CallTelemetry Azure & Microsoft 365 Security MCP Server (@calltelemetry/azure-security-mcp)

Model Context Protocol (MCP) server providing Microsoft 365 Defender Plan 2 security management, Microsoft Defender XDR KQL threat hunting, incident triage, tenant secure score, and expanded Microsoft Intune MDM endpoint reporting.

Supports both local stdio execution (Claude Code, Antigravity, Cursor) and containerized HTTP/SSE for Kubernetes deployment behind Bifrost Gateway (port 8023).

Capabilities & Tools

1. MDM & Expanded Endpoint Reporting

• mdm_list_devices: List all Intune managed endpoints, OS, hardware model, compliance status, encryption status, and last check-in timestamp.
• mdm_get_device_detail: Granular hardware specifications, CPU, RAM, total storage, free disk space, used storage percentage, MAC addresses, serial number, OS build, and FileVault/BitLocker encryption status.
• mdm_get_compliance: Tenant fleet compliance breakdown (compliant, non-compliant, in-grace-period).
• mdm_get_device_compliance_policies: Specific compliance policies and failing rule settings (firewall, minimum OS version, password complexity, encryption).
• mdm_get_device_configuration_states: Applied configuration profiles (Defender system extensions, network filters, device feature profiles).
• mdm_get_endpoint_security: Endpoint security posture including FileVault/BitLocker disk encryption state, Microsoft Defender partner-reported threat level, jailbreak status, storage metrics, and active policy counts.

2. Threat Hunting (KQL)

• security_hunt_kql: Execute KQL queries across Microsoft Defender XDR Advanced Hunting tables (AlertEvidence, AlertInfo, EmailEvents, etc.).

3. Security Incidents & Alerts

• security_list_incidents: List multi-stage security attack incidents from Defender XDR with severity, status, and classification filters.
• security_get_incident: Deep incident inspection with alerts, affected assets (devices & users), and attack timeline.
• security_update_incident: Triage incident status, classification (TruePositive / FalsePositive), and assignment.
• security_get_score: Tenant Microsoft Secure Score, current vs max points, percentage, and top actionable recommendations.

4. Office 365 Posture

• o365_get_posture: Priority Account (VIP) audit, Strict vs Standard preset security policies, and Anti-Phishing baseline protection settings.

Authentication

1. Production / Kubernetes (Doppler):

   • AZURE_TENANT_ID
   • AZURE_CLIENT_ID
   • AZURE_CLIENT_SECRET Mounted securely via Doppler from project ct-azure or ai-workspace config prd.

2. Local Development:

   • Automatically falls back to local Azure CLI access token via az account get-access-token --resource https://graph.microsoft.com.

Development

# Install dependencies
npm install

# Typecheck and run tests
npm run validate

# Run locally in stdio mode
npm run dev

# Run locally in SSE mode (Port 8023)
npm run dev:sse

CI/CD & Publishing

• CI: Runs on all pushes and pull requests (npm run validate and npm pack --dry-run).
• Container Registry: Multi-arch images built and pushed to ghcr.io/calltelemetry/azure-security-mcp via .github/workflows/docker.yml.
• npm OIDC Trusted Publishing: Tagged releases (v*) publish automatically to npm registry using GitHub Actions OIDC (id-token: write, environment: npm-publish) via .github/workflows/publish.yml.

Cloudflare Worker (stateless streamable HTTP)

src/worker.ts serves the Azure Security tools as a stateless MCP endpoint (MCP spec 2026-07-28, no sessions) using the Agents SDK createMcpHandler. The Node SSE/stdio entrypoints are unchanged and keep serving the cluster until cutover (ADR 0781). Registration is shared (src/register.ts).

• Endpoint: POST <base>/azure_security/mcp (MCP_BASE_PATH), health at <base>/azure_security/healthz.
• Azure auth is service-principal client credentials via fetch only; the az CLI fallback is disabled on the Worker.
• Production requests must carry a valid Cloudflare Access assertion; the Worker returns 503 until ACCESS_TEAM_DOMAIN and ACCESS_AUD are configured. Secrets come from Doppler (mcp-workers/prd) via calltelemetry/mcp-worker-actions.
• Exposure: the Worker registers only the read-only allowlist in src/worker-tools.ts. The mutating tool (security_update_incident) stays off unless an operator sets WORKER_ENABLE_RESTRICTED_TOOLS=true.
• Every request is logged with the Access subject, MCP method and tool name (never arguments).

npm run dev:worker     # wrangler dev --env development (ENVIRONMENT=development skips Access)
npm run build:worker   # wrangler deploy --dry-run