`vulkro-sf org mfa`

Checks which integration profiles and admins in the live org are exempt from MFA.

vulkro-sf org mfa --target-org <alias>
vulkro-sf org mfa -o <alias> --format json

Finding	Severity	Meaning
`SF-MFA-001`	High	A standard integration profile is exempt from MFA.
`SF-MFA-002`	High	A System Administrator is exempt from MFA and has no SSO federation ID.
`SF-MFA-003`	Medium	An active login flow is bound to the System Administrator profile. Often on purpose; listed for review.

It reads the exemption settings. It cannot see whether a user registered an authenticator, or what an external identity provider enforces.