MCP for Login as User is a Pro add-on for MCP for J that lets your AI client work with Web357's Login as User: check its health, read its per-group permission rules in a form you can actually follow, test whether a user can be signed in as, and create the one-time front-end link that shows you the site exactly as that customer sees it. Login as User is a separate purchase from Web357, and every tool here refuses without it. This add-on is deliberately stricter than Login as User's own defaults. Creating links is off until you switch it on, every link needs a stated reason that is logged before the link exists, and Super Users can't be targets unless you choose to allow it.
Why this exists
On a membership site, a shop or a community site, a lot of support starts with "I can't see it". The customer's menu is missing an item, a download won't open, their account page looks wrong. The quickest way to understand it is to look at the site as them, and Login as User does that without anyone handing over a password. This add-on lets your AI client take part in that job. It can tell you whether a user can be signed in as and why not, create the link once you've said what you're checking, and later tell you who signed in as whom and the reason they gave. It also decodes Login as User's per-group rules, which are hard to read in its options screen, into a plain list of who may sign in as which groups.
What Claude can do
Seven tools. Every one of them is restricted to Super Users.
| Area | Tools | What you can do |
|---|---|---|
| Diagnostics | 1 | A health check to run first. It reports the version and edition, whether the pieces Login as User depends on are switched on, whether its own rules let Super Users be impersonated, whether the admin email is off, and the state of this add-on's three options. |
| Settings | 2 | Read Login as User's settings with the per-group rules decoded, and change them. The change runs Login as User's own post-save permission sync and is written to the User Actions Log. |
| Links | 3 | A dry run that tells you whether a link for a given user would work and, if not, every reason why. Create a one-time link with a stated reason. Revoke pending links. |
| Activity | 1 | Who signed in as whom, when, and the reason given, read from Joomla's User Actions Log. A link that was created but never used shows up as exactly that. |
Stricter than Login as User itself, on purpose
Out of the box, Login as User lets a Super User sign in as another Super User. For a button a person clicks in the administrator, that's a reasonable default. Over MCP, the request can come from an AI agent, and an agent can be steered by text it reads on your site. So this add-on sets tighter defaults than Web357 does, and only a person can loosen them.
- Creating links is off until a person turns it on. The option is Allow Login as User links over MCP in the add-on's plugin settings. Installing or updating the add-on never switches it on. Until it's on, the read-only tools work and link creation refuses.
- Administrator users are refused unless you allow them. Anyone who can log into the administrator โ Managers, Administrators and similar โ is refused as a target unless Allow backend users as targets is on, because their front-end session carries their permissions.
- Super Users are refused by default, whatever Login as User's own rules say. From version 1.0.1 there's a third option, Allow Super User targets. It's off by default and its description carries a warning. It's nested under Allow backend users as targets, so it only appears, and only takes effect, once that one is on as well. Both live in the add-on's plugin options (System โ Plugins โ System - MCP for Joomla: Login as User add-on). Even with both on, Login as User's own rules still have to allow the target. This add-on will make a Super User group non-impersonable in Login as User's settings, but never the other way round, so that part stays a human decision in Login as User's own options.
The reason the Super User option is a separate, loud switch is simple. A link for a Super User is full control of the site. For as long as it's valid, whoever opens it is that administrator on the front end โ and if Global Configuration "Shared Sessions" is on, in the administrator as well. Once you turn the option on, anyone or any AI with MCP access to this tool could use it to take over an administrator account, and whatever they do is recorded as that administrator.
By turning it on, you accept that risk for every MCP token and AI client connected to your site, not only the one you're using right now. If you need it for a particular job, turn it on, do the job, and turn it off again when you're done. While it's in effect, the health check raises a warning about it, every Super User link is logged with its own "for SUPER USER" wording, and the tool's response carries a warning of its own.
One honest limit on all three options. They're a deliberate-intent switch, not a wall against a Super User: a Super User's MCP token can change plugin options through MCP for J's own set_plugin_params tool, the same way that user could install code. The real protection is the audit trail, so keep an eye on the User Actions Log.
What happens to every link
- It needs a stated reason. What you're checking for this user, at least ten characters. "Customer reports the Members menu is missing โ ticket 4512" is the sort of thing it wants.
- The reason is logged before the link exists. The User Actions Log entry โ who asked, for whom, why, and when it expires โ is written first. If that write fails, no link is created. The tools also refuse outright if Joomla's action logging is unavailable.
- It's Login as User's own link. No token or login path is invented here. The link is created through Login as User's own mechanism after its own permission checks, so it works once and expires after five minutes. When it's opened, Login as User checks permissions again, writes its own log entry, and emails the admin if its "Inform Admin via Email" option is on. That email setting can't be changed over MCP โ the channel that creates the links shouldn't be able to switch off the alert.
- It can be cancelled.
revoke_loginasuser_linksdeletes pending links, including ones made with the admin button. Joomla's Clear Cache also cancels every pending link, because Login as User keeps them underadministrator/cache. Worth knowing if a link you just made stops working.
The link itself does appear in your AI client's conversation, since that's how it reaches you. That's one more reason the five-minute expiry and single use matter, and why you shouldn't paste a link anywhere shared.
Installing it
You'll need Joomla 5 or 6, PHP 8.2 or later, MCP for J, and Login as User 3.7 or later, which you buy from Web357. Web357 currently sells it as a premium-only product. Older free installs still exist, and since nothing in Login as User changes behaviour by edition, the tools work on any 3.7 build.
- Subscribe on the sign-up page, or get this and every other Pro add-on with MCP for J Pro โ All Access.
- Download the ZIP and install it through System โ Install โ Extensions, or paste your download URL into Install from URL.
- The plugin enables itself, and the health, settings, dry-run and activity tools show up in your connected AI client the next time it lists them. Link creation stays off until you turn it on in System โ Plugins โ System - MCP for Joomla: Login as User add-on.
There's no admin screen beyond those plugin options. The add-on adds tools to MCP for J rather than a place to click.
Using it
Run the health check first. It's read-only and it will tell you about anything that would make a link fail. Two of those catch people out. If Global Configuration "Track Session Metadata" is off, Login as User refuses every login, and the link is used up anyway, so the tools refuse to create one in that state. And the tools won't run while Login as User's own system plugin is disabled, because that plugin is what consumes a link, and without it Login as User's permission check stops reading your per-group rules.
After that, ask in plain language. "Can I sign in as
Version 1.0.0 was tested end to end against Login as User 3.7.6 on Joomla 6.2.0 and PHP 8.3. A real link was opened and signed in as the chosen test user. A second use of the same link didn't sign anyone in, and neither did a revoked one. Manager and Super User targets were refused.
Open source
GPL-2.0-or-later, the same license as Joomla itself. The full source is in the ZIP you download.
Add comment