Libre DevOps Helpers

ldo: importable Python helpers and a fast CLI for day-to-day DevOps and security work.

ldo is a fast, read-only command line for day-to-day security and platform work across Microsoft (Entra ID, Defender XDR, Intune, Azure, Graph, PIM, Logic Apps) and ServiceNow. It signs in as you, through the Azure CLI by default, and can read only what you can. The Python sibling of the LibreDevOpsHelpers PowerShell module, and importable as a library too.

Commands

Every command takes -p for a profile and -o table|json|csv|tsv, lists take --sort and --unique by column, and lists of names come from arguments, stdin, a text file, or a column of a CSV or Excel workbook.

Install

From PyPI:

uv tool install libre-devops-helpers     # the ldo command, in an environment of its own
pipx install libre-devops-helpers        # the same, with pipx
uv pip install libre-devops-helpers      # into the current environment, to use it as a library
pip install libre-devops-helpers         # the same, with pip
uv tool upgrade libre-devops-helpers     # later, to the newest release

Add the keychain extra ("libre-devops-helpers[keychain]") to keep sign-ins in the macOS Keychain or the Linux Secret Service. A tagged release installs straight from GitHub too: uv tool install git+https://github.com/libre-devops/python-helpers@v0.5.2.

Or run the container image, which has the Azure CLI inside: podman run --rm -it ghcr.io/libre-devops/python-helpers:latest --help (see Container images). Each release is also in the GitLab copy's package and container registries (how).

Quickstart

az login                        # the default sign-in is the Azure CLI's
ldo config init                 # write ~/.config/ldo/config.toml
$EDITOR "$(ldo config path)"    # put your tenant id in a profile
ldo profiles                    # your profiles, and whether each can sign in

Then:

ldo devices check web01,web02                        # in Entra and onboarded to Defender?
ldo devices check -f plan.xlsx --column FQDN --tag linux-servers
ldo devices av-signature web01                       # Defender Antivirus versions
ldo entra devices -f plan.xlsx --column FQDN --group "MDE Pilot Devices"
ldo azure automation logs aa-ops --runbook Rotate-Keys    # the newest run's logs
ldo graph get-device web01
ldo xdr alerts --since 24h --severity high
ldo azure resource-graph "resources | summarize count() by type"
ldo keyvault expiry kv-app-prd --within 30d

Incidents, Graph hunting and PIM for Entra roles need scopes the Azure CLI's token never has: sign in through your own app registration for those. Permissions lists what each command needs.

Documentation

• Configuration: profiles, common options, environment variables, exit codes
• Proxies and certificates: corporate proxies, cntlm, TLS inspection
• Signing in and Permissions
• Container images
• Using it as a library and Rebranding for your organisation
• Development: just recipes, tests, CI and releasing
• AI.md: the instructions for AI coding assistants (Claude Code, Copilot, Codex)

Contributions are welcome: see CONTRIBUTING.md, and SECURITY.md to report a vulnerability. Licensed under MIT.