Open-source · Microsoft 365 · CSP operations

Your Microsoft cloud. One intelligent interface.

An independently developed MCP server designed to connect ChatGPT and compatible AI clients with Microsoft 365 administration and Cloud Solution Provider workflows—securely, transparently and tenant by tenant.

↓ Download source ZIP Quick start guide →

MIT licensedPublic GitHub developmentLocal prototype v0.1.0

skunkworks-365-mcp / preview

# Connect your own authorized services

$ git clone skunkworks-africa/...

$ npm install # Node 24+

server: skunkworks-365-mcp

transport: local HTTP /mcp

authentication: JWT validation

registered_tools: 8 read-only

provider_connectors: not yet wired

SECURE BY DESIGN
Caller identity · tenant allowlist · explicit permissions

Built around open standards

Model Context ProtocolMicrosoft Graph (planned)OAuth / Entra ID (planned)Least privilege

Capabilities

One place for Microsoft 365 operations.

These are the product areas in development—not a claim that Microsoft or distributor APIs are already connected. The starter registers eight read-only tools, with simulated connector-unavailable responses for seven.

▦

Customer tenants

Explicit tenant allowlists and customer-scoped authorization. The starter lists locally authorized tenant IDs.

Local prototype

◫

Licensing inventory

Seat capacity, assigned products and SKU visibility through authorized Microsoft Graph access.

Integration planned

↺

Subscriptions

Subscription visibility, renewal oversight and commercial context where upstream APIs permit.

Integration planned

Billing & reconciliation

Correlate distributor charges, subscriptions and customer invoicing without commingling tenants.

Integration planned

♧

GDAP & delegation

Permission-aware operations with customer consent and role checks separated from reseller status.

Integration planned

⌘

Service administration

Plan safe user, application and policy reads; stage changes behind explicit approvals and audits.

Integration planned

Quick start

Clone it. Inspect it. Run it locally.

Start with the repository source and a development environment. The scaffold requires a real token issuer configuration; its example values are nonfunctional placeholders. It never queries a Microsoft tenant.

Step 01 · Prerequisites & download

Get the source

Install Git and Node.js 24 or later, then clone the public repository. Alternatively download the source archive.

git clone https://github.com/skunkworks-africa/skunkworks-365-mcp.git
cd skunkworks-365-mcp
npm install --ignore-scripts

Download ZIP instead ↗

Step 02 · Local configuration

Configure authentication

Copy the example environment and registry, then replace placeholder issuer, audience, JWKS URL and verified subject. Keep real values outside version control.

cp .env.example .env
cp access-registry.example.json access-registry.json

Use set -a; . ./.env; set +a in a Unix shell to load settings, or your OS equivalent. Do not expose the server publicly.

Step 03 · Build & validate

Run the prototype

Compile the TypeScript project, run the included tests and start the locally bound service after populating valid authentication settings.

npm run build
npm test
npm start

The local endpoint is http://127.0.0.1:3000/mcp. It requires a signed bearer token from your configured issuer.

Step 04 · Review before production

Understand the boundaries

All seven Microsoft/provider reads currently return connector_unavailable. Remote OAuth discovery, Graph adapters, distributor billing and production hardening are still on the roadmap.

Review security checklist →

Do not paste tenant credentials, access tokens or customer billing data into public GitHub issues.

Connect your AI client

Ready for ChatGPT—once the remote endpoint is deployed.

The source targets MCP interoperability. ChatGPT cannot connect directly to a local-only HTTP service, and this documentation domain is not the MCP endpoint. Follow these steps only after the project has a separately hosted, authenticated HTTPS runtime.

Remote service not deployed

ChatGPT setup

Open ChatGPT on the web and go to Plugins.
Choose + → Add custom MCP server (subject to workspace permissions).
Enter your deployed HTTPS MCP endpoint (typically ending in /mcp), not this documentation website.
Configure OAuth if required; review the server's permissions and risk warning.
Create/install the plugin, inspect discovered tools and test only an authorized tenant.

Official ChatGPT guide ↗

Other MCP clients

Client integration

Compatible clients will need an accessible MCP transport, appropriate bearer token or OAuth flow, and per-tenant authorization. Client configuration varies; a URL alone does not grant access to Microsoft 365.

transport: streamable HTTP
endpoint: https://YOUR-DEPLOYMENT.example/mcp
authorization: OAuth / valid bearer token
status: not yet hosted

The URL above is an illustrative placeholder, not a working endpoint or a service hosted by Skunkworks.

MCP specification ↗

Microsoft CSP constraint: Microsoft's Partner Center APIs do not support indirect reseller API access. Billing and subscription integrations must use authorized distributor/provider interfaces where applicable. Microsoft reference ↗

Transparent development

What's available in v0.1.0?

The included tools are registered with the local MCP SDK. Only authorized tenant IDs come from the local registry. No live Microsoft, CSP or billing data is returned.

MCP tool	Current behavior	State
tenants_list_authorized	Lists IDs in the local server-side access registry	Local implementation
users_list	Microsoft user connector unavailable	Planned
licenses_capacity	Microsoft license connector unavailable	Planned
subscriptions_list	Commercial subscription connector unavailable	Planned
billing_records	Distributor or billing connector unavailable	Planned
gdap_relationships	Delegated relationship connector unavailable	Planned
policies_list	Policy connector unavailable	Planned
applications_list	Application connector unavailable	Planned

Open-source download

Build with us.

The repository contains the public prototype and documentation. Source downloads are snapshots of the latest main branch, not binary installers or a hosted service.

Developer preview · MIT License

Skunkworks 365 MCP source

Clone or download the entire TypeScript prototype, security guidance, workflow and website source.

TypeScriptMCP SDKNode.js 24+MIT

↓ Download ZIP View GitHub repository ↗

Documentation & contributions

Read before using in any production tenant. Security and authorization controls are prerequisites, not optional enhancements.

README & quick start ↗

Security policy ↗

Development roadmap ↗

Issues and feedback ↗

Frequently asked questions

The important distinctions.

Is the public MCP server online?

No. This site hosts public documentation. The present prototype binds to localhost and has no live upstream adapters. A secured remote service must be deployed separately before ChatGPT can connect.

Can I manage CSP billing today?

Not yet. Billing, distributor reconciliation and Microsoft Graph integrations are planned. The local billing tool intentionally returns a connector-unavailable response.

Does this work for indirect resellers?

The project is designed to accommodate reseller-specific data paths, but Microsoft does not offer Partner Center API access to indirect resellers. Authorized distributor APIs or exports are needed for that commercial data.

Is Microsoft customer data public?

No. The repository and docs are public, but production tenant identifiers, access tokens, customer records and billing data must stay private and server-side.