# CIPP Gives your AI assistant structured access to CIPP: tenants, users, mailboxes, policies and licenses across Microsoft 365. - MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 11 - Author: WYRE-AI - License: not stated · policy=link-only · description only; the file stays with the author - Source: https://github.com/WYRE-AI/cipp-mcp - Updated: 2026-10-21 - HTML: https://affpapa.org/en/nevibecode/mcp/cipp ## What it does CIPP stands for CyberDrain Improved Partner Portal, a tool for managing many client tenants in Microsoft 365. This MCP server exposes it to an assistant through 49 tools in 12 categories. You can list tenants, users, groups and mailboxes, pull reports on mailbox and online-archive sizes, and read Entra ID sign-in logs with status, location, Conditional Access and MFA details. Security and compliance get their own set: Conditional Access policies, named locations, Microsoft Secure Score, BPA, domain health and drift detection. There is also license reporting, alerts, audit logs, scheduled tasks, and GDAP role and invite management. Two transport modes are available: stdio and HTTP, with MCP Gateway support. You need Node.js 18+, a running CIPP deployment, and an API key from CIPP Settings → API Client Management. Set `CIPP_BASE_URL` to the Azure Function App address, not the Static Web App frontend: the SWA's built-in auth intercepts tokens and sends requests to its login page, so every API call fails. HTTP mode also requires `CONDUIT_S2S_SECRET`; without it the process exits with an error. ## Requirements - Needs: Docker - Environment variables: `CIPP_API_URL`, `CIPP_CLIENT_ID`, `CIPP_CLIENT_SECRET`, `CIPP_TENANT_ID`, `MCP_TRANSPORT`, `AUTH_MODE`, `LOG_LEVEL` — keys and tokens: ask the human for the values, never commit them or put them in shared files. ## Install ### Claude Code (native platform) **Platform CLI** ```bash claude mcp add --env CIPP_API_URL= --env CIPP_CLIENT_ID= --env CIPP_CLIENT_SECRET= --env CIPP_TENANT_ID= --env MCP_TRANSPORT= --transport stdio cipp -- docker run -i --rm -e CIPP_API_URL -e CIPP_CLIENT_ID -e CIPP_CLIENT_SECRET -e CIPP_TENANT_ID -e MCP_TRANSPORT ghcr.io/wyre-ai/cipp-mcp:v1.11.1 ``` Replace <…> with your own values. 2 more environment variables are in the server README ### Codex **Platform CLI** ```bash codex mcp add cipp --env CIPP_API_URL= --env CIPP_CLIENT_ID= --env CIPP_CLIENT_SECRET= --env CIPP_TENANT_ID= --env MCP_TRANSPORT= -- docker run -i --rm -e CIPP_API_URL -e CIPP_CLIENT_ID -e CIPP_CLIENT_SECRET -e CIPP_TENANT_ID -e MCP_TRANSPORT ghcr.io/wyre-ai/cipp-mcp:v1.11.1 ``` Replace <…> with your own values. 2 more environment variables are in the server README ### Cursor **Config file** File `.cursor/mcp.json`: ```json { "mcpServers": { "cipp": { "command": "docker", "args": [ "run", "-i", "--rm", "-e", "CIPP_API_URL", "-e", "CIPP_CLIENT_ID", "-e", "CIPP_CLIENT_SECRET", "-e", "CIPP_TENANT_ID", "-e", "MCP_TRANSPORT", "ghcr.io/wyre-ai/cipp-mcp:v1.11.1" ], "env": { "CIPP_API_URL": "", "CIPP_CLIENT_ID": "", "CIPP_CLIENT_SECRET": "", "CIPP_TENANT_ID": "", "MCP_TRANSPORT": "" } } } } ``` Replace <…> with your own values. 2 more environment variables are in the server README ### GitHub Copilot **Config file** File `.vscode/mcp.json`: ```json { "servers": { "cipp": { "type": "stdio", "command": "docker", "args": [ "run", "-i", "--rm", "-e", "CIPP_API_URL", "-e", "CIPP_CLIENT_ID", "-e", "CIPP_CLIENT_SECRET", "-e", "CIPP_TENANT_ID", "-e", "MCP_TRANSPORT", "ghcr.io/wyre-ai/cipp-mcp:v1.11.1" ], "env": { "CIPP_API_URL": "", "CIPP_CLIENT_ID": "", "CIPP_CLIENT_SECRET": "", "CIPP_TENANT_ID": "", "MCP_TRANSPORT": "" } } } } ``` Replace <…> with your own values. 2 more environment variables are in the server README ### Gemini CLI **Platform CLI** ```bash gemini mcp add -e CIPP_API_URL= -e CIPP_CLIENT_ID= -e CIPP_CLIENT_SECRET= -e CIPP_TENANT_ID= -e MCP_TRANSPORT= cipp docker run -i --rm -e CIPP_API_URL -e CIPP_CLIENT_ID -e CIPP_CLIENT_SECRET -e CIPP_TENANT_ID -e MCP_TRANSPORT ghcr.io/wyre-ai/cipp-mcp:v1.11.1 ``` Replace <…> with your own values. 2 more environment variables are in the server README ## When to use it - list client tenants and check their state - pull a mailbox size report for one tenant - review a user's Entra ID sign-in logs - gather license and Secure Score data - manage GDAP roles and invites ## Example prompts - List all tenants in CIPP and their status - Pull the mailbox size report for tenant contoso - Check sign-in logs for user ivan@contoso.com over the last week ## Similar - [mcp-server](https://affpapa.org/en/nevibecode/mcp/mcp-server.md) — MCP server · ★ 43872 - [Coder](https://affpapa.org/en/nevibecode/mcp/coder.md) — MCP server · ★ 17160 - [firebase-mcp](https://affpapa.org/en/nevibecode/mcp/firebase-mcp.md) — MCP server · ★ 4481 - [Radar Kubernetes MCP Server](https://affpapa.org/en/nevibecode/mcp/radar-kubernetes-mcp-server.md) — MCP server · ★ 3905 - [Supabase](https://affpapa.org/en/nevibecode/mcp/supabase.md) — MCP server · ★ 2969 - [Microsoft Fabric MCP Server](https://affpapa.org/en/nevibecode/mcp/microsoft-fabric-mcp-server.md) — MCP server · ★ 3799 --- NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md