# Inforcer [Health: Active]

**Category:** 💻 Developer Tools  
**Repository:** https://github.com/WYRE-AI/inforcer-mcp  
**GitHub Stars:** 1  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/inforcer

## Description
Read-only MCP server for Inforcer M365 baseline governance, plus assessment and report runs.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "inforcer": {
    "command": "npx",
    "args": ["-y","github:WYRE-AI/inforcer-mcp"],
    "env": {
      "INFORCER_REGION": "",
      "INFORCER_API_KEY": ""
    }
  }
}
```

**Requires environment variables:** `INFORCER_REGION`, `INFORCER_API_KEY` — the values above are empty placeholders; fill in real credentials before running (see the repository for what each one is for).

## Documentation

## What the Inforcer MCP server does

The Inforcer MCP server gives MCP-compatible clients structured access to Microsoft 365 governance information held in Inforcer. Its read-oriented tools cover tenant records, baseline definitions, alignment scores, tenant drift details, policies, Microsoft Secure Score data, users, groups, roles, audit events, assessments, and report runs.

The server also exposes two operational actions. `inforcer_assessments_run` starts an assessment for a tenant, while `inforcer_reports_run` queues reports for one or more tenants. These actions do not create, modify, or delete policies, tenants, or baselines, but they do initiate real work and are marked high impact. Confirm with the user before invoking either one.

## How it works

The server wraps the `@wyre-technology/node-inforcer` SDK and communicates with Inforcer using the region-specific `Inf-Api-Key` header. Its API surface is based on a community-sourced Inforcer API rather than an official published REST specification, so endpoint behavior and response fields may change. Verify important results against the Inforcer portal.

For tenant-scoped requests, tools accept a numeric Client Tenant ID, tenant DNS name, Azure AD tenant GUID, or friendly name. Names and identifiers are resolved to the numeric Client Tenant ID before the request. If a value matches multiple tenants, the call fails as ambiguous; use the numeric ID or inspect the mapping with `inforcer_tenants_resolve`.

A navigation tool can help select a domain before using domain-specific operations. Report execution is asynchronous: queue the report, poll its status until `isTerminal` is true, and download each resulting output. Downloaded files are returned as base64-encoded content.

## Setup and configuration

The Inforcer MCP server requires `INFORCER_REGION` and `INFORCER_API_KEY` for API calls. Valid regions are `anz`, `eu`, `uk`, and `us`; the key is sent to Inforcer as the `Inf-Api-Key` header. Tool discovery can work without these values, but the first real API request will fail if either is missing.

Local deployments use stdio by default. Claude Code can add the server with `npx -y github:WYRE-AI/inforcer-mcp`, passing the region and API key as environment variables. The project also supports Docker and HTTP transport; the container example exposes port 8080. Set `MCP_TRANSPORT=http` for HTTP mode and use `MCP_HTTP_PORT` to select another port.

When deployed behind the WYRE MCP Gateway, use `AUTH_MODE=gateway` with HTTP transport. The gateway supplies `x-inforcer-region` and `x-inforcer-api-key` request headers, which map to the corresponding environment values. The HTTP deployment includes a `/health` endpoint that reports whether credentials are configured.

## Tools and capabilities

- Navigate available domains and check live connectivity.
- List, retrieve, and resolve Inforcer tenants.
- Inspect baselines, alignment scores, and per-tenant drift.
- List tenant policies and retrieve Secure Score information.
- List or retrieve users and groups, and list roles.
- Search audit events and enumerate event types.
- List assessments and start an assessment run.
- List report types and runs, check run status, queue reports, and download outputs.

## Limitations and notes

The integration is mostly read-only, not a general Inforcer administration interface. There are no tools for creating, updating, or deleting tenants, policies, or baselines. Assessment and report actions have side effects in the form of starting or queuing work, even though they are not destructive.

The community-sourced SDK and API may change without notice. Credentials are not logged, but operators should still protect API keys and confirm high-impact actions. Tenant DNS names, friendly names, and Azure AD GUIDs are convenience inputs; they are distinct from Inforcer's numeric Client Tenant ID.

_Full upstream README: https://allmcps.com/mcp/inforcer/readme_