MCPComp Documentation

An MCP server’s metadata stays perfectly valid right up to the moment its client secret lapses — and then every token request fails at once, with nothing in the published configuration having changed. That is only visible from inside the identity provider. Entra first, because it is the only major provider exposing credential expiry through a proper API.

Check for expiring credentials

export MCPCOMP_ENTRA_TENANT=... MCPCOMP_ENTRA_CLIENT_ID=... MCPCOMP_ENTRA_CLIENT_SECRET=...
mcpcomp entra --within-days 30

MCPComp Entra tenant contoso.onmicrosoft.com
Scanned 42 app registration(s).

  [high] An Entra credential expires within 30 days
    1 credential(s) expiring: Prod MCP/deploy (11 days). Rotate before the
    deadline; nothing about the MCP server's own metadata will change when it
    lapses.
    fix: Add the replacement credential now and switch the deployment over
    before the old one lapses; both can be valid at once, so rotation needs
    no downtime.

The secret is read from the environment only — there is deliberately no --client-secret flag, because anything on the command line is readable through ps and lands in shell history.

The app registration needs the Application.Read.All application permission with admin consent. Authentication is Microsoft’s own ClientSecretCredential from @azure/identity, and paging is the Graph SDK’s PageIterator — no Graph URL is built by hand.

Rotate before it lapses

mcpcomp entra --rotate

--rotate fixes the expiring-secret finding instead of only reporting it: for each expiring secret it adds a replacement through Graph’s own addPassword action and prints the new value once. The old secret stays valid during the switchover, so rotation needs no downtime; retiring it is your call once the deployment presents the new one. Certificates are report-only — a key pair is something only you can mint.

Rotation writes to the tenant, so it needs Application.ReadWrite.All and never runs without the explicit flag.

Exit codes

Code	Meaning
`0`	Clean
`1`	Something expires within the horizon
`2`	Something has already expired, or bad argument

​Check for expiring credentials

​Rotate before it lapses

​Exit codes

Check for expiring credentials

Rotate before it lapses

Exit codes