{
  "markdown": "# CIPP MCP Server\n\nMCP (Model Context Protocol) server for [CIPP](https://github.com/KelvinTegelaar/CIPP) — the CyberDrain Improved Partner Portal. Provides AI assistants with structured access to CIPP's M365 multi-tenant management capabilities.\n\n## Features\n\n- **37 tools** across 11 categories\n- Tenant, user, group, and mailbox management\n- Security: Conditional Access policies, named locations\n- Standards & compliance: BPA, domain health, drift detection\n- License reporting (per-tenant and CSP-wide)\n- Alerts, audit logs, and scheduled tasks\n- GDAP role and invite management\n- Stdio and HTTP transport modes\n- MCP Gateway compatible\n\n## Prerequisites\n\n- Node.js 18+\n- A running CIPP deployment\n- CIPP API Key (generated from CIPP Settings → API Client Management)\n\n## Installation\n\n### Via npm (once published)\n\n```sh\nnpx cipp-mcp\n```\n\n### From source\n\n```sh\ngit clone https://github.com/WYRE-AI/cipp-mcp\ncd cipp-mcp\nnpm install\nnpm run build\n```\n\n## Configuration\n\nSet these environment variables (or copy `.env.example` to `.env`):\n\n| Variable | Required | Description |\n|---|---|---|\n| `CIPP_BASE_URL` | Yes | Your CIPP **Azure Function App** URL (e.g. `https://cippXXXXX.azurewebsites.net`). **Do not use the SWA / frontend URL** — see [Finding your Function App URL](#finding-your-function-app-url). |\n| `CIPP_API_KEY` | One of | Static Bearer token. Use this **or** the OAuth trio below. |\n| `CIPP_TENANT_ID` | One of | Entra tenant ID that owns the CIPP API-client app registration. |\n| `CIPP_CLIENT_ID` | One of | OAuth client ID issued by CIPP's API Client Management page. |\n| `CIPP_CLIENT_SECRET` | One of | OAuth client secret paired with `CIPP_CLIENT_ID`. |\n| `CIPP_TOKEN_SCOPE` | No | Override OAuth scope (default: `<clientId>/.default`). |\n| `CIPP_TOKEN_URL` | No | Override OAuth token endpoint (sovereign clouds only). |\n| `MCP_TRANSPORT` | No | `stdio` (default) or `http` |\n| `MCP_HTTP_PORT` | No | Port for HTTP mode (default: 8080) |\n| `LOG_LEVEL` | No | `error`, `warn`, `info` (default), or `debug` |\n\n> [!IMPORTANT]\n> `CIPP_BASE_URL` must be the **Azure Function App** URL — the CIPP-API backend,\n> `https://<function-app-name>.azurewebsites.net` — **not** the Static Web App /\n> custom-domain UI URL (e.g. `https://cipp.yourdomain.com`). The SWA's built-in\n> auth intercepts bearer tokens and redirects them to its interactive login page,\n> so every API call fails. Find the Function App (named like `cippXXXXX`) in your\n> CIPP resource group in the Azure Portal.\n\n## Usage with Claude Desktop\n\nAdd to your `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"cipp\": {\n      \"command\": \"node\",\n      \"args\": [\"/path/to/cipp-mcp/dist/entry.js\"],\n      \"env\": {\n        \"CIPP_BASE_URL\": \"https://cippXXXXX.azurewebsites.net\",\n        \"CIPP_TENANT_ID\": \"your-entra-tenant-id\",\n        \"CIPP_CLIENT_ID\": \"your-client-id\",\n        \"CIPP_CLIENT_SECRET\": \"your-client-secret\"\n      }\n    }\n  }\n}\n```\n\n> **Note:** `CIPP_BASE_URL` must be the Azure **Function App** URL (`.azurewebsites.net`), not\n> the frontend SWA URL (`.azurestaticapps.net` or your custom domain). The SWA enforces\n> browser-based auth and will redirect all API requests to a Microsoft login page.\n\n## Tools\n\n| Category | Tools |\n|---|---|\n| Tenants | list_tenants, get_tenant_details |\n| Users | list_users, create_user, edit_user, disable_user, reset_password, reset_mfa, revoke_sessions, offboard_user, bec_check, list_mfa_users, list_user_devices, list_user_groups |\n| Groups | list_groups, create_group |\n| Mailboxes | list_mailboxes, list_mailbox_permissions, set_out_of_office, set_email_forwarding |\n| Security | list_conditional_access_policies, list_named_locations |\n| Standards | list_standards, run_standards_check, list_bpa, list_domain_health |\n| Licenses | list_licenses, list_csp_licenses |\n| Alerts | list_audit_logs, list_alert_queue |\n| GDAP | list_gdap_roles, list_gdap_invites |\n| Scheduler | list_scheduled_items, add_scheduled_item |\n| Core | ping, get_version, list_logs |\n\n### CIPP version compatibility\n\nRequest bodies are shaped against CIPP's own `Invoke-*.ps1` handlers and are\nwritten to satisfy both current and older CIPP builds — where the two differ,\nthe server sends the form both accept. Three behaviours are worth knowing:\n\n- **`offboard_user` reports queued, not completed.** CIPP's `ExecOffboardUser`\n  returns HTTP 200 the instant the job is created; it never waits for or reports\n  the offboarding result. Confirm the outcome in CIPP's Offboarding view before\n  treating an account as offboarded. The tool refuses a call with no actions\n  selected, since that would otherwise queue a job that succeeds while doing\n  nothing.\n- **Some endpoints report failure under HTTP 200.** `EditUser`,\n  `AddScheduledItem` and `ExecOffboardUser` return error text in `Results`\n  rather than an error status. These tools parse `Results` and return\n  `status: \"failed\"`; do not treat a 200 as success.\n- **Two parameters need a recent CIPP.** `offboard_user`'s\n  `DisableOneDriveSharing` and `set_out_of_office`'s `timezone` are ignored by\n  older builds rather than erroring — so an offboarding that selects *only*\n  `DisableOneDriveSharing` will run no actions on an older CIPP.\n\n## Authentication Setup\n\nCIPP's API Client Management page provisions an Entra ID app registration and\nreturns an OAuth **client ID + client secret** (not a long-lived Bearer token).\nThe server exchanges these for a short-lived access token on each request using\nthe OAuth 2.0 client-credentials flow, and caches the token until just before\nits expiry.\n\n1. In CIPP, go to **Settings → CIPP Settings → Integrations → CIPP-API**\n2. Create a new API client\n3. Copy the **Client ID** and **Client Secret** — you will not be able to\n   retrieve the secret later\n4. Configure the server with the **Function App URL** (see below):\n   ```env\n   CIPP_BASE_URL=https://cippXXXXX.azurewebsites.net\n   CIPP_TENANT_ID=<your-entra-tenant-id>\n   CIPP_CLIENT_ID=<client-id-from-cipp>\n   CIPP_CLIENT_SECRET=<client-secret-from-cipp>\n   ```\n\nIf you already have a static Bearer token (older CIPP deployments), set\n`CIPP_API_KEY` instead and leave the OAuth variables unset. When both are\nprovided, `CIPP_API_KEY` wins.\n\n## Finding your Function App URL\n\nCIPP runs as an Azure Static Web App (SWA) backed by an Azure Function App.\nThe SWA URL (your custom domain or `*.azurestaticapps.net`) enforces browser-only\nauth and **cannot be used as `CIPP_BASE_URL`**. Use the Function App URL instead.\n\n**Self-hosted CIPP:** Find the Function App in the Azure portal (look for an App Service\nwith `Kind: functionapp` in the same resource group as your SWA), or run:\n```sh\naz staticwebapp show --name <your-swa-name> --resource-group <rg> \\\n  --query \"linkedBackends[0].backendResourceId\" -o tsv\n```\n\n**CIPP-sponsored hosting:** Contact the CIPP team for your instance's Function App URL —\nit is not the same as the URL shown in your browser.\n\n## IP Allowlist\n\nCIPP validates each API client against an `IPRange` field stored in Azure Table Storage.\nIf your server's public IP is not in this list, you will receive:\n\n> `Access to this CIPP API endpoint is not allowed, the API Client does not have the required permission`\n\n**Self-hosted:** Add your IP via the CIPP UI (Settings → API Client Management) or\ndirectly in the `ApiClients` table of your CIPP storage account.\n\n**CIPP-sponsored hosting:** Ask the CIPP team to add your server's public IP to your\nAPI client's allowed range.\n\n## License\n\nApache-2.0 — see [LICENSE](LICENSE)\n\n## Contributing\n\nIssues and PRs welcome. This server is tracked against [wyre-technology/msp-claude-plugins#24](https://github.com/wyre-technology/msp-claude-plugins/issues/24).\n",
  "bytes": 7704,
  "sha": "2f8ce3483477c36d42723219c7314b41d04b285675f11432ff8a1a1cd0bbe85a",
  "repo_slug": "wyre-technology/cipp-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_wyre_technology_cipp_mcp_59a338b0/readme"
}