Afi MCP

Analyze locally synced data with count, group-by, and summary operations. Data must be synced first with the sync command.

Lists installations for the application identified by the authentication key. Use the `limit` and `page_token` query parameters to paginate through all installations. Optional: limit, page_token. Returns array of V1Installation.

Group locally synced archives by resource, take the newest created_at, and flag protected resources whose newest backup exceeds --max-age (run 'afi-cli fleet-sync' first). Resources with a protection but no archive at all are reported as never_archived. Use this command to find protected resources whose most recent backup is older than the threshold. Do NOT use this command to find resources with NO protection at all; use 'coverage-gaps' instead.

Get API domain context: resource taxonomy, auth requirements, query tips, and unique capabilities. Call this first.

Find resources with NO backup protection applied, by joining locally synced resources against protections (run 'afi-cli fleet-sync' first). Use this command to list resources that lack any protection at all. Do NOT use this command for protected resources whose backups have gone stale; use 'backup-stale' instead. Do NOT use this command for the all-tenants health rollup; use 'fleet-health' instead.

Roll up the locally synced task-status snapshots, quota states, and protection coverage for every tenant into one fleet table (run 'afi-cli fleet-sync' first; the task counters cover the sync's lookback window). Use this command for the fleet-wide nightly backup + quota rollup across all tenants. Do NOT use this command to drill a single tenant's unprotected resources; use 'coverage-gaps' instead. Do NOT use this command for one tenant's deep posture card; use 'tenant-scorecard' instead.

The Afi public API exposes exactly one flat list (application installations); everything else is path-scoped per org or tenant, so the generic 'sync' command can only cover installations. fleet-sync walks the full hierarchy — installations, orgs (including child orgs), tenants, then each tenant's resources, protections, policies, archives, quotas, and a task-status snapshot — into local SQLite with one respectful, sequential, rate-limited pass. Every fleet question (coverage-gaps, fleet-health, backup-stale, reconcile-licenses, tenant-scorecard, resolve) then runs offline. Use this command to populate or refresh the local fleet store. Do NOT use this command for the flat installations-only sync; use 'sync' instead.

Import data from a JSONL file by issuing POST requests for each record. Each line must be a valid JSON object. Failed records are logged to stderr but do not stop the import.

Analyze locally synced data to show how many items are assigned to each person. Helps identify overloaded team members and unbalanced workload.

Run the vendor's archive-and-offboard sequence with a verification gate the portal lacks: trigger a final out-of-schedule backup, wait for the task to finish, confirm a fresh archive exists for the resource, and only then remove the protection so the Microsoft 365 / Google Workspace seat can be released. The command REFUSES the irreversible unprotect step until the backup is verified (override the wait with --no-wait at your own risk). Use this command to safely back up then release a departing user's resource (the vendor's archive-and-offboard sequence). Do NOT use this command to merely list a resource's backups; use 'tenants archives list' instead. Do NOT use this command to unprotect without a final backup; use 'tenants resources protections-unprotect' instead.

Creates a new child organization. Optional: parent_org_id, external_id, name (plus 1 more). Returns the new V1CreateOrgResult.

Retrieves an organization by its ID. Required: id. Returns the V1Org.

Returns historical usage for the organization's subscriptions over the requested period. If the licensed quantity changes during that period, the response includes multiple records for the same subscription. Only post-pay subscriptions are included in the response. Required: org_id. Optional: start, end.

Returns subscription details for the specified organization. Each tenant in the organization has its own subscription. Use the `limit` and `page_token` query parameters to paginate the results. Required: org_id. Optional: limit, page_token.

Lists child organizations of the specified parent organization. The root organization and its sub-organizations form a hierarchy. Each organization in the hierarchy can own tenants and resources. Use the `limit` and `page_token` query parameters to paginate through the hierarchy. Required: org_id. Optional: limit, page_token. Returns array of V1Org.

Lists tenants for the specified organization ID. Use the `limit` and `page_token` query parameters to paginate through tenants. Required: org_id. Optional: limit, page_token. Returns array of V1Tenant.

Scan locally synced data for items that are missing important fields such as assignee, project, priority, or labels. Useful for triaging unowned work.

Join locally synced org subscriptions (licensed resource quantities) against per-tenant protected-resource counts and flag over- and under-provisioned tenants (run 'afi-cli fleet-sync' first). Only resource-kind subscription items are compared; storage and other quota kinds appear in 'tenant-scorecard'. Use this command to compare purchased subscription quantities against actually-protected resource counts. Do NOT use this command for raw subscription history; use 'orgs licensing get-subscription-history' instead.

Look up Afi objects in the local store by external ID (the stable M365/GWS identifier), Afi ID, or name/email substring. Afi's docs warn that names and emails are ambiguous keys, and one external ID can map to several per-region Afi tenants (Multi-Geo) — every object sharing the identifier is returned. Use this command to find the Afi resource/tenant behind an M365/GWS ID, email, or name before an offboard or audit. Do NOT use this command to run the offboard itself; use 'offboard' instead. Do NOT use this command for free-text search across all synced fields; use 'search' instead.

Full-text search across all synced data. Faster than paginating list endpoints. Requires sync first.

Run read-only SQL against local database. Use for ad-hoc analysis, aggregations, and joins across synced resources. Requires sync first.

Scan locally synced data for items that have not been updated within the specified number of days. Useful for identifying forgotten or blocked work.

Sync data from the API into a local SQLite database. Supports resumable incremental sync (only fetches new data since last sync) and full resync. Once synced, use the 'search' command for instant full-text search. Exit codes & warnings: Resources the API denies access to (HTTP 403, or HTTP 400 with an access-policy body) are reported as warnings rather than failing the run. In --json mode each is emitted as a {"event":"sync_warning",...} line carrying status, reason, and message fields, and a final {"event":"sync_summary",...} aggregates the run. Exit 0 when at least one resource synced and no resource flagged in the spec as critical (x-critical: true) failed; non-critical failures emit {"event":"sync_warning","reason":"exit_policy_default_changed", ...} so callers can detect that a partial failure was tolerated. Pass --strict to exit non-zero on any per-resource failure. Exit is always non-zero when every selected resource failed, regardless of --strict. Resource scoping: --resources runs the named top-level resources, plus any parent-keyed dependent whose own name is listed OR whose parent table is listed. Naming a parent therefore cascades to its dependents (so "sync this parent and its children" works without listing every nested resource by hand). There is no flag today to suppress the cascade for a named parent. To run a dependent without re-syncing its parent, list only the dependent by name; the parent table must already be populated from a prior sync.

Tail streams live data changes by polling the API at configurable intervals. Events are emitted as NDJSON to stdout for piping to other tools. Gracefully shuts down on SIGTERM/SIGINT. Note: For APIs with WebSocket or SSE support, a future version will use native streaming instead of polling.

Roll up locally synced resources, protections, policies, archives, quotas, and the task-status snapshot for one tenant into a single posture card (run 'afi-cli fleet-sync' first). Use this command for one tenant's full backup posture (coverage %, last run, quota, archive age). Do NOT use this command for the all-tenants rollup; use 'fleet-health' instead.

List and delete archives for tenants

Schedules the archive for deletion. The default delay is 7 days, during which the deletion can be canceled. Required: tenant_id, id, reason. Returns the ArchivesDeleteResponse. Destructive.

Retrieves the archives for the specified tenant and, optionally, for the specified resource in this tenant. Required: tenant_id. Optional: resource_id, limit, page_token. Returns array of V1Archive.

List audit for tenants

Retrieves audit events for the specified tenant. Use the `limit` and `page_token` query parameters to paginate through all events. Required: tenant_id. Optional: limit, page_token, start_time (plus 1 more). Returns array of V1AuditEvent.

Retrieves a tenant by its ID. Required: id. Returns the V1Tenant.

Update jobs for tenants

Triggers an out-of-schedule job execution, spawns a task, and returns its ID. Required: tenant_id, job_id.