cipp-ops — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cipp-ops (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The meta-layer — tools for managing CIPP itself rather than the tenants it manages. GDAP for the delegation chain, scheduler for recurring jobs, and health/version/log endpoints for verifying CIPP is reachable and functioning.
cipp_list_gdap_rolescipp_list_gdap_roles()Returns the GDAP (Granular Delegated Admin Privileges) role definitions available — the AAD roles your CSP relationship can grant to your MSP technicians per-tenant.
cipp_list_gdap_invitescipp_list_gdap_invites()Returns pending GDAP relationship invites that customers have not yet accepted. Stale invites > 14 days are usually customers who lost the email — re-send via the CIPP UI.
GDAP is the modern replacement for AOBO/DAP. Each invite grants the MSP partner tenant a specific set of AAD roles in the customer tenant for a fixed duration. CIPP relies on active GDAP relationships for nearly every multi-tenant operation; broken GDAP = silent failures across the rest of the toolkit.
cipp_list_scheduled_itemscipp_list_scheduled_items()Lists CIPP's scheduled tasks: recurring standards checks, BPA refreshes, alert evaluations, custom user-defined schedules.
cipp_add_scheduled_itemcipp_add_scheduled_item(name, command, parameters?, recurrence?, scheduledTime?)Creates a new scheduled task in CIPP. Use cases:
Pick recurrence deliberately — CIPP doesn't dedupe scheduled items, so re-running this tool with the same name creates a duplicate.
cipp_pingcipp_ping()Liveness probe for the CIPP API. Returns immediately if CIPP is reachable. First call when troubleshooting "tools aren't working" — separates "MCP can't reach CIPP" from "CIPP can't reach Microsoft."
cipp_get_versioncipp_get_version()Returns the deployed CIPP version (frontend + backend). Useful when reporting an issue to CIPP maintainers or comparing against the release notes for known regressions.
cipp_list_logscipp_list_logs(severity?, count?)Application logs from the CIPP backend. Use for diagnosing failed background jobs, GDAP errors, or rate-limit hits against the Graph API.
ping = cipp_ping()
version = cipp_get_version()
gdap_invites = cipp_list_gdap_invites()If any are unhealthy, halt the bulk operation. Bulk standards deployments or user creation against a CIPP with stale GDAP will silently fail or partially apply.
Run weekly:
cipp_list_gdap_invites — chase pending > 14 dayscipp_list_tenants against expected onboarded list — gaps usually mean revoked GDAPcipp_list_gdap_roles — verify the MSP role template hasn't been altered (drift here breaks fine-grained access)When any other CIPP tool returns an error:
cipp_ping — is CIPP reachable at all?cipp_get_version — is it the version you think it is?cipp_list_logs(severity='error', count=50) — what does CIPP itself report?cipp_list_gdap_invites and the affected tenant in cipp_list_tenants — broken GDAP is the #1 cause of partial failures.cipp_add_scheduled_item doesn't validate the command parameter against CIPP's known job types — typos create scheduled items that fail silently. Verify with cipp_list_scheduled_items after creation.cipp_list_logs is bounded by what CIPP itself retains — for long-term log retention, ship CIPP logs to an external SIEM via the CIPP integrations panel.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.