---
title: "Workspace and people"
description: "Who is asking, what they may do, and who else is here."
url: "https://openemail.uk/docs/mcp/tools/workspace"
area: "MCP server"
category: "Tools"
---

# Workspace and people

Who is asking, what they may do, and who else is here.

## Workspace and people tools

| Tool | What it does |
| --- | --- |
| whoAmI | What you may do in the mailbox that is currently active: the role you hold, whether you own the workspace, and every permission that role grants. |
| listRoles | The roles this workspace defines and what each one grants, with how many people and API keys hold each, the fact that says whether changing one is safe. |
| listWorkspaceMembers | Who is in the workspace, the role each of them holds, and which addresses they were given. |

> Read `whoAmI` before telling somebody a thing cannot be done. A tool you lack the permission for is not in your tool list AT ALL, so an absent tool is far more often a permission you do not hold than a feature this server is missing. It answers for the ACTIVE connection, so the answer changes after `setActiveConnection`.

> `whoAmI` needs no permission; the other two sit behind `roles:read` and `members:read`. The split is the same one drawn everywhere else here. Describing yourself is not a statement about anybody else, and the two that name colleagues are gated like every other statement about somebody else.

> A ROLE and an ADDRESS GRANT are two different things, and `listWorkspaceMembers` reports both per person because neither answers for the other. The role is what somebody may do, the addresses are what they may do it to, and a person can hold a role with no addresses (they open an empty mailbox) or an address with no role row at all, which is an older grant that implies a role rather than one anybody chose. The workspace owner is not listed: they are the account the workspace belongs to and hold everything.

> Nothing here writes. There is no createRole, no setMemberRole and no grantAddress, for the same reason there is no deleteRule: widening a role or handing out an address from inside a chat window is a quiet, wide change that nobody sees afterwards. All of it is in Settings → Roles and on `/roles`, where whoever is doing it can see the whole matrix they are changing.