agentleFS
Sign inStart free
Cap-goCap-go/capgo-skills/skills/capgo-organization-management/SKILL.md

capgo-organization-management

Skill75 starsChanged 33 days agoMITView on GitHub

Guides Capgo account lookup and organization administration with the CLI, including `account whoami`, `organization list/add/members/set/delete`, 2FA enforcement, password policy, API-key expiration and hashed-key policy, and apps per organization. Use when listing or creating Capgo organizations, auditing members' 2FA before enforcing it, tightening org security settings, or resolving "Access Denied: Two-Factor Authentication Required" or "Insufficient permissions". Do not use for OTA bundle or channel work (capgo-release-management), native builds (capgo-native-builds), or app-side updater code (capgo-live-updates).

1 other project uses a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

6 rules. About 0 are common, 1 is distinctive, and 5 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈1

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 5

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Do not use when:

    line 23
  2. Very specific:

    Use organization. The organisation spelling is deprecated and will be removed.

    line 45
  3. Very specific:

    Do not ask users to paste API keys into chat for admin work.

    line 79
  4. Very specific:

    Run organization list again.

    line 83
  5. Very specific:

    Run organization members ORG_ID again after enforcement.

    line 84
  6. Very specific:

    Run a read-only command with a non-admin member's key (for example app list).

    line 85

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Capgo Organization Management

Administer Capgo accounts and organizations safely from the CLI.

Facts below were checked against @capgo/cli 8.77 (October 2026). All commands accept -a, --apikey.

When to Use

TRIGGER when:

  • The user needs their Capgo account ID or email for support (account whoami).
  • The user lists, creates, renames, or deletes organizations.
  • The user audits members or 2FA status, or enforces 2FA, a password policy, API-key expiration, or hashed API keys.
  • The user needs to know which org owns an app (app list --show-org --show-org-id).
  • A command fails with an org-level 2FA or permission error.

Do not use when:

  • The work is bundles, channels, or rollouts. Use capgo-release-management.
  • The user needs native cloud builds. Use capgo-native-builds.
  • The user wants an agent connected to the Capgo account (MCP). Use capgo-cli-usage.

Command Map

GoalCommand (npx @capgo/cli@latest ...)
Who am Iaccount whoami (alias account id)
List orgsorganization list
Create orgorganization add --name "My Company" --email admin@example.com
Members + 2FA statusorganization members ORG_ID (2FA status needs super_admin)
Rename / change emailorganization set ORG_ID --name "New Name" --email ops@example.com
Enforce 2FAorganization set ORG_ID --enforce-2fa (--no-enforce-2fa to undo)
Password policyorganization set ORG_ID --password-policy --min-length 12 --require-uppercase --require-number --require-special
API-key expirationorganization set ORG_ID --require-apikey-expiration --max-apikey-expiration-days 90 (1 to 365)
Hashed API keysorganization set ORG_ID --enforce-hashed-api-keys
Apps per orgapp list --show-org --show-org-id or app list --filter-by-org-id ORG_ID --output-text
Delete orgorganization delete ORG_ID (owner only, irreversible)

Use organization. The organisation spelling is deprecated and will be removed.

Procedure

1. Identify scope and role

npx @capgo/cli@latest account whoami
npx @capgo/cli@latest organization list

Confirm the target ORG_ID. Security settings need the super_admin role. Deleting an org needs the owner.

2. Inspect before enforcing

npx @capgo/cli@latest organization members ORG_ID

List the members without 2FA, then report to the user before enforcing. Enforcing 2FA locks those members out of CLI and API access until they enable it.

3. Change one policy at a time

Apply one organization set change, verify it, then move to the next. Keep at least one admin with working 2FA and a valid key so the org is never locked out.

4. API-key policy side effects

  • --require-apikey-expiration / --max-apikey-expiration-days affects new keys. The keys the hosted MCP creates for OAuth (MCP · <client>) already expire after at most 90 days, and a stricter org limit wins.
  • --enforce-hashed-api-keys means a key is shown only once at creation. Existing CI secrets keep working, but a lost key must be recreated.

Traps

  • organization delete cannot be undone, and only owners can run it. Run app list --filter-by-org-id ORG_ID first so the user sees what lives in that org, then get explicit confirmation with the org name.
  • organization members needs super_admin to show 2FA status. Lower roles see partial data.
  • Do not ask users to paste API keys into chat for admin work. Have them run npx @capgo/cli@latest login, or set CAPGO_TOKEN in their shell.

Verification

  1. Run organization list again. The name and email changes show up.
  2. Run organization members ORG_ID again after enforcement. Every remaining member shows 2FA enabled.
  3. Run a read-only command with a non-admin member's key (for example app list). It should succeed after they enable 2FA.

Error Handling

StringFix
🔐 Access Denied: Two-Factor Authentication Required / This organization requires all members to have 2FA enabled.Enable 2FA at https://console.capgo.app (account settings), then retry. Docs: https://capgo.app/docs/webapp/2fa-enforcement/
Insufficient permissions for <key>The acting user or key lacks the role. Security settings need super_admin, delete needs the owner
No organizations availableThe key's user has no org yet. Create one with organization add
No Capgo API key found. Run ... first, then retry this command.npx @capgo/cli@latest login, set CAPGO_TOKEN, or pass -a

Resources

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free