Microsoft Entra SCIM

{
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "name": "io.github.darrenjrobinson/entra-scim-mcp",
  "description": "Microsoft Entra SCIM 2.0 Provisioning API: user and group lifecycle, with a local mock.",
  "title": "Microsoft Entra SCIM",
  "repository": {
    "url": "https://github.com/darrenjrobinson/entra-scim-mcp",
    "source": "github"
  },
  "version": "0.3.0",
  "websiteUrl": "https://github.com/darrenjrobinson/entra-scim-mcp#readme",
  "packages": [
    {
      "registryType": "npm",
      "registryBaseUrl": "https://registry.npmjs.org",
      "identifier": "entra-scim-mcp",
      "version": "0.3.0",
      "transport": {
        "type": "stdio"
      },
      "environmentVariables": [
        {
          "description": "Directory (tenant) GUID. Required to authenticate against a live tenant; not needed for ENTRA_SCIM_DRY_RUN or ENTRA_SCIM_STATIC_TOKEN, which supply their own placeholder.",
          "name": "ENTRA_TENANT_ID"
        },
        {
          "description": "App registration (client) GUID. Required to authenticate against a live tenant; not needed for ENTRA_SCIM_DRY_RUN or ENTRA_SCIM_STATIC_TOKEN.",
          "name": "ENTRA_CLIENT_ID"
        },
        {
          "description": "Client secret value. For a live tenant set exactly one of ENTRA_CLIENT_SECRET or ENTRA_CLIENT_CERT_PATH; a certificate is preferred for anything long-lived.",
          "isSecret": true,
          "name": "ENTRA_CLIENT_SECRET"
        },
        {
          "description": "Path to a PEM holding the certificate and its private key. Set exactly one of ENTRA_CLIENT_SECRET or ENTRA_CLIENT_CERT_PATH.",
          "name": "ENTRA_CLIENT_CERT_PATH"
        },
        {
          "description": "Password for the PEM, if it is encrypted.",
          "isSecret": true,
          "name": "ENTRA_CLIENT_CERT_PASSWORD"
        },
        {
          "description": "Override the SCIM base URL (default https://graph.microsoft.com/rp/scim). Point it at the bundled mock to try the tools without a tenant.",
          "name": "ENTRA_SCIM_BASE_URL"
        },
        {
          "description": "Use a fixed bearer token instead of Azure AD. Refuses any microsoft.com/microsoft.us host and requires ENTRA_SCIM_BASE_URL; intended for the local mock only.",
          "isSecret": true,
          "name": "ENTRA_SCIM_STATIC_TOKEN"
        },
        {
          "description": "Set to 1 to run every client-side validation and return the request that would have been sent, without sending it or acquiring a token.",
          "name": "ENTRA_SCIM_DRY_RUN"
        }
      ]
    }
  ]
}