PowerShell Exec MCP Server

Instructions

Creates a PowerShell remediation script that follows Microsoft Intune best practices:
- Proper exit codes (0=success, 1=failure, 2=error)
- Event log integration for monitoring and troubleshooting
- System restore point creation before making changes
- Comprehensive error handling and logging
- No user interaction (required for Intune deployment)

⚠️  IMPORTANT: For complete Intune compliance, you need BOTH detection and remediation scripts.
Consider using 'generate_intune_script_pair' instead to create both scripts together.

Microsoft References:
- Intune Remediation Scripts: https://docs.microsoft.com/en-us/mem/intune/fundamentals/remediations
- Best Practices: https://docs.microsoft.com/en-us/mem/intune/fundamentals/remediations-script-samples
- PowerShell Script Requirements: https://docs.microsoft.com/en-us/mem/intune/apps/intune-management-extension
- Exit Code Standards: https://docs.microsoft.com/en-us/mem/intune/apps/troubleshoot-mam-app-installation#exit-codes

Args:
    description: Clear description of what the script should remediate (e.g., 'Install Chrome browser', 'Configure Windows firewall')
    remediation_logic: PowerShell code that performs the remediation. Use 'Complete-Remediation -Success $true -Message "description"' to indicate completion
    output_path: Optional file path where the script will be saved. If not provided, returns script content
    timeout: Command timeout in seconds (1-300, default 60)
    
Returns:
    Generated script content or path where script was saved
    
Example:
    Generate a script to install Chrome:
    ```
    result = await generate_intune_remediation_script(
        description="Install Chrome browser to latest version",
        remediation_logic='''
        $installer = "$env:TEMP\ChromeSetup.exe"
        Invoke-WebRequest -Uri "https://dl.google.com/chrome/install/latest/chrome_installer.exe" -OutFile $installer
        Start-Process -FilePath $installer -Args "/silent /install" -Wait
        Remove-Item $installer -Force
        Complete-Remediation -Success $true -Message "Chrome installation completed successfully"
        ''',
        output_path="remediate_chrome.ps1"
    )
    ```
    
Tips:
    - Always use Complete-Remediation function to set proper exit codes
    - Test your remediation_logic in a safe environment first
    - Consider creating a system restore point for major changes
    - Use Write-IntuneLog for detailed logging and troubleshooting
    - Ensure no user interaction is required (scripts run silently)

Implementation Reference

• src/server.py:389-457 (handler)

  The core handler function implementing the 'generate_intune_remediation_script' MCP tool. It prepares template parameters based on user inputs (description, remediation_logic, etc.) and delegates to the shared generate_script_from_template helper using the specific 'intune_remediation' template for Intune best practices.

  @mcp.tool()
  async def generate_intune_remediation_script(
      description: str,
      remediation_logic: str,
      output_path: Optional[str] = None,
      timeout: Optional[int] = 60
  ) -> str:
      """Generate a Microsoft Intune remediation script with enterprise-grade features.
      
      Creates a PowerShell remediation script that follows Microsoft Intune best practices:
      - Proper exit codes (0=success, 1=failure, 2=error)
      - Event log integration for monitoring and troubleshooting
      - System restore point creation before making changes
      - Comprehensive error handling and logging
      - No user interaction (required for Intune deployment)
      
      ⚠️  IMPORTANT: For complete Intune compliance, you need BOTH detection and remediation scripts.
      Consider using 'generate_intune_script_pair' instead to create both scripts together.
      
      Microsoft References:
      - Intune Remediation Scripts: https://docs.microsoft.com/en-us/mem/intune/fundamentals/remediations
      - Best Practices: https://docs.microsoft.com/en-us/mem/intune/fundamentals/remediations-script-samples
      - PowerShell Script Requirements: https://docs.microsoft.com/en-us/mem/intune/apps/intune-management-extension
      - Exit Code Standards: https://docs.microsoft.com/en-us/mem/intune/apps/troubleshoot-mam-app-installation#exit-codes
      
      Args:
          description: Clear description of what the script should remediate (e.g., 'Install Chrome browser', 'Configure Windows firewall')
          remediation_logic: PowerShell code that performs the remediation. Use 'Complete-Remediation -Success $true -Message "description"' to indicate completion
          output_path: Optional file path where the script will be saved. If not provided, returns script content
          timeout: Command timeout in seconds (1-300, default 60)
          
      Returns:
          Generated script content or path where script was saved
          
      Example:
          Generate a script to install Chrome:
          ```
          result = await generate_intune_remediation_script(
              description="Install Chrome browser to latest version",
              remediation_logic='''
              $installer = "$env:TEMP\\ChromeSetup.exe"
              Invoke-WebRequest -Uri "https://dl.google.com/chrome/install/latest/chrome_installer.exe" -OutFile $installer
              Start-Process -FilePath $installer -Args "/silent /install" -Wait
              Remove-Item $installer -Force
              Complete-Remediation -Success $true -Message "Chrome installation completed successfully"
              ''',
              output_path="remediate_chrome.ps1"
          )
          ```
          
      Tips:
          - Always use Complete-Remediation function to set proper exit codes
          - Test your remediation_logic in a safe environment first
          - Consider creating a system restore point for major changes
          - Use Write-IntuneLog for detailed logging and troubleshooting
          - Ensure no user interaction is required (scripts run silently)
      """
      params = {
          "SYNOPSIS": f"Intune Remediation Script - {description}",
          "DESCRIPTION": description,
          "DATE": datetime.now().strftime('%Y-%m-%d'),
          "REMEDIATION_LOGIC": remediation_logic
      }
      
      if output_path:
          output_path = ensure_directory(output_path)
      
      return await generate_script_from_template("intune_remediation", params, output_path, timeout)

• src/server.py:148-186 (helper)

  Shared helper tool used by generate_intune_remediation_script (and others) to load a named PowerShell template from TEMPLATES_DIR, perform parameter substitution, optionally save to output_path, and return the generated script content.

  @mcp.tool()
  async def generate_script_from_template(
      template_name: str,
      parameters: Dict[str, Any],
      output_path: Optional[str] = None,
      timeout: Optional[int] = 60
  ) -> str:
      """Generate a PowerShell script from a template.
      
      Args:
          template_name: Name of the template to use (without .ps1 extension)
          parameters: Dictionary of parameters to replace in the template
          output_path: Where to save the generated script (optional)
          timeout: Command timeout in seconds (1-300, default 60)
          
      Returns:
          Generated script content or path where script was saved
      """
      template_path = os.path.join(TEMPLATES_DIR, f"{template_name}.ps1")
      if not os.path.exists(template_path):
          raise ValueError(f"Template {template_name} not found")
          
      with open(template_path, 'r') as f:
          template_content = f.read()
          
      # Replace template variables
      script_content = template_content
      parameters['DATE'] = datetime.now().strftime('%Y-%m-%d')
      
      for key, value in parameters.items():
          script_content = script_content.replace(f"{{{{{key}}}}}", str(value))
          
      if output_path:
          with open(output_path, 'w') as f:
              f.write(script_content)
          return f"Script generated and saved to: {output_path}"
      
      return script_content

• src/server.py:306-316 (helper)

  Helper utility called by generate_intune_remediation_script to normalize and ensure the output directory exists before writing the generated script file.

  @mcp.tool()
  def ensure_directory(path: str) -> str:
      """Ensure directory exists and return absolute path."""
      abs_path = normalize_path(path)
      if os.path.splitext(abs_path)[1]:  # If path has an extension
          dir_path = os.path.dirname(abs_path)
      else:
          dir_path = abs_path
      os.makedirs(dir_path, exist_ok=True)
      return abs_path

• src/server.py:389-389 (registration)

  The @mcp.tool() decorator registers the generate_intune_remediation_script function as an MCP tool with FastMCP.

  @mcp.tool()