CIPP — Claude Code MCP server: 49 tools for M365 management
Gives your AI assistant structured access to CIPP: tenants, users, mailboxes, policies and licenses across Microsoft 365.
claude mcp add --env CIPP_API_URL=<CIPP_API_URL> --env CIPP_CLIENT_ID=<CIPP_CLIENT_ID> --env CIPP_CLIENT_SECRET=<CIPP_CLIENT_SECRET> --env CIPP_TENANT_ID=<CIPP_TENANT_ID> --env MCP_TRANSPORT=<MCP_TRANSPORT> --transport stdio cipp -- docker run -i --rm -e CIPP_API_URL -e CIPP_CLIENT_ID -e CIPP_CLIENT_SECRET -e CIPP_TENANT_ID -e MCP_TRANSPORT ghcr.io/wyre-ai/cipp-mcp:v1.11.1What CIPP does
CIPP stands for CyberDrain Improved Partner Portal, a tool for managing many client tenants in Microsoft 365. This MCP server exposes it to an assistant through 49 tools in 12 categories. You can list tenants, users, groups and mailboxes, pull reports on mailbox and online-archive sizes, and read Entra ID sign-in logs with status, location, Conditional Access and MFA details.
Security and compliance get their own set: Conditional Access policies, named locations, Microsoft Secure Score, BPA, domain health and drift detection. There is also license reporting, alerts, audit logs, scheduled tasks, and GDAP role and invite management. Two transport modes are available: stdio and HTTP, with MCP Gateway support.
You need Node.js 18+, a running CIPP deployment, and an API key from CIPP Settings → API Client Management. Set CIPP_BASE_URL to the Azure Function App address, not the Static Web App frontend: the SWA's built-in auth intercepts tokens and sends requests to its login page, so every API call fails. HTTP mode also requires CONDUIT_S2S_SECRET; without it the process exits with an error.
What it helps with
- list client tenants and check their state
- pull a mailbox size report for one tenant
- review a user's Entra ID sign-in logs
- gather license and Secure Score data
- manage GDAP roles and invites
Example prompts for the agent
- List all tenants in CIPP and their status
- Pull the mailbox size report for tenant contoso
- Check sign-in logs for user [email protected] over the last week
How to install CIPP
Platform CLI
claude mcp add --env CIPP_API_URL=<CIPP_API_URL> --env CIPP_CLIENT_ID=<CIPP_CLIENT_ID> --env CIPP_CLIENT_SECRET=<CIPP_CLIENT_SECRET> --env CIPP_TENANT_ID=<CIPP_TENANT_ID> --env MCP_TRANSPORT=<MCP_TRANSPORT> --transport stdio cipp -- docker run -i --rm -e CIPP_API_URL -e CIPP_CLIENT_ID -e CIPP_CLIENT_SECRET -e CIPP_TENANT_ID -e MCP_TRANSPORT ghcr.io/wyre-ai/cipp-mcp:v1.11.1Replace <…> with your own values. 2 more environment variables are in the server README
Platform CLI
codex mcp add cipp --env CIPP_API_URL=<CIPP_API_URL> --env CIPP_CLIENT_ID=<CIPP_CLIENT_ID> --env CIPP_CLIENT_SECRET=<CIPP_CLIENT_SECRET> --env CIPP_TENANT_ID=<CIPP_TENANT_ID> --env MCP_TRANSPORT=<MCP_TRANSPORT> -- docker run -i --rm -e CIPP_API_URL -e CIPP_CLIENT_ID -e CIPP_CLIENT_SECRET -e CIPP_TENANT_ID -e MCP_TRANSPORT ghcr.io/wyre-ai/cipp-mcp:v1.11.1Replace <…> with your own values. 2 more environment variables are in the server README
Config file
{
"mcpServers": {
"cipp": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"CIPP_API_URL",
"-e",
"CIPP_CLIENT_ID",
"-e",
"CIPP_CLIENT_SECRET",
"-e",
"CIPP_TENANT_ID",
"-e",
"MCP_TRANSPORT",
"ghcr.io/wyre-ai/cipp-mcp:v1.11.1"
],
"env": {
"CIPP_API_URL": "<CIPP_API_URL>",
"CIPP_CLIENT_ID": "<CIPP_CLIENT_ID>",
"CIPP_CLIENT_SECRET": "<CIPP_CLIENT_SECRET>",
"CIPP_TENANT_ID": "<CIPP_TENANT_ID>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>"
}
}
}
}Replace <…> with your own values. 2 more environment variables are in the server README
Config file
{
"servers": {
"cipp": {
"type": "stdio",
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-e",
"CIPP_API_URL",
"-e",
"CIPP_CLIENT_ID",
"-e",
"CIPP_CLIENT_SECRET",
"-e",
"CIPP_TENANT_ID",
"-e",
"MCP_TRANSPORT",
"ghcr.io/wyre-ai/cipp-mcp:v1.11.1"
],
"env": {
"CIPP_API_URL": "<CIPP_API_URL>",
"CIPP_CLIENT_ID": "<CIPP_CLIENT_ID>",
"CIPP_CLIENT_SECRET": "<CIPP_CLIENT_SECRET>",
"CIPP_TENANT_ID": "<CIPP_TENANT_ID>",
"MCP_TRANSPORT": "<MCP_TRANSPORT>"
}
}
}
}Replace <…> with your own values. 2 more environment variables are in the server README
Platform CLI
gemini mcp add -e CIPP_API_URL=<CIPP_API_URL> -e CIPP_CLIENT_ID=<CIPP_CLIENT_ID> -e CIPP_CLIENT_SECRET=<CIPP_CLIENT_SECRET> -e CIPP_TENANT_ID=<CIPP_TENANT_ID> -e MCP_TRANSPORT=<MCP_TRANSPORT> cipp docker run -i --rm -e CIPP_API_URL -e CIPP_CLIENT_ID -e CIPP_CLIENT_SECRET -e CIPP_TENANT_ID -e MCP_TRANSPORT ghcr.io/wyre-ai/cipp-mcp:v1.11.1Replace <…> with your own values. 2 more environment variables are in the server README
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about CIPP
How do I install CIPP in Claude Code?
Run `claude mcp add --env CIPP_API_URL=<CIPP_API_URL> --env CIPP_CLIENT_ID=<CIPP_CLIENT_ID> --env CIPP_CLIENT_SECRET=<CIPP_CLIENT_SECRET> --env CIPP_TENANT_ID=<CIPP_TENANT_ID> --env MCP_TRANSPORT=<MCP_TRANSPORT> --transport stdio cipp -- docker run -i --rm -e CIPP_API_URL -e CIPP_CLIENT_ID -e CIPP_CLIENT_SECRET -e CIPP_TENANT_ID -e MCP_TRANSPORT ghcr.io/wyre-ai/cipp-mcp:v1.11.1`.
What does the CIPP MCP server do?
It exposes 49 CIPP tools to your assistant for Microsoft 365 work: tenants, users, groups, mailboxes, security policies, licenses, alerts and GDAP.
What do I need to run CIPP MCP?
Node.js 18+, a running CIPP deployment, and an API key from CIPP settings. HTTP mode also needs CONDUIT_S2S_SECRET.
