synitio/ad-mcp repository overview

⁠Synit AD MCP

A read-only MCP server for Enterprise Active Directory. Agents, service desk tools, and automations look up users, groups, memberships, objects, and schema metadata through a fixed set of bounded tools. Writing to Active Directory is not possible by design: this server has no write tools at all.

• Read-only by architecture: no plan creation, no plan execution, no risk approval, no AD writes.
• Redacted responses: credential, password, LAPS, BitLocker, photo, and security-descriptor attributes are filtered before they reach the agent.
• Every call audited: each tool call lands in the audit log, including the protocol version used.
• Optional drafts, never writes: when enabled, the agent can prepare JSON for the separate AD Proxy HTTP plan endpoint. Review and submission stay with a human or workflow.

The server speaks MCP protocol 2026-07-28 only: stateless, no initialize handshake, no session ID, over streamable HTTP or stdio. Older protocol versions are rejected.

⁠Quick start

docker pull synitio/ad-mcp:latest

The container expects an HCL configuration mounted read-only, with the AD bind password and cursor secret passed as environment variables. For a local stdio setup, an MCP client launches the container with -i:

docker run --rm -i -v ./admcp.hcl:/etc/adproxy/admcp.hcl:ro \
  synitio/ad-mcp:latest -config /etc/adproxy/admcp.hcl

Never publish a stdio server port. For streamable HTTP, use bearer-token authentication with TLS directly or behind a trusted reverse proxy. Setup details: getting started⁠.

⁠Agent profiles

The tool surface is selectable per deployment: standard exposes all tools for large models, local reduces tools and page size for small local models. The deduplicated-v1 response profile trims repeated identity fields for small context windows. A tested agent persona for this server is documented as an example AGENTS.md.

⁠Tags and platforms

Linux images for amd64, arm64, and arm/v7. Use a pinned version tag and record the image digest for reproducible deployments; latest is a moving tag.

⁠Documentation

• Product page⁠
• Getting started⁠
• Configuration⁠
• Tools⁠
• Drafts and audit⁠
• Agent persona (example AGENTS.md)⁠
• Troubleshooting⁠
• Upgrade to v0.1.0⁠

⁠Related image

Reviewed or automated AD changes go through the separate control plane, synitio/ad-proxy⁠, with its plan/apply/verify workflow.

⁠License and use

Internal use, including production, is free of charge under the product license. External hosting, managed-service, reseller, and other commercial-service use requires prior written permission. Details: license and use⁠.

Questions or a read-only pilot: synit.io/kontakt⁠