Entrapulse Polyarchy

Please install the `entrapulse-polyarchy` MCP server into my current AI client (that's you).

Required prerequisites (do these first if not already done):
- **Node.js and npm** — Install Node.js so the server can be launched via npx. (https://nodejs.org/)
- **Microsoft Entra ID / Microsoft Graph access** — You need access to a Microsoft Entra ID tenant. By default the server uses interactive sign-in with Microsoft's first-party Graph Command Line Tools public client, so no app registration is needed for most tenants.

Optional prerequisites:
- Optional: bring your own Entra app registration — Needed for hardened tenants or if you want to use your own app in interactive or device-code modes. Register an app, add the portless redirect URI http://localhost, optionally enable public client flows for device code, add delegated Microsoft Graph permissions User.Read.All, Group.Read.All, RoleManagement.Read.Directory, and Application.Read.All, then grant admin consent.

Canonical MCP server config (stdio transport):
- command: `npx`
- args: ["-y","entrapulse-polyarchy"]
- optional environment variables:
  - `TENANT_ID`: Microsoft Entra tenant ID. Optional for default interactive auth, but useful to pin sign-in to a specific tenant. Required together with CLIENT_ID for bring-your-own app interactive/device-code auth, and required for app-only auth. (example: `<your-tenant-guid>`)
  - `CLIENT_ID`: App registration client ID. Optional in default interactive mode because the server can use Microsoft's first-party Graph Command Line Tools client. Required with TENANT_ID for bring-your-own app interactive/device-code auth, and required for app-only auth. (example: `<your-app-registration-client-id>`)
  - `CLIENT_SECRET`: App registration client secret for app-only authentication. Required only for app-only mode; when used, you must also set TENANT_ID and CLIENT_ID. (example: `<your-client-secret>`)
  - `USE_DEVICE_CODE`: Set to true to use device-code authentication instead of browser-based interactive sign-in. Common for headless or SSH environments. (example: `true`)
  - `USE_CLIENT_TOKEN`: Set to true to use a bearer token supplied by the MCP client via the set-access-token tool instead of the server acquiring its own token. (example: `true`)
  - `ACCESS_TOKEN`: Optional initial Microsoft Graph bearer token when using client-provided token mode. (example: `<your-access-token>`)
  - `POLYARCHY_DISABLE_TOKEN_CACHE`: Set to true to disable OS-keychain token persistence. (example: `true`)
  - `POLYARCHY_AUTH_RECORD`: Path to the persisted sign-in record file. Delete the file at this path to force a fresh sign-in. (example: `<path-to-auth-record.json>`)

Note: Default auth mode is interactive sign-in on first tool call, with no env vars required. In app-only mode there is no /me context, so callers must provide a person to visualize-identity or polyarchy-report. The README only documents stdio launch via npx.

Add this MCP server to my current client's config in the correct format for you. If you need secrets or credentials I haven't provided, ASK me — do not invent values or leave raw placeholders. After adding it, tell me how to verify the server is connected.