wyre-technology/cipp-mcp

CIPP MCP Server

MCP (Model Context Protocol) server for CIPP — the CyberDrain Improved Partner Portal. Provides AI assistants with structured access to CIPP's M365 multi-tenant management capabilities.

Features

• 37 tools across 11 categories
• Tenant, user, group, and mailbox management
• Security: Conditional Access policies, named locations
• Standards & compliance: BPA, domain health, drift detection
• License reporting (per-tenant and CSP-wide)
• Alerts, audit logs, and scheduled tasks
• GDAP role and invite management
• Stdio and HTTP transport modes
• MCP Gateway compatible

Prerequisites

• Node.js 18+
• A running CIPP deployment
• CIPP API Key (generated from CIPP Settings → API Client Management)

Installation

Via npm (once published)

npx cipp-mcp

From source

git clone https://github.com/wyre-technology/cipp-mcp
cd cipp-mcp
npm install
npm run build

Configuration

Set these environment variables (or copy .env.example to .env):

| Variable | Required | Description | |---|---|---| | CIPP_BASE_URL | Yes | Your CIPP deployment URL (e.g. https://cipp.yourdomain.com) | | CIPP_API_KEY | One of | Static Bearer token. Use this or the OAuth trio below. | | CIPP_TENANT_ID | One of | Entra tenant ID that owns the CIPP API-client app registration. | | CIPP_CLIENT_ID | One of | OAuth client ID issued by CIPP's API Client Management page. | | CIPP_CLIENT_SECRET | One of | OAuth client secret paired with CIPP_CLIENT_ID. | | CIPP_TOKEN_SCOPE | No | Override OAuth scope (default: <clientId>/.default). | | CIPP_TOKEN_URL | No | Override OAuth token endpoint (sovereign clouds only). | | MCP_TRANSPORT | No | stdio (default) or http | | MCP_HTTP_PORT | No | Port for HTTP mode (default: 8080) | | LOG_LEVEL | No | error, warn, info (default), or debug |

Usage with Claude Desktop

Add to your claude_desktop_config.json:

{
  "m