MCP server for CIPP (CyberDrain Improved Partner Portal) — M365 multi-tenant management, users, security, and standards for MSPs
概览
MCP (Model Context Protocol) server for CIPP — the CyberDrain Improved Partner Portal. Provides AI assistants with structured access to CIPP's M365 multi-tenant management capabilities. - across 12 categories - Tenant, user, group, and mailbox management - Mailbox and online-archive size reporting, per tenant or per user - Per-user Entra ID sign-in logs (status, location, Conditional Access, MFA) - Security: Conditional Access policies, named locations, Microsoft Secure Score - Standards & compliance: BPA, domain health, drift detection - License reporting (per-tenant and CSP-wide) - Alerts, audit logs, and scheduled tasks - GDAP role and invite management - Stdio and HTTP transport modes - MCP Gateway compatible - Node.js 18+ - A running CIPP deployment - CIPP API Key (generated from CIPP Settings → API Client Management) Set these environment variables (or copy .env.example to .env): CIPP_BASE_URL must be the URL — the CIPP-API backend, https:// .azurewebsites.
README
以下为原文 README 节选，完整内容请查看原文。
CIPP MCP Server
MCP (Model Context Protocol) server for CIPP — the CyberDrain Improved Partner Portal. Provides AI assistants with structured access to CIPP’s M365 multi-tenant management capabilities.
Features
- 49 tools across 12 categories
- Tenant, user, group, and mailbox management
- Mailbox and online-archive size reporting, per tenant or per user
- Per-user Entra ID sign-in logs (status, location, Conditional Access, MFA)
- Security: Conditional Access policies, named locations, Microsoft Secure Score
- Standards & compliance: BPA, domain health, drift detection
- License reporting (per-tenant and CSP-wide)
- Alerts, audit logs, and scheduled tasks
- GDAP role and invite management
- Stdio and HTTP transport modes
- MCP Gateway compatible
Prerequisites
- Node.js 18+
- A running CIPP deployment
- CIPP API Key (generated from CIPP Settings → API Client Management)
Installation
Via npm (once published)
npx cipp-mcp
From source
git clone https://github.com/WYRE-AI/cipp-mcp
cd cipp-mcp
npm install
npm run build
Configuration
Set these environment variables (or copy .env.example to .env):
| Variable | Required | Description |
|---|---|---|
CIPP_BASE_URL |
Yes | Your CIPP Azure Function App URL (e.g. https://cippXXXXX.azurewebsites.net). Do not use the SWA / frontend URL — see Finding your Function App URL. |
CIPP_API_KEY |
One of | Static Bearer token. Use this or the OAuth trio below. |
CIPP_TENANT_ID |
One of | Entra tenant ID that owns the CIPP API-client app registration. |
CIPP_CLIENT_ID |
One of | OAuth client ID issued by CIPP’s API Client Management page. |
CIPP_CLIENT_SECRET |
One of | OAuth client secret paired with CIPP_CLIENT_ID. |
CIPP_TOKEN_SCOPE |
No | Override OAuth scope. Default: api:///.default. An explicit value disables the legacy-scope fallback below. |
CIPP_TOKEN_SCOPE_FALLBACK |
No | When no explicit scope is set, retry a CIPP HTTP 401 once with the legacy /.default scope and reuse whichever audience this client accepts. Default: true. TOKEN_SCOPE_FALLBACK is an alias. Gateway requests can send x-token-scope-fallback. |
CIPP_TOKEN_URL |
No | Override OAuth token endpoint (sovereign clouds only). |
MCP_TRANSPORT |
No | stdio (default) or http |
AUTH_MODE |
No | env (stdio and single-tenant HTTP) or gateway. Gateway mode requires CIPP credential headers on each /mcp request and does not fall back to CIPP_*. The container image and the Compose gateway service set gateway. |
安装
npx cipp-mcp配置
{
"mcpServers": {
"cipp": {
"command": "node",
"args": ["/path/to/cipp-mcp/dist/entry.js"],
"env": {
"CIPP_BASE_URL": "https://cippXXXXX.azurewebsites.net",
"CIPP_TENANT_ID": "your-entra-tenant-id",
"CIPP_CLIENT_ID": "your-client-id",
"CIPP_CLIENT_SECRET": "your-client-secret"
}
}
}
}