Log inSubmit server
Inforcer logo

Inforcer

Read-only access to Inforcer M365 governance data, with assessment and report execution tools.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Inforcer

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "inforcer": {
      "command": "npx",
      "args": [
        "-y",
        "github:WYRE-AI/inforcer-mcp"
      ],
      "env": {
        "INFORCER_REGION": "YOUR_VALUE_HERE",
        "INFORCER_API_KEY": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

Install not yet sandbox-tested— we haven't run this command through our automated sandbox yet. Not a red flag; we're working through the catalog.

Overview

The Inforcer MCP server exposes Inforcer Microsoft 365 baseline-governance data through MCP tools. It covers tenants, baselines, alignment and drift, policies, Secure Score, identity, audit logs, assessments, and reports. Most operations are read-only, while assessment runs and report queues trigger work in Inforcer and require confirmation. Use it when an agent needs to inspect governance data or retrieve report outputs through stdio or HTTP.

Use cases

  • Inspect Microsoft 365 baseline alignment and tenant drift
  • Review tenant policies and Secure Score data
  • Search audit events across governed tenants
  • Start assessments after confirming the requested tenant
  • Queue and retrieve Inforcer report outputs

Key features

  • Read-only governance data access
  • Tenant identifier resolution
  • Baseline and drift inspection
  • Identity and audit queries
  • Assessment and report execution
  • Stdio and streamable HTTP transports

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

8/8 checks healthy over the last 42d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 1d ago via OSV.dev · github:WYRE-AI/inforcer-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
Last commit4d agoMost recent push to the default branch.

How Inforcer works

What the Inforcer MCP server does

The Inforcer MCP server gives MCP-compatible clients structured access to Microsoft 365 governance information held in Inforcer. Its read-oriented tools cover tenant records, baseline definitions, alignment scores, tenant drift details, policies, Microsoft Secure Score data, users, groups, roles, audit events, assessments, and report runs.

The server also exposes two operational actions. inforcer_assessments_run starts an assessment for a tenant, while inforcer_reports_run queues reports for one or more tenants. These actions do not create, modify, or delete policies, tenants, or baselines, but they do initiate real work and are marked high impact. Confirm with the user before invoking either one.

How it works

The server wraps the @wyre-technology/node-inforcer SDK and communicates with Inforcer using the region-specific Inf-Api-Key header. Its API surface is based on a community-sourced Inforcer API rather than an official published REST specification, so endpoint behavior and response fields may change. Verify important results against the Inforcer portal.

For tenant-scoped requests, tools accept a numeric Client Tenant ID, tenant DNS name, Azure AD tenant GUID, or friendly name. Names and identifiers are resolved to the numeric Client Tenant ID before the request. If a value matches multiple tenants, the call fails as ambiguous; use the numeric ID or inspect the mapping with inforcer_tenants_resolve.

A navigation tool can help select a domain before using domain-specific operations. Report execution is asynchronous: queue the report, poll its status until isTerminal is true, and download each resulting output. Downloaded files are returned as base64-encoded content.

Setup and configuration

The Inforcer MCP server requires INFORCER_REGION and INFORCER_API_KEY for API calls. Valid regions are anz, eu, uk, and us; the key is sent to Inforcer as the Inf-Api-Key header. Tool discovery can work without these values, but the first real API request will fail if either is missing.

Local deployments use stdio by default. Claude Code can add the server with npx -y github:WYRE-AI/inforcer-mcp, passing the region and API key as environment variables. The project also supports Docker and HTTP transport; the container example exposes port 8080. Set MCP_TRANSPORT=http for HTTP mode and use MCP_HTTP_PORT to select another port.

When deployed behind the WYRE MCP Gateway, use AUTH_MODE=gateway with HTTP transport. The gateway supplies x-inforcer-region and x-inforcer-api-key request headers, which map to the corresponding environment values. The HTTP deployment includes a /health endpoint that reports whether credentials are configured.

Tools and capabilities

  • Navigate available domains and check live connectivity.
  • List, retrieve, and resolve Inforcer tenants.
  • Inspect baselines, alignment scores, and per-tenant drift.
  • List tenant policies and retrieve Secure Score information.
  • List or retrieve users and groups, and list roles.
  • Search audit events and enumerate event types.
  • List assessments and start an assessment run.
  • List report types and runs, check run status, queue reports, and download outputs.

Limitations and notes

The integration is mostly read-only, not a general Inforcer administration interface. There are no tools for creating, updating, or deleting tenants, policies, or baselines. Assessment and report actions have side effects in the form of starting or queuing work, even though they are not destructive.

The community-sourced SDK and API may change without notice. Credentials are not logged, but operators should still protect API keys and confirm high-impact actions. Tenant DNS names, friendly names, and Azure AD GUIDs are convenience inputs; they are distinct from Inforcer's numeric Client Tenant ID.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Inforcer

Inforcer is an MCP server that connects AI assistants to Inforcer Microsoft 365 baseline-governance data. Its main tools query tenants, baselines, alignment and drift, policies, Secure Score, identity, audit logs, assessments, and reports. Most tools are read-only; assessment runs and report queues are the two high-impact actions.

Install it with Claude Code, Docker, or from source. The Claude Code command runs the repository through `npx`; Docker uses the published container or Compose configuration; source installation requires cloning the repository, installing dependencies, and building it.

Set `INFORCER_REGION` and `INFORCER_API_KEY` before making API calls. The region must be `anz`, `eu`, `uk`, or `us`, and the key is sent as the `Inf-Api-Key` header. Transport, port, authentication mode, and logging have additional optional settings.

Queue a report with `inforcer_reports_run`, check progress using `inforcer_reports_run_status`, and download completed outputs with `inforcer_reports_download_output`. Report queuing starts real work in Inforcer, so confirm the action before invoking it.

Yes, Claude Code is documented as a supported setup. Add the server with `claude mcp add`, pass `INFORCER_REGION` and `INFORCER_API_KEY`, and run the repository through `npx`.

Related MCP servers

All in Developer Tools All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewInforcer AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/inforcer?style=directory)](https://allmcps.com/mcp/inforcer)
HTML Embed
<a href="https://allmcps.com/mcp/inforcer"><img src="https://allmcps.com/api/badge/inforcer?style=directory" alt="Inforcer on AllMCPs" /></a>