CIPP MCP server

CIPP MCP Server

MCP (Model Context Protocol) server for CIPP — the CyberDrain Improved Partner Portal. Provides AI assistants with structured access to CIPP's M365 multi-tenant management capabilities.

Features

• 45 tools across 12 categories
• Tenant, user, group, and mailbox management
• Mailbox and online-archive size reporting, per tenant or per user
• Security: Conditional Access policies, named locations
• Standards & compliance: BPA, domain health, drift detection
• License reporting (per-tenant and CSP-wide)
• Alerts, audit logs, and scheduled tasks
• GDAP role and invite management
• Stdio and HTTP transport modes
• MCP Gateway compatible

Prerequisites

• Node.js 18+
• A running CIPP deployment
• CIPP API Key (generated from CIPP Settings → API Client Management)

Installation

Via npm (once published)

npx cipp-mcp

From source

git clone https://github.com/WYRE-AI/cipp-mcp
cd cipp-mcp
npm install
npm run build

Configuration

Set these environment variables (or copy .env.example to .env):

[!IMPORTANT]

CIPPBASEURL must be the Azure Function App URL — the CIPP-API backend,

https://.azurewebsites.net — not the Static Web App /

custom-domain UI URL (e.g. https://cipp.yourdomain.com). The SWA's built-in

auth intercepts bearer tokens and redirects them to its interactive login page,

so every API call fails. Find the Function App (named like cippXXXXX) in your

CIPP resource group in the Azure Portal.

Usage with Claude Desktop

Add to your claudedesktopconfig.json:

{
  "mcpServers": {
    "cipp": {
      "command": "node",
      "args": ["/path/to/cipp-mcp/dist/entry.js"],
      "env": {
        "CIPP_BASE_URL": "https://cippXXXXX.azurewebsites.net",
        "CIPP_TENANT_ID": "your-entra-tenant-id",
        "CIPP_CLIENT_ID": "your-client-id",
        "CIPP_CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

Note: CIPPBASEURL must be the Azure Function App URL (.azurewebsites.net), not

the frontend SWA URL (.azurestaticapps.net or your custom domain). The SWA enforces

browser-based auth and will redirect all API requests to a Microsoft login page.

Tools

Shortened. The full README is on GitHub.