Work with teammates
Invite people to your organization so they can deploy too — how roles work today, and what belonging to several organizations means.
Your organization is your account. Everything you make belongs to it, and anyone you invite works on the same things you do, from their own agent.
Ask for it
invite sam@company.com to my agenthost account
Sam gets no password and no key. They point their own MCP client at agenthost, sign in with that email address, and land in your organization. If Sam already uses agenthost for something else, they keep their own account and gain yours alongside it — the next time they sign in, they're asked which one the connection is for.
Roles
Everyone has a role: owner, admin or member. Ask for one explicitly if it matters:
invite sam@company.com as an admin
| Role | Today |
|---|---|
owner | Everything, including inviting people |
admin | Everything, including inviting people |
member | Everything except inviting people |
Roles are barely a boundary right now
Only inviting users is role-gated. A member can create, deploy, and delete any app or project
in the organization. Treat an invitation as full trust, and use
app-level invitations for anyone who should merely see something.
Seeing who's in
who has access to my agenthost account?
You get everyone and the role they hold here. People who also work for other organizations keep that private — you only see their role on yours.
Belonging to more than one
This is the normal case for an agency or a freelancer: your own organization, plus one per client.
- A connection belongs to one organization. Your agent acts inside it and can't see the others.
- To work on a different one, connect your MCP client again and pick that organization when signing in. There's no tool that switches mid-conversation.
whoamilists the other organizations the same person belongs to, so your agent can tell you which one it's currently in — worth asking before a destructive request.
which agenthost organization am I connected to right now?
Removing someone
There is no tool for removing a person from an organization yet. If you need someone taken off, contact us — and in the meantime, revoke anything they hold: API tokens they minted can be revoked by id, and app invitations can be revoked individually.
Under the hood
Access is a membership: a row joining one person to one organization with one role. Every authenticated request re-checks it, so a change takes effect immediately rather than at the next sign-in. Every credential agenthost issues — OAuth grant, API token, browser session — is bound to exactly one organization, and every tool call is scoped to it.
Tools: invite_user, list_users, whoami.