{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_pyv7bnk4yqqz","handle":"m365-evidence-mcp","url":"https://wellknown.network/agents/m365-evidence-mcp","links":{"self":"https://wellknown.network/agents/m365-evidence-mcp/record.json","html":"https://wellknown.network/agents/m365-evidence-mcp","markdown":"https://wellknown.network/agents/m365-evidence-mcp/record.md","api":"https://wellknown.network/api/v1/agents/m365-evidence-mcp","status":"https://wellknown.network/api/v1/agents/m365-evidence-mcp/status","claim":"https://wellknown.network/agents/m365-evidence-mcp/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/m365-evidence-mcp/claim.json","badge":"https://wellknown.network/agents/m365-evidence-mcp/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/m365-evidence-mcp/history","tools":"https://wellknown.network/api/v1/agents/m365-evidence-mcp/tools"},"ard":{"identifier":"urn:air::server:m365-evidence-mcp","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"m365-evidence-mcp","summary":"MCP server over Microsoft Graph: four read-only audit evidence tools any AI client can call","description":"# m365-evidence-mcp\n\nAn MCP server that turns the Microsoft Graph reads an IT auditor keeps repeating into tools any MCP-capable AI client can call. Point it at a tenant with a read-only token and ask for the evidence in plain language instead of clicking through four admin portals.\n\nThe four tools cover ITGC classics: security posture, MFA coverage, dormant accounts and privileged access. The model fetches, the auditor concludes.\n\n## Tools\n\n| Tool | What it does |\n|---|---|\n| `secure_score()` | Current Secure Score plus the five weakest controls |\n| `mfa_coverage()` | How many users are MFA registered, and who is not |\n| `stale_accounts(days)` | Enabled accounts with no sign-in in the last N days |\n| `privileged_roles()` | Activated directory roles and who holds them |\n\n## Setup\n\n```bash\npython3 -m venv .venv\n.venv/bin/pip install mcp\n```\n\nGet a Graph token. The Azure CLI is the quickest way:\n\n```bash\nexport GRAPH_TOKEN=$(az account get-access-token --resource https://graph.microsoft.com --query accessToken -o tsv)\n```\n\nThe Access token tab in Graph Explorer works too. Scopes: SecurityEvents.Read.All for the score, Reports.Read.All for MFA coverage, User.Read.All plus AuditLog.Read.All for stale accounts, Directory.Read.All for roles. All of them are read scopes and most need admin consent.\n\nWire it into Claude Code:\n\n```bash\nclaude mcp add m365evidence -- /path/to/m365-evidence-mcp/.venv/bin/python /path/to/m365-evidence-mcp/m365_evidence_mcp.py\n```\n\n## Demo\n\nWhat it looks like from Claude Code:\n\n```\n> pull the access review evidence for the quarter\n\n⏺ m365evidence · privileged_roles()\n\n  Global Administrator (2):\n    - amir.admin@demo.example\n    - breakglass@demo.example\n  Helpdesk Administrator (1):\n    - sara.support@demo.example\n\n⏺ Two global admins and one of them is the break glass account.\n  Helpdesk Administrator has a single holder. MFA coverage next?\n```\n\nThe accounts above are demo data. The format is exactly what the server returns.\n\n## Design notes\n…","publisher":{"name":"Al Amin Bashir Afara","url":null},"homepage":"https://github.com/aminafara123/m365-evidence-mcp","repository":"https://github.com/aminafara123/m365-evidence-mcp","version":"1.0.0","license":"MIT","protocols":["mcp"],"tags":["mcp","microsoft-graph","it-audit","grc","secure-score","audit-evidence"],"pricing":null,"endpoints":[{"url":"pypi:m365-evidence-mcp","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","license":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"knowledge.knowledge-graph","name":"Knowledge Graphs","confidence":0.997,"provenance":"derived"}],"categories":["knowledge"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"m365-evidence-mcp","registry":"pypi","observedAt":"2026-11-05T21:26:49.517Z","publishedAt":"2026-09-29T12:34:56.417304Z","latestVersion":"1.0.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"m365-evidence-mcp","url":"https://pypi.org/project/m365-evidence-mcp/","firstSeenAt":"2026-09-30T11:24:23.112Z","fetchedAt":"2026-11-05T21:26:16.274Z","normalizedAt":"2026-11-05T21:26:16.274Z"}]},"firstSeenAt":"2026-09-30T11:24:23.112Z","updatedAt":"2026-11-05T21:26:49.517Z"}