Inforcer API Patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Inforcer API Patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The Inforcer MCP server exposes a read-only Microsoft 365 security baseline governance surface for MSPs — managed tenants, baseline templates, alignment/drift, secure scores, identity inventory, and audit events — plus exactly one write action: triggering an assessment run. Read this skill first; the other Inforcer skills build on the connection, envelope, and tenant-id conventions described here.
Community-sourced API caveat. Inforcer publishes no official public API documentation. The API surface modelled here is community-sourced from the royklo/InforcerCommunity project. Endpoint paths, field names, and behaviour may change without notice. Tool names below are illustrative of the MCP surface, not a guaranteed contract.The gateway authenticates to Inforcer using two credentials, each on its own X- header:
| Gateway header | Env var | Value |
|---|---|---|
X-Inforcer-Region | INFORCER_REGION | One of us, uk, eu, anz (required) |
X-Inforcer-Api-Key | INFORCER_API_KEY | Your raw Inforcer API key |
export INFORCER_REGION="us" # or uk / eu / anz
export INFORCER_API_KEY="your-inforcer-api-key"The .mcp.json substitutes ${INFORCER_REGION} and ${INFORCER_API_KEY} into the X-Inforcer-Region and X-Inforcer-Api-Key headers respectively.
The gateway-facing X- headers are not what Inforcer's own API expects. The MCP server translates them:
X-Inforcer-Region selects the regionalhost. The upstream base URL is https://api-{region}.inforcer.com/api, e.g. https://api-us.inforcer.com/api. Region is required — there is no default host.
X-Inforcer-Api-Key is forwardedupstream as the custom Inf-Api-Key header that Inforcer's API actually reads.
You never set Inf-Api-Key or the base URL yourself — the MCP server handles both. You only need the two X- headers (via the env vars).
Many Inforcer routes live under a `/beta/` path prefix (the beta API), e.g. https://api-{region}.inforcer.com/api/beta/.... The MCP server builds these paths for you, but be aware that the surface is a beta API and may evolve.
Inforcer responses are wrapped in a consistent envelope:
{
"success": true,
"message": "OK",
"errors": [],
"data": [ ... ]
}| Field | Meaning |
|---|---|
success | Boolean — whether the call succeeded |
message | Human-readable status string |
errors | Array of error detail (empty on success) |
data | The actual payload (object or array) |
Always read from data. Treat success: false (or a non-empty errors) as a failure even if an HTTP 200 came back.
List endpoints paginate with a `continuationToken`:
continuationToken. Pass it back on the nextrequest to fetch the following page.
Loop until no continuationToken is returned before claiming a result set is complete — especially for portfolio-wide reports where a partial page silently understates drift or inventory.
Tenant-scoped Inforcer paths take an integer Client Tenant ID — not the Azure AD tenant GUID and not the tenant domain.
| Identifier | Works in the path? |
|---|---|
Integer Client Tenant ID (e.g. 1423) | Yes — this is what the path expects |
Azure AD tenant GUID (00000000-…) | No — must be resolved to the integer id |
Tenant domain (contoso.onmicrosoft.com) | No — must be resolved to the integer id |
Friendly display name (Contoso) | No — must be resolved to the integer id |
The MCP server resolves friendly names, DNS domains, and Azure AD GUIDs to the integer Client Tenant ID for you, so you can refer to a tenant naturally. But the underlying API path is the integer id. If a tenant-scoped call returns nothing, the most common cause is that a GUID or domain reached the path without being resolved to the integer Client Tenant ID — re-resolve via inforcer_tenants_list (see tenant-management).
| Status | Meaning | Action |
|---|---|---|
| 400 | Bad request — often a malformed tenant id (GUID/domain where an integer is expected) | Resolve to the integer Client Tenant ID and retry |
| 401 | Missing or invalid API key | Re-check INFORCER_API_KEY → X-Inforcer-Api-Key (forwarded as Inf-Api-Key) |
| 403 | Key valid but not authorized for this resource/region | Check the key's scope and that INFORCER_REGION matches the key's region |
| 404 | Unknown tenant / baseline / assessment id | Re-list to confirm the id exists; check you used the integer Client Tenant ID |
| 429 | Rate limit | Back off and retry |
success: false in a 200 body | Application-level failure | Read message and errors; do not trust data |
mutation is inforcer_assessments_run — flag it explicitly before invoking (see assessments).
INFORCER_REGION is set and matches the key's region —a missing or wrong region points the MCP server at the wrong host.
continuationToken before reporting totals.work — resolve to the integer Client Tenant ID first.
against the royklo/InforcerCommunity project rather than assuming a stable contract.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.