Files

Mike Swanson f55b8d2556 docs: purge stale fabb3421 narrative — Mail.Send already lives in the 365 app suite

Mail.Send is NOT an open decision or a 'blocked' item: the Exchange Operator
tier (b43e7342) already holds Graph Mail.Send + Mail.ReadWrite +
MailboxSettings.ReadWrite (the suite's IR victim-notification mail path).
/mailbox (ACG own-mail) separately uses the dedicated ComputerGuru Mailbox app
1873b1b0. The deleted fabb3421/Claude-MSP-Access app is now referenced only as
DELETED/do-not-use across all live surfaces.

Corrected: remediation-tool gotchas.md (removed 'suite has no mail scopes /
mailbox BLOCKED / decision-not-executed'), commands/mailbox.md (header +
Attribution no longer name the deleted app as active), feedback memory
(promoted 'suite has Mail.Send — settled' to a headline), breach-report
template, .grok mirrors, credentials.md, CATALOG_SHARED_DATA.md, and wiki
(internal-infrastructure, glaztech, dataforth). Removed dead plaintext secret
for the deleted app from CATALOG_SHARED_DATA.md.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-21 09:46:54 -07:00

2.0 KiB

Raw Blame History

name, description

name	description
remediation-tool	M365 tenant investigation and remediation using the ComputerGuru tiered MSP app suite (Security Investigator, Exchange Operator, User Manager, Tenant Admin, Defender Add-on). Gated writes. Use when the user says "remediation tool", "365 remediation", "check <user> mailbox", "breach check", "tenant sweep", "inbox rules for <user>", or any M365 Graph/Exchange admin task.

/remediation-tool — M365 Investigation & Remediation

Grok skill for the shared command. Full details, safety gates, and the 5-app suite description are in .claude/commands/remediation-tool.md and the implementation in .claude/skills/remediation-tool/.

Important posture (from CLAUDE.md and the skill):

Read-only by default.
All write/remediation actions are gated behind explicit --confirm or user approval.
Use the skill's structured flows for tenant sweeps, password spray detection, inbox rule enumeration, mailbox searches, etc.
NOT for CIPP — this is the direct Graph API tiered app suite (Security Investigator / Exchange Operator / User Manager / Tenant Admin / Defender). The old single fabb3421/Claude-MSP-Access app was DELETED 2026-06-14 — do not reference it. Mail.Send lives in the Exchange Operator tier (b43e7342).

When invoked:

Read the command doc .claude/commands/remediation-tool.md.
Read the full skill .claude/skills/remediation-tool/SKILL.md (it has the detailed model).
Use tools to run the underlying Python/Graph scripts (via run_terminal_command after activating the right env/venv if needed).
For any credential or token work, go through the vault or 1password skill.
Follow all compliance/audit logging requirements in the skill.

This is heavily used in remediation mode. The skill itself is already a proper SKILL.md, so this Grok wrapper mainly ensures /remediation-tool shorthand works and points to the source.

See the remediation-tool skill directory for the actual implementation scripts and rules.

2.0 KiB Raw Blame History

/remediation-tool — M365 Investigation & Remediation

2.0 KiB

Raw Blame History