Admin work is the part of infrastructure engineering nobody talks about loving. Provisioning the same database connection for the 200th time. Sifting through audit logs to answer one specific question that nobody built a dashboard for. Clicking through approval queues in a console you opened just for that. It’s the work that pulls you out of flow and into the ticket queue.
The pitch for AI agents was that you’d get some of that time back. For read-only questions, it’s mostly working. Ask the model a question about your data, get an answer. The minute the work requires writes or systematic action on infrastructure, you’re back to clicking buttons by hand.
Two places this gap is most expensive right now:
Reporting and analytics on data your tools already collect. Audit logs and session history pile up by the gigabyte. The only way to slice them is whatever dashboard the vendor decided to build. Want to know which queries your team runs every Tuesday morning but never on weekends? Want a weekly summary of the dangerous commands your engineers tried to run last week, grouped by user? Build a custom analytics application. Or wait six months for the feature request.
Bulk operations on resources. You have 5,000 databases to provision, or 200 guardrail rules to deploy across environments. You could write a script. You could build a CLI. Or you could keep doing it one console click at a time. Either way, the time cost falls on the engineer who already had something else to do.
Two reasons this gap stays open:
- Raw admin API tokens route the agent around your governance layer. Reads are fine. Writes don’t land in the same audit log as your humans’. Approval workflows skip the agent entirely. Role boundaries get enforced at the API gateway, not the policy engine.
- Human-in-the-loop on every write slows incident response back to ticket speed and stalls the AI productivity story you sold leadership.
Neither is the deal you signed up for.
Today we’re shipping the Hoop MCP admin server, an embedded Model Context Protocol implementation inside the Hoop gateway that closes both gaps.
What does MCP actually solve, and what doesn’t it solve?
Model Context Protocol gives agents a clean, standardized way to call tools. Claude Code, Cursor, and any MCP-compatible client can discover an MCP server, see what it can do, and call into it without bespoke integration work per platform.
What MCP does not do, on its own, is solve the governance problem. The protocol is a transport and a tool-description format. Auth, audit, and approval still live wherever you put them. Most agent admin integrations today put them nowhere.
How Hoop closes it
The MCP server runs at the policy engine, not at the API gateway. Same audit log, same approval gates, same role boundaries. Different transport, identical governance.
Hoop is the open-source access gateway between engineers, AI agents, and infrastructure. We embedded an MCP server inside the gateway itself, mounted at /api/mcp. That one design choice does the work:
- The agent connects with a bearer token tied to a Hoop user identity.
- Every call passes through the same Gin middleware that protects every other Hoop API route.
- AuditMiddleware records the call alongside human admin activity in the same log.
- RBAC, ABAC, and access request rules apply automatically. If your policy says engineers cannot delete production connections without approval, the agent inherits that policy the moment it picks up the token.
No parallel agent path. Agents run on the same rails your humans do, with the same boundaries enforced at the policy engine, not the API gateway.
Traditional REST API token vs Hoop MCP server
Traditional REST API token: