instance
`admin_get_notification_scheme`	Get full details of a single notification scheme, including event notifications

Admin access

29 of the 57 tools on this page require JIRA_ADMIN_TOKEN, and each one is marked [ADMIN] in the tables above. If it isn't configured, those tools aren't just blocked — they're never advertised to the agent at all, so it won't try to reach for them. Section by section:

Looking up people — 5 of 20 gated. Plain lookups, searching, assignability and password-policy checks all work with the standard token. The gated five are the instance-wide diagnostics get_duplicated_users_count and get_duplicated_users_list, and the anonymization reads get_user_anonymization_progress, get_user_anonymization_validation and get_user_anonymization_rerun_validation.
User accounts — 7 of 11 gated: create_user, update_user, update_user_password, delete_user, add_user_to_application, remove_user_from_application and delete_user_session. The four column/property tools (set_user_columns, reset_user_columns, set_user_property, delete_user_property) run on the standard token.
User avatars (4) and user anonymization (3) — fully admin-gated, every tool.
Groups — 4 of 6 gated: the writes add_user_to_group, remove_user_from_group, create_group and delete_group. Finding a group by name is not gated: get_groups_picker and get_group_user_picker work with the standard token.
Permission & notification schemes — 6 of 13 gated, and it is the writes that are gated: admin_create_permission_scheme, admin_delete_permission_scheme, admin_create_permission_scheme_grant, admin_delete_permission_scheme_grant, admin_get_permission_scheme_attribute and admin_set_permission_scheme_attribute. Reading a scheme does not need the admin token: admin_list_permission_schemes, admin_get_permission_scheme, admin_update_permission_scheme, admin_get_permission_scheme_grants, admin_get_permission_scheme_grant, admin_list_notification_schemes and admin_get_notification_scheme all run on the standard token. (admin_get_permission_scheme_attribute is the one read in this group that is gated.)

Things to know

Hard-to-undo actions — and actions that widen someone's access — need explicit confirmation. These 19 tools require confirm:true, and the agent should always check with you before setting it. Revoking or destroying (11): delete_user, delete_user_avatar, delete_user_property, delete_user_session, remove_user_from_application, reset_user_columns, delete_stale_user_anonymization_task, delete_group, remove_user_from_group, admin_delete_permission_scheme and admin_delete_permission_scheme_grant. Anonymizing (2): schedule_user_anonymization and schedule_user_anonymization_rerun. Changing credentials (1): update_user_password. Granting access (5) — these are new, and gate the grant side that previously ran unconfirmed while the matching revocation was gated: create_user (a new login-capable account, which takes a licensed seat from the instance's default application access whether or not you name any applications), add_user_to_application (a licensed seat), add_user_to_group (group membership and every permission it carries), admin_create_permission_scheme_grant (a new grant on a scheme) and admin_set_permission_scheme_attribute (a scheme-wide attribute). Separately, update_user needs confirm:true conditionally — only when it carries a licence grant (applicationKeys) or reactivates a disabled account (active:true); an ordinary name or email edit, and active:false to disable an account, need no confirmation. If your agent skips asking you to confirm before one of these runs, don't approve it.
delete_user is irreversible and just as serious as deleting an issue — the account and its identity are gone for good.
Anonymization is as high-impact as deletion. schedule_user_anonymization scrambles a user's username, display name, and email and disables the account — useful for GDPR-style "right to be forgotten" requests where you need to remove personal data without breaking historical issue history. It requires confirm:true, and beyond that it's asynchronous and has no built-in undo, so run get_user_anonymization_validation first and confirm with the requester before scheduling it. Check progress afterward with get_user_anonymization_progress.
Check a password before you set it. check_password_policy_create_user and check_password_policy_update_user let you validate a candidate password against the instance's policy without actually creating an account or changing anyone's credentials.
Duplicate-user tools are diagnostics, not fixes. get_duplicated_users_count and get_duplicated_users_list surface accounts that LDAP/directory sync has duplicated; they don't merge or remove anything themselves.

See docs/api-catalog.md for the complete technical reference (every field, every parameter). For errors, see Troubleshooting.