Roadrecon MCP Server

What atomicchonk/roadrecon_mcp_server MCP server does

The atomicchonk/roadrecon_mcp_server MCP server gives an MCP-compatible assistant access to Azure AD data exposed by a running ROADrecon instance. It is intended for security analysis of tenant-enumeration results rather than for collecting the data itself. The repository identifies Claude Desktop as an example client.

Available data includes tenant statistics, users, groups, applications, service principals, devices, MFA information, directory roles, role definitions, app role assignments, OAuth2 permission grants, and tenant details. Many entity types support both collection-level resources and detail resources addressed with an object ID.

How it works

The server communicates with the ROADrecon web GUI, which must already be running and reachable. The default URL is http://localhost:5000; a different URL can be supplied through the ROADRECON_URL environment variable.

After the MCP client connects, the atomicchonk/roadrecon_mcp_server MCP server makes ROADrecon data available through URIs such as roadrecon://users, roadrecon://groups, and roadrecon://applications/{id}. Analysis tools operate on that data. The included prompt templates organize common investigations, including privileged access, identity security, application risk, stale accounts, PIM, service-principal credentials, legacy authentication, conditional access, and broader security posture reviews.

One conditional-access tool analyzes policies from an HTML file. It checks C:\Temp\caps.html by default and can use another path when provided.

Setup and configuration

Use Python 3.8 or newer. Clone the repository, install its dependencies from requirements.txt, and start the server with:

python roadrecon_mcp_server.py

The ROADrecon GUI should be started separately before launching the MCP server. To target another GUI endpoint, set ROADRECON_URL, for example:

ROADRECON_URL=http://localhost:8080 python roadrecon_mcp_server.py

The documented client setup uses Claude Desktop's server settings and its option for adding a running server. The atomicchonk/roadrecon_mcp_server MCP server therefore requires both a reachable ROADrecon GUI and an MCP-compatible client.

Tools and capabilities

The atomicchonk/roadrecon_mcp_server MCP server includes tools to:

• Locate users with high-privilege roles.
• Assess MFA deployment across users.
• Find applications containing secrets or certificates.
• Examine group types and membership.
• Identify accounts inactive for a specified period.
• Assess PIM implementation.
• Detect over-permissioned service principals and long-lived credentials.
• Identify risks associated with legacy authentication protocols.
• Review conditional-access policies from an HTML file.

Its prompts provide reusable starting points for comprehensive security reviews and focused investigations. The resource set also allows an assistant to inspect individual users, groups, applications, and service principals when detail-level analysis is needed.

Limitations and notes

The repository does not describe a built-in ROADrecon collector, Azure authentication flow, or cloud-hosted endpoint. It expects an existing ROADrecon instance with its web GUI accessible. Conditional-access analysis depends on an HTML export or file available to the server, with a default lookup at C:\Temp\caps.html.

The documented license is MIT. Analysis results depend on the completeness and currency of the ROADrecon data supplied by the connected instance; the README describes access and analysis functions but does not specify retention, data validation, or remediation capabilities.