# io.github.WYRE-AI/cipp-mcp MCP server for CIPP — M365 multi-tenant management for MSPs (users, tenants, policies). - **Type:** MCP server - **Trust:** 60/100 (B), scored on the content rubric - **Verification:** community-indexed — nobody has claimed this listing - **Version:** 1.8.1 - **Author:** io.github.WYRE-AI - **License:** Unknown - **Source:** https://github.com/WYRE-AI/cipp-mcp ## Trust 60/100 (B), scored on the content rubric - Publisher verified: no - Install scripts: nothing suspicious found - Prompt-injection scan: clean - Obfuscation scan: clean - Evidence age: 1 day ## Security scan - **Status:** clean - **Scanned:** 2026-09-19T17:58:56.258Z - **Version scanned:** HEAD - **CVEs:** no coverage — this entry has no package coordinates to query OSV against, so "no known CVEs" is NOT asserted for it. ## Tools 40 declared. Statically extracted from the shipped source — a floor on the surface, not a census. - `cipp_list_tenants` — List all tenants managed in CIPP - `cipp_get_tenant_details` — Get detailed information about a specific tenant - `cipp_list_users` — List users in a tenant - `cipp_create_user` — ⚠ HIGH-IMPACT. Creates a new user account in the tenant, which grants - `cipp_edit_user` — ⚠ HIGH-IMPACT. Edits an existing user's properties, which can include - `cipp_disable_user` — ⚠ HIGH-IMPACT. Disables a user account, blocking sign-in. Reversible by - `cipp_reset_password` — ⚠ HIGH-IMPACT. Resets a user's password, invalidating their current - `cipp_reset_mfa` — ⚠ HIGH-IMPACT. Resets all MFA methods for a user, requiring them to - `cipp_revoke_sessions` — ⚠ HIGH-IMPACT. Revokes all active sessions for a user, forcing them to - `cipp_offboard_user` — ⚠ DESTRUCTIVE — IRREVERSIBLE. Queues CIPP's offboarding job for a user. - `cipp_bec_check` — Run a Business Email Compromise check on a user - `cipp_list_mfa_users` — List users and their MFA status in a tenant - `cipp_list_user_devices` — List devices enrolled by a user - `cipp_list_user_groups` — List groups a user is a member of - `cipp_list_groups` — List groups in a tenant - `cipp_create_group` — ⚠ HIGH-IMPACT. Creates a new group in the tenant, which can be used for - `cipp_list_mailboxes` — List mailboxes in a tenant - `cipp_list_mailbox_permissions` — List permissions on a specific mailbox - `cipp_list_mailbox_usage` — Report mailbox and online-archive sizes across a tenant, largest first, with - `cipp_get_mailbox_usage` — Report the primary mailbox size and online-archive size for a single mailbox, with - `cipp_set_out_of_office` — ⚠ HIGH-IMPACT. Configures the out-of-office / auto-reply for a mailbox, - `cipp_set_email_forwarding` — ⚠ HIGH-IMPACT. Configures email forwarding on a mailbox, silently - `cipp_list_conditional_access_policies` — List Conditional Access policies for a tenant - `cipp_list_named_locations` — List named locations (trusted IPs) for a tenant - `cipp_list_enterprise_apps` - `cipp_list_standards` — List compliance standards configured for a tenant - `cipp_run_standards_check` — Trigger a standards compliance check for a tenant - `cipp_list_standard_templates` — List the CIPP Standards Templates configured across the partner tenant. - `cipp_get_tenant_drift` — Report standards drift — settings that deviate from a tenant's assigned - `cipp_get_tenant_alignment` — Report each tenant's alignment percentage against its assigned Standards - `cipp_create_standard_template` — ⚠ HIGH-IMPACT. Creates or updates a CIPP Standards Template (upsert by - `cipp_delete_standard_template` — ⚠ HIGH-IMPACT. Permanently deletes a CIPP Standards Template by ID. - `cipp_list_bpa` — Get Best Practice Analyser results for a tenant - `cipp_list_domain_health` — Check domain health (DMARC, DKIM, SPF) for a tenant - `cipp_list_licenses` — List license assignments and usage for a tenant - `cipp_list_csp_licenses` — List all CSP licenses across tenants - `cipp_list_audit_logs` — List audit log entries for a tenant - `cipp_list_alert_queue` — List queued alerts across all tenants - `cipp_list_gdap_roles` — List available GDAP (Granular Delegated Admin Privileges) roles - `cipp_list_gdap_invites` — List pending GDAP relationship invites ## Install This entry has no npm package and no hosted endpoint, so there is nothing for an MCP client to launch or connect to. It is indexed as source only. ## Blast radius Extensive to critical — no package coordinates and no declared endpoint — Forge cannot tell where this would run or whose authority it would borrow. Known so far: deletes data; holds an oauth grant. - Floor 48, ceiling 60 (tier: unknown) - `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low. - This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score. ## Machine-readable views of this entry - Signed JSON: https://forgeregistry.com/api/v1/packages/io.github.WYRE-AI%2Fcipp-mcp - Install plan: https://forgeregistry.com/api/v1/packages/io.github.WYRE-AI%2Fcipp-mcp/install-plan - Alternatives: https://forgeregistry.com/api/v1/alternatives/io.github.WYRE-AI%2Fcipp-mcp - HTML page: https://forgeregistry.com/registry/io.github.WYRE-AI%2Fcipp-mcp - MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan` ## About this document Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.