cipp-security — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited cipp-security (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read-only access to a tenant's Conditional Access policy graph and named-location list. Use as input to security posture reviews and to detect tenants drifting from MSP baseline policies. CIPP doesn't expose CA write operations through MCP — apply policy changes via CIPP standards or the CIPP UI.
cipp_list_conditional_access_policiescipp_list_conditional_access_policies(tenantFilter='contoso.onmicrosoft.com')Returns every CA policy with displayName, state (enabled / disabled / enabledForReportingButNotEnforced), conditions (users, apps, locations, platforms, sign-in risk), and grantControls (MFA, compliant device, terms of use, etc).
cipp_list_named_locationscipp_list_named_locations(tenantFilter='contoso.onmicrosoft.com')Returns named locations: IP ranges (trusted/untrusted) and country-based locations. These are the building blocks CA policies reference for location-based controls.
| Finding | Why it matters |
|---|---|
Zero policies in enabled state | Tenant has no CA enforcement at all — a baseline enabledForReportingButNotEnforced doesn't block anything |
| MFA not required for "All cloud apps" | A baseline policy is missing or scoped too narrowly |
| Policies excluding the entire admin role | Common configuration mistake; admins should require more MFA, not less |
| Trusted location includes home/coffee-shop IPs | Named-location bloat creates exception paths for attackers |
legacy authentication not blocked | Basic auth bypasses MFA entirely; should be blocked tenant-wide |
| Reporting-only policies older than 30 days | Should have been promoted to enabled or removed |
policies = cipp_list_conditional_access_policies(tenantFilter)
enabled = [p for p in policies if p['state'] == 'enabled']
mfa_for_all_apps = any(
p for p in enabled
if 'mfa' in p.get('grantControls', {}).get('builtInControls', [])
and 'All' in p.get('conditions', {}).get('applications', {}).get('includeApplications', [])
)If mfa_for_all_apps is false, the tenant lacks the baseline "MFA for everything" policy that every MSP should ship as a standard.
Run cipp_list_conditional_access_policies per tenant and compare the policy fingerprint (display names + state + grant controls) against the MSP's golden baseline. Flag tenants where any baseline policy is missing or disabled.
cipp_run_standards_check and the standards UI) to deploy policy templates across tenants, or do it manually via the CIPP web UI.enabledForReportingButNotEnforced looks like coverage in dashboards but enforces nothing. Always check state == 'enabled' for actual enforcement.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.