Platform Settings

Platform settings control the global behavior of MCP Hub. These settings are managed by platform administrators and affect all users, organizations, and services across the platform.

Platform Administrator Configuration

Platform administrators are designated via the ADMIN_USERS environment variable in the .env file:

ADMIN_USERS=[email protected],[email protected],[email protected]

This is a comma-separated list of email addresses. When a user logs in with one of these emails, they are automatically granted the PLATFORM_ADMIN role. Changes to this variable take effect on the next login of each affected user.

Important Notes

• The platform_role field is set in the database when the user authenticates. If an email is removed from ADMIN_USERS, the user loses admin access on their next login.
• For immediate revocation without waiting for the next login, update the database directly: UPDATE users SET platform_role = NULL WHERE email = '[email protected]'.
• The platform role is orthogonal to organization roles – a platform admin can also be an organization Member or Viewer.

Future Roles

The platform role system is designed to support additional roles beyond PLATFORM_ADMIN:

Global Configuration

MCP Hub is configured entirely through environment variables. The following categories control platform-wide behavior:

Server Configuration

Database Configuration

Cache and Rate Limiting

Redis is used for session storage, access tokens, and rate limiting counters. Rate limits are enforced per plan:

Storage Configuration

Two S3 buckets are used: one for MCP source code tarballs and one for analysis results and generated reports. The minio-init container in development creates these buckets automatically.

Authentication

Worker and AMQP

Registry Integration

Admin Dashboard

The admin dashboard at /admin provides a high-level overview of platform health and activity.

Statistics Cards

• Total Users: Total registered users and active count.
• Organizations: Total organizations and active count.
• Total MCPs: Registered MCPs with public/private breakdown.
• Activity (Last 24h): Recent platform events with 7-day and 30-day trends.

User Distribution

A visual breakdown showing the percentage of users on each plan (Free, PRO, Enterprise), useful for understanding revenue distribution and conversion rates.

Quick Actions

Direct navigation links to:

• Manage Users: /admin/users
• Manage Organizations: /admin/orgs
• Audit Logs: /admin/audit

Organization Management

Platform administrators can manage all organizations from /admin/orgs:

• View all organizations: List with name, slug, plan, status, member count, and creation date.
• Organization details: View members, activity, areas, and configuration.
• Change organization plan: Upgrade or downgrade between Free, PRO, and Enterprise.
• Suspend organization: Temporarily disable access for all members (requires a reason).
• Activate organization: Restore access after suspension.
• Delete organization: Soft-delete the organization (data preserved for compliance).

Global Audit Log

The platform audit log at /admin/audit records all administrative actions across the platform:

GET /api/v1/admin/audit

Supports filtering by:

• Action type: user.suspend, org.create, mcp.delete, etc.
• Date range: Events within a specific time period.
• Pagination: Page and limit parameters.

Action Categories

User actions: user.create, user.update, user.suspend, user.activate, user.delete, user.plan_update, user.role_change, user.bulk_suspend, user.bulk_activate

Organization actions: org.create, org.update, org.suspend, org.activate, org.delete, org.plan_update

MCP actions: mcp.create, mcp.update_metadata, mcp.delete, mcp.assign_tags, mcp.featured

Category/Tag actions: category.create, category.update, category.delete, tag.create, tag.update, tag.delete

Each audit event includes the administrator who performed the action, the affected resource, a timestamp, and metadata with action-specific details.

Health Monitoring

Health Check Endpoints

MCP Hub exposes health check endpoints for monitoring and orchestration:

Service Ports

In a full deployment, three services run simultaneously:

All three services must be running for the complete certification pipeline to function. The web service handles user-facing requests, the scheduler detects new commits, and the worker processes analysis jobs.

Infrastructure Services

The LavinMQ management UI at port 15672 provides visibility into message queues, job distribution, and dead letter queues.

Security Best Practices

1. Limit platform administrators: Keep the ADMIN_USERS list as short as possible.
2. Rotate secrets: Periodically rotate AUTH0_CLIENT_SECRET, REGISTRY_SERVICE_TOKEN, S3 credentials, and the session secret.
3. Monitor audit logs: Review the admin audit log regularly for unexpected actions.
4. Use separate environments: Keep development and production configurations strictly separated, especially Auth0 and Stripe credentials.
5. Never log secrets: The platform is designed to never log secret values. Verify this behavior when adding custom logging.
6. Secure the .env file: Ensure the environment file has restricted permissions and is never committed to version control.