How do I use adds-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@adds-mcp list all locked out users" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

adds-mcp

by Chiefff-Kiefff

Overview Schema Related Servers Score Discussions

Python

Remote

hg-directory-mcp

A pair of read-only MCP servers for monitoring and investigation of a Microsoft directory + PKI environment:

Server	Purpose	Data sources	Default port
`adds-mcp`	Active Directory Domain Services (users, groups, OUs, computers, GPOs, domain metadata)	LDAPS to any DC	8080
`adcs-mcp`	Active Directory Certificate Services (CAs, templates, trust anchors, issued certs)	LDAPS (AD PKI subtree) + WinRM to each online issuing CA	8081

Both servers refuse to mutate anything: adds-mcp opens LDAP with read_only=True and neither exposes any tool that accepts a write. adcs-mcp runs only Get-* and read-only registry reads on the CA hosts.

`adds-mcp` — Active Directory

35 read-only tools grouped by object type:

Domain	Tools
Users	`search_users`, `get_user`, `list_user_groups`, `list_locked_out_users`, `list_disabled_users`, `list_stale_users`, `list_recently_changed_users`, `list_password_never_expires`
Groups	`search_groups`, `get_group`, `list_group_members` (direct or recursive), `list_empty_groups`, `list_privileged_groups`
OUs	`list_ous`, `get_ou`, `list_ou_children`, `get_ou_tree` (nested hierarchy)
Computers	`search_computers`, `get_computer`, `list_domain_controllers`, `list_stale_computers`, `summarize_computer_os`
Group Policy Objects	`list_gpos`, `get_gpo`, `find_gpo_links`, `list_links_on_ou`
Domain / directory	`get_domain_info`, `get_password_policy`, `list_fine_grained_password_policies`, `list_fsmo_roles`, `list_trusts`, `list_sites`
Escape hatch	`ldap_search` (raw filter), `get_object_by_dn`, `count_objects`

Every attribute is decoded before it leaves the tool: SIDs, GUIDs, FILETIMEs, userAccountControl, groupType, tick-interval durations, and gPLink.

Related MCP server: BloodyAD MCP

`adcs-mcp` — Active Directory Certificate Services

Tools are split by data source. AD-side tools work as soon as you have LDAPS to any DC and the ADDS_* vars set. WinRM-side tools additionally require the ADCS_* vars and WinRM listeners on each issuing CA.

AD-side (LDAPS to `CN=Public Key Services,CN=Configuration,DC=...`)

Tool	Description
`list_enrollment_services`	Every Enterprise CA published in the domain
`get_enrollment_service`	Detailed attributes for a single Enterprise CA
`list_root_cas`	Root CA certificates published as trust anchors
`list_ntauth_cas`	Contents of `CN=NTAuthCertificates` (CAs trusted for AD auth)
`list_certificate_templates`	All templates, with flag decoding
`get_certificate_template`	One template by displayName / cn / OID / DN
`list_templates_by_eku`	Templates that include a given EKU OID
`find_templates_offered_by_ca`	Templates a specific Enterprise CA is configured to issue
`list_aia_entries`	Authority Information Access entries in AD
`list_cdp_entries`	CRL Distribution Points and published CRLs in AD
`list_kra_certificates`	Key Recovery Agent certificates in AD
`list_pki_oids`	Custom OIDs registered under `CN=OID`

WinRM-side (PowerShell / PSPKI on each online issuing CA)

Tool	Description
`list_issued_certificates`	Certificate DB rows with disposition = issued
`list_pending_requests`	Requests awaiting officer approval
`list_failed_requests`	Failed / denied requests
`list_revoked_certificates`	Revoked entries
`get_certificate_by_serial`	Full row + raw cert for a single serial
`count_certificates_by_disposition`	Grouped counts across the CA DB
`get_ca_configuration`	CRL/AIA/CDP settings, allowed templates, publication URIs
`list_ca_role_holders`	CA ACL decoded (CA Admins, Certificate Managers, Auditors, …)
`list_officer_rights`	Per-template certificate manager rights
`get_ca_certificate_chain`	The CA's own certificate chain (PEM)
`list_ca_backup_settings`	Registry-level CA config from `HKLM\...\CertSvc\Configuration`

Standalone

Tool	Description
`parse_certificate_pem`	Decode any PEM or base64 DER cert into JSON (SAN, EKU, key usage, chain)

3-tier PKI notes

Tier 0 (offline Root) and Tier 1 (offline Policy) aren't queried directly — there's no live endpoint. Use parse_certificate_pem to inspect any offline root/intermediate cert or CRL you export from them, and cross-reference them with list_ntauth_cas / list_aia_entries / list_root_cas to verify the domain still trusts them.
Tier 2 (online Issuing CAs) are the target of the WinRM-backed tools. Provide their hostnames in ADCS_CA_HOSTS and grant the WinRM service account read rights to the CA (typically membership in the CA's built-in Auditor role on each issuing CA).

Requirements

Python 3.11+
LDAPS reachable from wherever the servers run
For adcs-mcp: WinRM 5986 (HTTPS) reachable to each entry in ADCS_CA_HOSTS, plus a WinRM service account with read rights on the CA

Configuration

Configuration is loaded from environment variables (.env supported). See .env.example for the full list.

ADDS_* variables are read by both servers (they share the LDAPS bind). ADCS_* variables are read only by adcs-mcp.

Running

Install the package (add [adcs] extra for WinRM support):

pip install -e .            # adds-mcp only
pip install -e ".[adcs]"    # adds-mcp + adcs-mcp

Run either server:

adds-mcp    # HTTP :8080, endpoint /mcp
adcs-mcp    # HTTP :8081, endpoint /mcp

Docker (two separate images):

docker build -t adds-mcp -f Dockerfile      .
docker build -t adcs-mcp -f Dockerfile.adcs .

docker run --rm -p 8080:8080 --env-file .env adds-mcp
docker run --rm -p 8081:8081 --env-file .env adcs-mcp

Repository layout

src/
  adds_mcp/          # AD DS server
    __init__.py
    config.py
    client.py        # ldap3 wrapper, read_only=True, filter/DN escaping
    formatting.py    # SID/GUID/FILETIME/UAC/groupType decoders
    server.py
    tools/           # users, groups, ous, computers, gpos, domain, search

  adcs_mcp/          # ADCS server (reuses adds_mcp.client for LDAPS)
    __init__.py
    config.py
    ldap_source.py   # Points reused ldap client at CN=Public Key Services
    winrm_source.py  # pypsrp WinRM PowerShell runner (optional)
    cert_utils.py    # X.509 parsing (cryptography)
    server.py
    tools/           # cas, templates, trust, issued, admin, parsing

This server cannot be installed

license - not found

quality - not tested

maintenance

How are these scores calculated?

Maintenance

–Maintainers

–Response time

–Release cycle

–Releases (12mo)

Commit activity

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

MCP Microsoft Graph Server
Cloud Platforms Security
tcpatter
-
license
-
quality
-
maintenance
Provides secure access to Microsoft Entra ID (Azure AD) resources including users, devices, and applications through Microsoft Graph API. Enables querying organizational data with comprehensive audit logging to Azure Blob Storage.
Last updated 2025-08-07
BloodyAD MCP
Security Penetration Testing OS Automation
dcollaoa
A
license
-
quality
C
maintenance
Enables Active Directory enumeration and abuse operations through the bloodyAD tool. Supports LDAP queries, user/group management, DNS operations, and security testing directly from AI assistants.
Last updated 2025-09-27
16
MIT
mcp-activedirectory
Security Databases
fredriksknese
F
license
A
quality
C
maintenance
Provides AI assistants with unified access to on-prem Active Directory via LDAP and Azure AD / Entra ID through the Microsoft Graph API. It enables comprehensive management and search of users, groups, computers, and cloud devices using 18 specialized tools.
Last updated 2026-05-29
18
Koppla
Security Search
ruudmens
A
license
-
quality
D
maintenance
Enables managing Active Directory users, groups, and computers using natural language, with support for queries and updates.
Last updated 2025-04-14
55
MIT

View all related MCP servers

Related MCP Connectors

data-breach-detector
Read-only breach intelligence from public feeds: reports THAT a domain leaked, never the data.
DERO MCP Server
Read-only DERO blockchain MCP: 33 tools (12 composites) incl. TELA discovery + bundled docs.
WHOIS
Query WHOIS/RDAP information for domains, IP addresses, CIDR prefixes and ASNs. Self-hostable.

View all MCP Connectors

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Chiefff-Kiefff/adds-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server