# Intellify Remote Power BI MCP Server

Production-oriented remote semantic-model engineering for Microsoft Fabric and Power BI. The target system lets authorized AI agents inspect, query, create, modify, validate, refresh, and manage eligible cloud semantic models through stateless Streamable HTTP.

The repository is being delivered phase by phase according to [`implementation.md`](implementation.md). Phases 0–6 establish the engineering foundation, secure remote boundary, provider and definition engines, reads, transactional and advanced authoring, lifecycle operations, agent-safe planning, resilience, and recovery. Phase 7 adds enterprise security, privacy, distributed observability, append-only audit, alerting, and service management. Hosted Render and live tenant certification remain explicit Phase 8 release gates.

## Current status

- Secure MCP 2026-07-28 Streamable HTTP control plane on Node.js 24 LTS.
- Tenant-specific Entra token validation, downstream OBO/workload token providers, encrypted partitioned cache, and authorization policy.
- Internal .NET 10 XMLA adapter trust contract with workload JWT authentication and short-lived execution-grant validation.
- Fixed-origin, retry-budgeted Fabric and Power BI REST clients with explicit long-running-operation handles and typed provider errors.
- Unknown-preserving TMSL definition engine with bounded decoding, immutable transformations, canonical indexes, versioned fingerprints, semantic diffing, and golden fixtures.
- Five policy-filtered MCP read tools for discovery, capability resolution, inspection, definition retrieval, DAX/INFO queries, and durable operation status.
- Three policy-filtered authoring tools for immutable planning, validation/approval, and apply, covering core model, table, column, measure, and relationship lifecycle changes.
- Advanced typed authoring for hierarchies, calculation groups/items, partitions, roles and table permissions, perspectives, named expressions, cultures, translations, and extended table/column/relationship metadata.
- Transactional-by-default model/table/partition refresh, Fabric model lifecycle, exact-target hard deletion, ownership-checked connection binding, and bounded administrative diagnostics.
- Per-model leases, idempotency, stale-base checks, ETag operation transitions, encrypted prechange snapshots, semantic verification, reconciliation, and compensation.
- Internal TOM transactional read/write, TMDL conversion, ADOMD.NET DAX/MDX/DMV/schema readers, restricted traces, and an authenticated versioned TypeScript client.
- Typed Arrow and JSON normalization with LZ4 support, deterministic row/byte/time limits, private expiring artifacts, and horizontally durable read-operation state.
- Strict domain, application, and contract boundaries.
- JSON/SSE, query cancellation/truncation, two-replica state, malformed-input, authorization, redaction, and official MCP Inspector tests.
- Credential-gated Fabric, Power BI, XMLA, OBO, and delegated-RLS integration harnesses.
- Active W3C traces, Azure Monitor OpenTelemetry, safe service metrics, HMAC-pseudonymized append-only audit, dashboards, alerts, SLOs, and operational runbooks.
- Private Azure networking, hardened Storage, Key Vault, managed identity, Container Apps, Container Registry, and monitoring IaC.
- Pull-request CI, CodeQL, dependency and Trivy scanning, image SBOMs, and release-metadata automation.

See [`docs/evidence/phase-7/validation-status.md`](docs/evidence/phase-7/validation-status.md) for the current gate status, [`docs/api/semantic-model-write-tools.md`](docs/api/semantic-model-write-tools.md) for the authoring contract, and [`docs/api/semantic-model-operations.md`](docs/api/semantic-model-operations.md) for operational actions. Credential-gated cloud and deployment tests are pending evidence, not passes.

## Prerequisites

- Node.js `24.14.0`
- pnpm `11.25.0` through Corepack
- .NET SDK `10.0.400` or Docker
- Docker for final Linux-image validation
- Azure CLI with Bicep for infrastructure compilation

## Local validation

```powershell
corepack pnpm install --frozen-lockfile
corepack pnpm ci:typescript
dotnet restore PowerBi.RemoteMcp.slnx
dotnet build PowerBi.RemoteMcp.slnx --configuration Release --no-restore
dotnet run --project apps/xmla-adapter/tests/PowerBi.XmlaAdapter.UnitTests --configuration Release --no-build
dotnet run --project apps/xmla-adapter/tests/PowerBi.XmlaAdapter.IntegrationTests --configuration Release --no-build
```

If .NET 10 is not installed locally, run the .NET checks through the pinned SDK container as described in [`docs/architecture/development-workflow.md`](docs/architecture/development-workflow.md).

## Local application

Build and start the TypeScript control plane:

```powershell
corepack pnpm build
corepack pnpm start:mcp
```

- TypeScript health: `GET http://localhost:3000/health/live`
- TypeScript readiness: `GET http://localhost:3000/health/ready`
- OAuth resource metadata: `GET http://localhost:3000/.well-known/oauth-protected-resource`
- Secure MCP: `POST http://localhost:3000/mcp`
- .NET container health: `GET http://localhost:8080/health/live`

The default development process generates an unlogged random MCP token and therefore denies callers unless `MCP_DEVELOPMENT_TOKEN` is explicitly set. Development authentication cannot start outside the development environment. See [`docs/api/mcp-client-configuration.md`](docs/api/mcp-client-configuration.md) and [`docs/security/entra-application-registration.md`](docs/security/entra-application-registration.md).

Semantic-model writes are also disabled by default. Do not enable `WRITE_MODEL_ENABLED` until the private adapter audience, execution-grant key pair, 32-byte approval/snapshot and audit-hashing keys, durable append-only audit, durable state storage, workload identity, and target/risk authorization policy are configured. See [`docs/architecture/semantic-write-safety.md`](docs/architecture/semantic-write-safety.md) and the [`live XMLA gate`](docs/evidence/phase-4/live-xmla-integration.md).

## Security

Do not place credentials, access tokens, connection strings, model definitions, or query results in source control or issues. Read [`SECURITY.md`](SECURITY.md), the [`threat model`](docs/security/threat-model.md), and the [`privacy and LLM data-handling guidance`](docs/security/privacy-and-llm-data-handling.md) before adding an integration.