Local MCP · read-only

Ask your AI client why an Intune assignment applies

Run Intune Assignment Checker locally over MCP. Sign in with your Microsoft work account in the browser, keep tokens protected on your machine, and make bounded read-only Microsoft Graph queries.

View setup Security model

Runs on your machine

Your AI client launches the MCP over stdio. There is no hosted token service or tenant database.

Tokens stay local

MSAL protects its cache with DPAPI, Keychain, or libsecret. Tokens never enter MCP tool results.

Purpose-built and read-only

Tools construct known Graph /beta paths internally. There is no generic Graph request tool.

Install

One npm package for every local MCP client

Choose your client, add the npx command once, and let the client launch the MCP when it is needed. Node.js 20 or newer is the only local prerequisite.

1Install Node.js 20 or newer.
2Add the configuration for your desktop client.
3Restart the client and confirm that the MCP is connected.
4Ask an Intune question and complete Microsoft sign-in when the browser opens.

Desktop clients only. ChatGPT Web and Claude.ai cannot directly start a local process. Use ChatGPT Desktop, Claude Desktop, Claude Code, Codex, Cursor, VS Code, or another local stdio MCP host.

Available on npm: the production Entra client is configured, and these commands launch the latest published package. Contributors can also use the source setup below.

Claude Desktop

Open Settings → Developer → Edit Config, add the server, then restart Claude Desktop.

Claude Desktop configuration

JSON

{
  "mcpServers": {
    "intune-assignment-checker": {
      "command": "npx",
      "args": ["-y", "intune-assignment-checker-mcp@latest"]
    }
  }
}

Claude Code

The user scope makes the MCP available in every project. Verify it with claude mcp list or /mcp.

Claude Code configuration

SHELL

claude mcp add --transport stdio --scope user \
  intune-assignment-checker -- \
  npx -y intune-assignment-checker-mcp@latest

ChatGPT Desktop & Codex

Add this to ~/.codex/config.toml. ChatGPT Desktop, Codex CLI, and the Codex IDE extension share the configuration on the same machine.

ChatGPT Desktop & Codex configuration

TOML

[mcp_servers.intune-assignment-checker]
command = "npx"
args = ["-y", "intune-assignment-checker-mcp@latest"]

Codex CLI shortcut: codex mcp add intune-assignment-checker -- npx -y intune-assignment-checker-mcp@latest

Cursor

Add the server to Cursor's MCP configuration and enable it from Cursor settings.

Cursor configuration

JSON

{
  "mcpServers": {
    "intune-assignment-checker": {
      "command": "npx",
      "args": ["-y", "intune-assignment-checker-mcp@latest"]
    }
  }
}

VS Code

Use MCP: Add Server with a stdio command, or place this entry in the appropriate VS Code mcp.json file.

VS Code configuration

JSON

{
  "servers": {
    "intune-assignment-checker": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "intune-assignment-checker-mcp@latest"]
    }
  }
}

Contributor source setup

Clone the MCP repository, run npm install, npm run check, and npm run build. Then point your client at the built entry file. The production public-client ID is already embedded.

Local source configuration

JSON

{
  "mcpServers": {
    "intune-assignment-checker": {
      "command": "node",
      "args": [
        "/absolute/path/to/IntuneAssignmentChecker-MCP/dist/index.js"
      ]
    }
  }
}

Authentication

One public client. No customer secret.

The standard installation uses one multi-tenant Entra public client named Intune Assignment Checker MCP. It uses delegated permissions only. Customers do not create a certificate, upload a secret, or operate a second registration.

Current consent bundle

DeviceManagementConfiguration.Read.All
DeviceManagementApps.Read.All
GroupMember.Read.All

These delegated Intune scopes normally require administrator consent. Additional scopes are added to this same registration only when the tools that use them ship. Cloud PC access is not requested in the current slice.

1. A tool needs Microsoft Graph

The local MCP first checks its protected cache. It can return auth_required instead when automatic sign-in is disabled.

2. Your browser opens Microsoft sign-in

Microsoft handles credentials and consent. The language model never receives a password, code, or access token.

3. MSAL stores the connection locally

The cache is bound to the current OS user. If the secure keyring is unavailable, the MCP falls back to memory instead of plaintext files.

4. Graph data travels directly from your machine

Only bounded tool results are returned to the AI client. No Intune inventory is stored by this website.

First tools

A narrow surface with explainable results

get_connection_status

Connection, tenant, scopes, and cache protection, but never the token.

search_policies

Search supported Intune policies and apps with bounded cursor pagination.

get_policy_assignments

Normalize includes, exclusions, groups, intents, and assignment filters.

Try asking

Natural-language assignment questions

Find policies with Endpoint Security in the name.
Show the assignments for this configuration policy.
Which included or excluded groups target this app?
Which assignment filters affect this policy?

Delegated Intune RBAC can narrow successful Graph results. Every response reports that uncertainty and never presents a partial category scan as complete.

Review exactly what stays local and what reaches your model

The security page documents token storage, Graph safeguards, model data exposure, retention, tenant selection, and revocation.

Read the security model