osint-mcp-server

m365_userrealm

Detect the authentication type for a domain's Microsoft 365 tenant, returning namespace type, federation brand, and authentication endpoints.

Instructions

Detect authentication type for a domain's Microsoft 365 tenant. Returns namespace type (Managed/Federated), federation brand name, and auth endpoints.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`domain`	Yes	Domain to check user realm for

Implementation Reference

src/m365/index.ts:57-83 (handler)

The core execution function for m365_userrealm. Calls Microsoft's getuserrealm.srf API to detect authentication type (Managed/Federated) for a domain. Returns namespace type, federation brand name, auth URLs, and cloud instance name.

export async function m365UserRealm(domain: string): Promise<M365UserRealmResult> {
  try {
    const res = await fetch(
      `https://login.microsoftonline.com/getuserrealm.srf?login=test@${encodeURIComponent(domain)}&json=1`,
    );
    if (!res.ok) return { domain, found: false };

    const data = await res.json();

    // NameSpaceType 0 = Unknown, 1 = Managed, 2 = Federated
    let namespaceType: string | undefined;
    if (data.NameSpaceType === "Managed" || data.NameSpaceType === 1) namespaceType = "Managed";
    else if (data.NameSpaceType === "Federated" || data.NameSpaceType === 2) namespaceType = "Federated";
    else if (data.NameSpaceType !== undefined) namespaceType = String(data.NameSpaceType);

    return {
      domain,
      found: namespaceType !== undefined,
      namespaceType,
      federationBrandName: data.FederationBrandName,
      federationActiveAuthUrl: data.AuthURL ?? data.STSAuthUrl,
      cloudInstanceName: data.CloudInstanceName ?? data.CloudInstanceIssuerUri,
    };
  } catch {
    return { domain, found: false };
  }
}

src/m365/index.ts:13-20 (schema)

Interface M365UserRealmResult defining the return type: domain, found, namespaceType, federationBrandName, federationActiveAuthUrl, cloudInstanceName.

interface M365UserRealmResult {
  domain: string;
  found: boolean;
  namespaceType?: string; // "Managed" or "Federated"
  federationBrandName?: string;
  federationActiveAuthUrl?: string;
  cloudInstanceName?: string;
}

src/protocol/tools.ts:448-455 (registration)

ToolDef registration for m365_userrealm. Defines name ('m365_userrealm'), description, schema (zod: domain string), and execute handler that calls m365UserRealm().

const m365UserRealmTool: ToolDef = {
  name: "m365_userrealm",
  description: "Detect authentication type for a domain's Microsoft 365 tenant. Returns namespace type (Managed/Federated), federation brand name, and auth endpoints.",
  schema: {
    domain: z.string().describe("Domain to check user realm for"),
  },
  execute: async (args) => json(await m365UserRealm(args.domain as string)),
};

src/protocol/tools.ts:528-528 (registration)
Tool registered in the allTools array export (line 528: m365UserRealmTool) that makes it available to the MCP server.
```
m365UserRealmTool,
```
src/index.ts:34-34 (registration)
Tool listed under 'Microsoft 365' category for CLI help/--list display (no API key required).
```
{ label: "Microsoft 365", env: null, tools: ["m365_tenant", "m365_userrealm"] },
```

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.2.0Mar 17, 2026

TDQS

B3.3/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral transparency. It describes the outputs (namespace type, federation brand, auth endpoints) but does not disclose any behavioral traits such as side effects, permissions required, error handling, or whether it performs network calls. The agent is left uninformed about potential risks or preconditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: a two-sentence structure that front-loads the purpose and then specifies the outputs. Every sentence adds value without redundancy or wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema, no annotations), the description provides the core information needed to invoke it. However, it lacks contextual depth such as usage guidance relative to siblings, error conditions, or behavioral details, which would make it more complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers the single parameter 'domain' with a description, and the tool's description does not add additional meaning beyond 'Domain to check user realm for', which is nearly identical to the schema's description. Since schema coverage is 100%, the baseline is 3, and no extra value is provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Detect authentication type for a domain's Microsoft 365 tenant.' It specifies the verb (detect) and the resource (authentication type of a domain's tenant). Additionally, it lists the specific outputs (namespace type, federation brand, auth endpoints), making it distinct from sibling tools like m365_tenant.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus alternatives (e.g., m365_tenant). It lacks explicit context or conditions for usage, nor does it mention when not to use it. The only implied usage is from the purpose itself, which is insufficient for effective decision-making.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.