BetterAzureMCP
BetterAzureMCP is a read-only MCP server that helps debug Azure applications from Copilot/VS Code by inspecting resources, health, logs, and telemetry.
Azure context & discovery: show sign-in/subscriptions, switch subscriptions/tenants, find resources by name/type/group/location/tag, get full resource definitions, and run KQL against Azure Resource Graph.
Health & change triage: check resource health and active service issues, list recent configuration changes with before/after values, review activity log for deployments/restarts/failures, and get platform metrics (CPU, memory, HTTP 5xx, latency).
Log & telemetry analysis: locate where telemetry goes (Log Analytics, App Insights, storage, Event Hubs), run KQL log queries, get Application Insights failure/triage summaries, and trace end-to-end transactions by operation ID.
App Service & Function Apps: overview state, runtime, plan, settings, logging, slots, deployments, functions; read app/platform log files; run built-in diagnostic detectors.
Container Apps: overview revisions, replicas, ingress, scale rules, containers; read console and system logs.
AKS: overview cluster state, node pools, networking, upgrades; inspect workloads, pods, events, deployments, and node health; read pod logs including previous crashed instances.
Privacy/read-only guarantees: write operations blocked, secrets masked, endpoint allowlist enforced, and output capped to avoid flooding context.
Provides read-only tools for inspecting Azure Kubernetes Service (AKS) clusters, including cluster state, node pools, workloads, events, and pod logs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@BetterAzureMCPwhy is orders-api returning 500s since this morning?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
BetterAzureMCP
A read-only Model Context Protocol server for Azure, built for one job: helping developers debug their Azure applications from GitHub Copilot, VS Code and other MCP clients.
Ask "why is orders-api returning 500s since this morning?" and the assistant can check resource health, recent configuration changes, failed deployments, Application Insights exceptions, container logs and pod restarts, without you opening the portal.
Stable. Every tool call has a hard deadline. Sign-in never waits on a hidden browser window. Nothing but protocol messages is written to stdout. No auto-updates and no runtime downloads.
Private. The server only talks to Azure's own API endpoints, enforced by an allowlist in code. No telemetry, no analytics, no third parties.
Read-only. Write operations are blocked at the HTTP layer, not just left out of the tool list. Values that look like secrets are masked before they leave the server.
Focused. 20 tools that cover the debugging path, instead of hundreds of per-service wrappers competing for the model's attention.
Contents
Related MCP server: azure-compliance-mcp
Quick start
You need Node.js 22 or later and an Azure login through the Azure CLI (az login), the Azure Developer CLI (azd auth login) or Azure PowerShell (Connect-AzAccount).
npm install -g betterazuremcp
az login
betterazuremcp doctordoctor checks the setup and tells you what to fix:
betterazuremcp 1.0.0 doctor
ok Node.js version: 22.22.2
ok Azure sign-in: dev@contoso.com (tenant 8a1c...e42f) via Azure CLI (az login)
ok Subscriptions: 3 accessible, 3 enabled
ok Azure Resource Graph: reachable, 412 resources indexedThen add the server to your client.
Client setup
Every client starts the server the same way: the command betterazuremcp, over stdio, with no arguments.
VS Code (GitHub Copilot)
Use the install button above, or add this to .vscode/mcp.json (or MCP: Open User Configuration for all workspaces):
{
"servers": {
"azure": {
"type": "stdio",
"command": "betterazuremcp"
}
}
}The tools are available in Copilot Chat in Agent mode.
GitHub Copilot Desktop
Open Settings (gear icon, bottom left) → MCP Servers → Add custom server.
Name:
azure. Transport:stdio. Command:betterazuremcp.Save. The server starts with the next chat.
Visual Studio, Copilot CLI, Claude Desktop and others are covered in docs/clients.md.
Tools
Finding things
Tool | What it does |
| Who you are signed in as, the directory, your subscriptions and the current subscription. Switches subscription or directory. |
| Finds resources by name, type, resource group, location or tag across all subscriptions. |
| KQL against Azure Resource Graph, for inventory questions across subscriptions. |
| The full definition of any resource by ID. |
What is wrong with this resource?
Tool | What it does |
| Azure's own view of the resource's availability, recent outages, and active service issues. |
| Configuration changes in the last 14 days, with before and after values and who made them. |
| Deployments, restarts, scaling and other operations, and why they failed. |
| Where the resource's logs go: workspaces, Application Insights, storage, Event Hubs, and which tables to query. |
| Platform metrics such as CPU, memory, HTTP 5xx, latency and restarts, summarized. |
Telemetry
Tool | What it does |
| KQL against a Log Analytics workspace, an Application Insights resource, or one resource's logs. |
| One-call triage: failure rate, failing operations, top exceptions, failing dependencies, slowest operations. |
| Every request, dependency call, exception and trace of one operation, in time order. |
Platforms
Tool | What it does |
| App Service and Function app state, runtime, plan, key settings, logging, slots, deployments, functions. |
| The latest application or platform log lines from the app's log files. |
| Azure's built-in "Diagnose and solve problems" detectors for App Service and Container Apps. |
| Container App revisions, replicas, restart counts, ingress, scale rules and containers. |
| Console and system logs of a Container App. |
| AKS cluster state, version and upgrades, node pools, networking and add-ons. |
| Failing pods, Warning events, unavailable deployments and unhealthy nodes, live from the cluster. |
| Pod logs, including the previous instance of a crashing container. |
Results start with a one-line summary followed by compact JSON, and are capped in size so they do not flood the model's context.
Things to ask:
"orders-api has been returning 500s since 9:00. Find out why."
"What changed in resource group rg-orders-prod in the last 24 hours?"
"Show the slowest operations of the checkout service this week and trace one of them."
"Why does the latest revision of the payments container app not become healthy?"
"Which pods in the shop namespace of aks-prod are crash-looping, and what do their logs say?"
Permissions
The server can only see what your account can see. Most tools work with the Reader role. A few need more:
Tools | Role needed |
All tools, at the scope you want to inspect | Reader |
| A role with |
| Azure Kubernetes Service Cluster User Role, plus read access inside the cluster (Azure Kubernetes Service RBAC Reader, or a Kubernetes |
When a role is missing, the tool says which one and suggests an alternative that works with Reader.
Current subscription
The server remembers the subscription and directory (Entra tenant) you worked in most recently, so the assistant does not have to ask where to look every time.
It follows your work. Whenever a tool reads a resource in a subscription, that subscription becomes the current one. Tools that need a scope, such as the activity log and recent changes, use it when you don't name another.
The assistant knows it. The current subscription is part of the server's instructions at the start of every session, and
azure_contextshows it.Switching is one sentence. "Switch to the Staging subscription" or "look in the fabrikam.onmicrosoft.com directory" makes the assistant call
azure_contextwith the new choice, which is then remembered.It survives restarts and stays local. The choice is stored in a small file in your user profile:
~/.local/state/betterazuremcp/context.jsonon Linux,~/Library/Application Support/betterazuremcp/on macOS,%APPDATA%\betterazuremcp\on Windows. It holds only IDs and display names. Delete it to forget, or setBETTERAZUREMCP_REMEMBER_CONTEXT=false.
If the remembered directory stops working for your login, for example after you sign in with another account, the server falls back to your default directory and forgets the old choice. BETTERAZUREMCP_TENANT_ID and BETTERAZUREMCP_SUBSCRIPTIONS always take precedence.
Configuration
Configuration is optional and done through environment variables. Most clients let you set them in the server entry ("env": { ... }).
Variable | Default | Description |
| tenant of your login | Tenant to sign in to. Set this if you have access to several tenants. |
|
|
|
|
| Deadline for a single tool call (5–600). |
|
| Size limit for a single tool result (2–256). |
| all accessible | Comma-separated subscription IDs. The server then reads only from these subscriptions, enforced for every request. |
|
| The server stops itself if it ever uses more memory than this. The client restarts it on the next call. |
|
| Remember the subscription and directory you worked in last. Set to |
| per-user app data folder | Where the remembered context is stored. |
|
| Set to |
|
|
|
Behind a corporate proxy, set HTTPS_PROXY (and NO_PROXY if needed).
Privacy and safety
Where data goes. Requests go only to Azure Resource Manager (
management.azure.com), the Log Analytics query API (api.loganalytics.io), your App Service apps' Kudu sites (*.scm.azurewebsites.net) and your AKS API servers (*.azmk8s.io). Any other host is refused before a request is made.What is sent. Only the Azure API calls needed to answer a tool call. There is no telemetry, crash reporting or update check.
What cannot happen.
PUT,PATCHandDELETEare blocked, and so is everyPOSTthat is not a known read. Kudu access is limited to log files, and Kubernetes access to pod, event, deployment and node status and pod logs. Secrets, config maps,execand calls such aslistKeysare blocked by the same rules.Prompt injection. Logs, messages and tags can contain text written by anyone. Results that carry such text are marked as untrusted, and text that reads like instructions to an AI assistant is flagged with a warning. The server limits what an injected instruction could achieve: it does not request secret values, cannot write, and can only reach Azure endpoints of resources you can already read.
What the AI sees. Your MCP client passes tool results to its language model. Values that look like secrets (passwords, keys, connection strings, SAS tokens) are masked first, and app setting values are not requested. Masking is pattern-based and cannot catch everything: logs and telemetry contain whatever your application wrote, so a secret your app logged in an unusual format can reach the model. Use an MCP client and model you trust with your logs.
The full model is in SECURITY.md. These are design properties backed by tests, not a warranty; see the license.
Troubleshooting
Start with betterazuremcp doctor. It checks sign-in, subscriptions and connectivity, and prints what to fix.
Symptom | Fix |
"Not signed in to Azure" | Run |
Signed in, but no subscriptions or 403 errors | You may be in the wrong tenant. Run |
The client cannot start | The client may not see your |
Timeouts on large queries | Narrow the query, or raise |
AKS tools cannot reach a private cluster | Private API servers are only reachable from their network. Use |
Server logs appear in your client's MCP output (in VS Code: MCP: List Servers → azure → Show Output). Set BETTERAZUREMCP_LOG_LEVEL=debug for more detail.
Building from source
git clone https://github.com/SH-G401/BetterAzureMCP.git
cd BetterAzureMCP
npm ci
npm run build
npm link # puts the `betterazuremcp` command on your PATHContributing
Issues and pull requests are welcome. See CONTRIBUTING.md for the development setup and ground rules, and docs/architecture.md for how the code fits together. The reasoning behind the design is in docs/RESEARCH.md and docs/PLAN.md, and docs/COMPLAINTS.md tracks user complaints about the official Azure MCP Server and what we do about each.
License
MIT. The npm package bundles open-source dependencies into a single file; their licenses are in dist/THIRD_PARTY_NOTICES.txt.
BetterAzureMCP is an independent project. It is not affiliated with, endorsed by or supported by Microsoft. Microsoft and Azure are trademarks of the Microsoft group of companies.
Available Tools
20 toolsazure_activity_logActivity logARead-onlyIdempotent
Lists control-plane operations from the Azure activity log: deployments, restarts, scaling, configuration updates, role assignments, and their failures, with the caller and error message. Scope it to a resource, a resource group or a whole subscription. Set onlyFailures to see only failed operations.
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | How many hours to look back (default 24, max 2160). | |
| limit | No | Maximum events (default 50). | |
| scope | Yes | Resource ID, resource group ID (/subscriptions/<id>/resourceGroups/<name>) or subscription ID path (/subscriptions/<id>). | |
| onlyFailures | No | Only return failed operations and errors. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so safety is covered. The description adds behavioral context about the content returned (caller and error message) and the scoping options, which goes beyond the structured fields. It does not mention pagination or error handling, but that is minor given the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no redundancy. The purpose is front-loaded in the first sentence, and the second adds actionable usage guidance. Every clause earns its place, making it an exemplar of concision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only log-listing tool, the description covers the essential aspects: what is returned, how to scope, and filtering. The lack of an output schema is partially mitigated by mentioning the caller and error message. It does not detail the event structure or pagination behavior, but these are either inferable or covered by parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description enhances meaning for 'scope' by explaining the three scoping levels, and for 'onlyFailures' by stating its purpose. This adds value over the schema, though it does not elaborate on 'hours' or 'limit' beyond their defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Lists') and resource ('control-plane operations from the Azure activity log'), and gives concrete examples (deployments, restarts, scaling, etc.) that make its purpose unmistakable. It also differentiates itself from sibling log tools by explicitly scoping to control-plane operations, which is distinct from data-plane logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: how to scope (resource, resource group, subscription) and how to filter (onlyFailures). However, it does not explicitly name alternatives or state when not to use this tool, leaving the differentiation to implication rather than direct guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_aks_overviewAKS cluster overviewARead-onlyIdempotent
Summarizes an AKS cluster from Azure Resource Manager: power and provisioning state, Kubernetes version and available upgrades, node pools (size, count, autoscaling, state), networking, identity and access mode, and enabled add-ons such as Container Insights. Also tells whether azure_aks_workloads and azure_aks_pod_logs can reach this cluster.
| Name | Required | Description | Default |
|---|---|---|---|
| clusterId | Yes | Resource ID of a Microsoft.ContainerService/managedClusters AKS cluster. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnly/openWorld/idempotent behavior. The description adds valuable behavioral context by specifying what aspects are summarized and by disclosing that it reports reachability for azure_aks_workloads and azure_aks_pod_logs. This goes well beyond the annotations and helps the agent understand what to expect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both of which earn their place. The first is dense but organized and front-loaded with the primary purpose; the second adds a unique capability that is important for tool selection among siblings.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only overview tool with one well-documented parameter and strong annotations, the description is complete. It lists the categories of information returned and includes the cross-tool reachability detail, so an agent has enough context to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% coverage for the single clusterId parameter, including its meaning as a Resource ID. The description adds no additional parameter-level detail beyond mentioning that the summary comes from Azure Resource Manager, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool summarizes an AKS cluster and enumerates the exact information it covers: power and provisioning state, Kubernetes version and upgrades, node pools, networking, identity, and add-ons. This distinguishes it from generic get_resource tools and from sibling tools like azure_aks_workloads and azure_aks_pod_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes the tool's scope evident: use it for a high-level overview of an AKS cluster and to check whether related workload/log tools can reach that cluster. It doesn't explicitly state when not to use it or name alternatives, but the context is clear enough given the sibling tool list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_aks_pod_logsAKS pod logsARead-onlyIdempotent
Reads the last log lines of a pod container in an AKS cluster through the Kubernetes API (read-only). Set previous to true to read the logs of the previous, crashed instance of a container in CrashLoopBackOff. Find pod names with azure_aks_workloads.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | Yes | Kubernetes pod name. | |
| previous | No | Read logs of the previous (crashed) container instance. | |
| clusterId | Yes | Resource ID of a Microsoft.ContainerService/managedClusters AKS cluster. | |
| container | No | Container name. Required when the pod has more than one container. | |
| namespace | Yes | Kubernetes namespace name. | |
| tailLines | No | Maximum lines (default 200). | |
| sinceMinutes | No | Only lines from the last N minutes. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the operation read-only and idempotent; the description adds useful behavioral context by specifying the Kubernetes API route, read-only semantics, and how 'previous' exposes logs from crashed container instances. This goes beyond the structured annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no fluff: the main purpose is front-loaded, the special 'previous' behavior is explained, and a useful sibling lookup hint is included. Every sentence contributes operational guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter tool, the schema covers parameter details and annotations cover safety/idempotency. The description adds the missing operational context: how to get crashed-instance logs and where to find pod names, making the tool fully usable without further lookups.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents parameters like pod, namespace, clusterId, container, tailLines, and sinceMinutes. The description adds value by explaining the purpose of 'previous' and directing users to find pod names, but most parameter semantics remain in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Reads' and the specific resource: last log lines of a pod container in an AKS cluster via the Kubernetes API. It distinguishes this from log analytics or container app logs by scoping to AKS pod containers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool, including the CrashLoopBackOff scenario with 'previous' and a pointer to azure_aks_workloads for finding pod names. It does not explicitly contrast it with other log-query siblings, but the AKS pod-scoped use case is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_aks_workloadsAKS workloadsARead-onlyIdempotent
Reads live workload state from an AKS cluster's Kubernetes API with your Entra ID account (read-only). view "problems" (default) returns only what needs attention: failing or restarting pods, recent Warning events, deployments that are not fully available, and nodes that are not ready. Other views list everything: "pods", "events", "deployments", "nodes". Optionally limit to one namespace.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | What to show (default problems). | problems |
| limit | No | Maximum items per list (default 100). | |
| clusterId | Yes | Resource ID of a Microsoft.ContainerService/managedClusters AKS cluster. | |
| namespace | No | Kubernetes namespace name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only, non-destructive, and idempotent; the description adds that authentication uses the caller's Entra ID account and that the data is live from the Kubernetes API. It also defines what 'problems' filters to, providing behavioral detail beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences front-load the core read-only workload purpose, explain the default behavior, enumerate views, and state the optional namespace. No filler or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool with a small parameter set, the description covers purpose, auth, views, and namespace scoping. There is no output schema, but the absence of a return-format description is a minor gap because the semantics of each view are already explained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is complete, so the baseline is a 3. The description adds real value by explaining the semantic difference between the 'problems' view and the 'everything' views, and by noting that namespace is optional; 'limit' remains schema-described but not enriched.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Reads live workload state from an AKS cluster's Kubernetes API'. It enumerates distinct views and explains what the default 'problems' view returns, making the tool easy to distinguish from siblings like azure_aks_overview and azure_aks_pod_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The default 'problems' view is presented as the triage/high-signal path and other views are described as listing everything, which is clear usage context. However, it never explicitly contrasts this tool with sibling tools such as azure_aks_overview or azure_aks_pod_logs, so an agent must infer when this one should be selected instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_appinsights_failuresApplication failures overviewARead-onlyIdempotent
One-call triage of an application from Application Insights: request volume and failure rate, the most frequent failed operations, top exceptions, failing dependencies (databases, HTTP calls, queues) and the slowest operations. Each entry carries a sample operation ID to pass to azure_appinsights_trace for the full end-to-end transaction.
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | Only this cloud role (service name), for apps that share one Application Insights resource. | |
| hours | No | How many hours to look back (default 24, max 720). | |
| appInsightsId | Yes | Application Insights resource ID, or the ID of an app (App Service, Function app, Container App) linked to one. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds behavioral context by detailing what the overview includes (top exceptions, failing dependencies, slowest operations) and that each entry carries an operation ID for trace handoff, which is useful beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no redundancy. The first sentence front-loads the purpose and content of the overview; the second sentence explains the operation ID handoff to the sibling tool. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must convey what the tool returns, and it does so comprehensively: request volume, failure rate, failed operations, exceptions, dependencies, slow operations, and operation IDs. It does not detail pagination/limits, but for a triage overview with all parameters documented and annotations covering safety, this is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% per the context signals, and each parameter (role, hours, appInsightsId) already has a descriptive definition in the schema. The description does not add parameter-level semantics beyond implicitly referencing the app and the one-call nature, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'One-call triage of an application from Application Insights' and enumerates the exact failure-related data returned: request volume, failure rate, failed operations, exceptions, dependencies, and slow operations. This specific verb-resource pairing clearly distinguishes it from sibling tools like azure_appinsights_trace (which it names) and generic logging/query tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly positions this as an initial triage tool, and explicitly instructs the agent to pass the sample operation ID to azure_appinsights_trace for full end-to-end transaction details. It does not explicitly state when not to use it or name alternative tools for non-failure investigations, but the context is clear enough for an agent to select it appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_appinsights_traceEnd-to-end transactionARead-onlyIdempotent
Shows everything recorded for one operation ID in Application Insights, in time order: the incoming request, outgoing dependency calls, exceptions with stack details, and log traces, across all services. Get operation IDs from azure_appinsights_failures (sampleOperationId) or from a log query.
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | How many hours to look back (default 168, max 720). | |
| operationId | Yes | Operation ID (trace ID). | |
| appInsightsId | Yes | Application Insights resource ID, or the ID of an app (App Service, Function app, Container App) linked to one. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent annotations, it discloses that results are time-ordered and include request, dependency, exception, and trace data across services. This gives an accurate picture of the call result without an output schema, and there is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two information-dense sentences with zero waste. The core result is front-loaded, and the cross-reference to the failures tool is placed at the end.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only trace tool with no output schema, the description enumerates what will be returned and in what order, while the schema and annotations handle parameters and side effects. An agent has enough context to call and interpret this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers all three parameters with 100% description coverage. The description adds real value by pointing to azure_appinsights_failures.sampleOperationId and clarifying that operationId is the trace key.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Uses a specific verb ('Shows') with a precise resource ('everything recorded for one operation ID'), enumerates content and ordering, and notes cross-service scope. This clearly differentiates it from service-specific log tools like azure_appservice_logs and azure_containerapp_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes the use case: trace one operation end-to-end across services, and tells agents where to obtain valid operation IDs. It stops short of explicitly stating when not to use it or naming the alternative for single-service logs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_appservice_logsApp Service logsARead-onlyIdempotent
Reads the most recent log lines of an App Service or Function app from its log files (Kudu). Linux: source "app" is the container stdout/stderr (your application output), "platform" is container start, stop and crash events. Windows: "app" is application logging (must be enabled), "platform" is the Windows event log (IIS and runtime errors). For logs older than the files on disk, use azure_logs_query.
| Name | Required | Description | Default |
|---|---|---|---|
| lines | No | Maximum lines per instance (default 100). | |
| source | No | Which log to read (default app). | app |
| resourceId | Yes | Resource ID of a Microsoft.Web/sites app or sites/slots slot. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds valuable behavioral context beyond those annotations: it identifies Kudu as the underlying source, explains Linux vs. Windows behavior for each source value, and notes that Windows application logging must be enabled. It does not cover every behavior such as pagination or authentication, but the added detail is meaningful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is information-dense but every sentence earns its place: the main verb-resource statement, Linux source semantics, Windows source semantics, and the routing to azure_logs_query for older logs. It is front-loaded and contains no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only log tool with strong annotations and a fully documented input schema, the description covers the key context: source selection, OS differences, a prerequisite, and the sibling tool for older logs. It does not describe the output format, but no output schema exists and the purpose is clear enough for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 even without elaboration. The description goes beyond the schema by explaining what 'app' and 'platform' mean on Linux and Windows, and it contextualizes the 'lines' parameter with 'most recent log lines.' This adds real value to the bare parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair: 'Reads the most recent log lines of an App Service or Function app' from Kudu log files. It distinguishes itself from azure_logs_query by explicitly noting the older-logs case, so an agent can tell this tool apart from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete when-to-use guidance: this tool reads recent on-disk log lines, and 'For logs older than the files on disk, use azure_logs_query.' It also provides per-OS guidance for the 'source' parameter, including a prerequisite for Windows app logging, making the selection decision explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_appservice_overviewApp Service overviewARead-onlyIdempotent
Summarizes an App Service or Function app (or a deployment slot) for debugging: state, runtime stack, plan and scale, key configuration (Always On, health check, TLS, workers), logging settings, slots, recent deployments and, for Function apps, the functions. App setting and connection string values are never read.
| Name | Required | Description | Default |
|---|---|---|---|
| resourceId | Yes | Resource ID of a Microsoft.Web/sites app or sites/slots slot. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior, lowering the bar. The description adds a meaningful behavioral guarantee: 'App setting and connection string values are never read.' This is valuable context beyond what the annotations provide and helps the agent avoid expecting sensitive values in the output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is packed with useful enumerations, including state, runtime stack, plan/scale, configuration, logging, slots, deployments, and functions. It front-loads the verb and target resource, and the final sentence adds an important constraint without any filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must communicate what the tool returns, and it does so thoroughly by listing all major sections: state, stack, plan, configuration, logging, slots, deployments, and functions. The explicit statement about not reading secrets also clarifies an important boundary for a potentially sensitive Azure resource.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the resourceId parameter is already documented as a Microsoft.Web/sites app or sites/slots slot. The description reinforces the resource scope but does not add new semantic detail beyond the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Summarizes'), a specific resource type ('App Service or Function app or a deployment slot'), and a clear purpose ('for debugging'). It also enumerates the exact aspects covered, which distinguishes it from sibling tools like azure_appservice_logs or azure_get_resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for debugging' gives clear context for when to use this tool: when an agent needs a broad overview of an App Service, Function app, or slot before digging into logs or metrics. It does not explicitly name alternatives or state when not to use it, so it falls short of a fully explicit routing guideline.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_containerapp_logsContainer App logsARead-onlyIdempotent
Reads recent Container App logs from the environment's Log Analytics workspace. source "console" is your containers' stdout/stderr; "system" is platform events: revision provisioning, image pulls, probe failures, crashes and scaling. Filter by revision or by text. Results are oldest first.
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | How many hours to look back (default 1, max 720). | |
| limit | No | Maximum lines (default 100). | |
| search | No | Only lines containing this text (case-insensitive). | |
| source | No | Which log to read (default console). | console |
| revision | No | Only this revision name. | |
| resourceId | Yes | Resource ID of a Microsoft.App/containerApps app. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safety profile is covered and the bar is lower. The description adds value beyond annotations by explaining source semantics, the workspace location, and the 'oldest first' ordering. It does not contradict the read-only annotation; 'Reads' is consistent with readOnlyHint=true.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences with zero filler: purpose and workspace first, then source semantics, then filtering and ordering. The most decision-critical info (what the tool reads) is front-loaded and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-param read-only tool with 100% schema coverage and no output schema, the description covers the key agent decision points: what it reads, which source to choose, how to filter, and result ordering. Minor gap: it doesn't describe the return format, but for a log reader that is self-evident and acceptable absent an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description goes beyond the schema by defining what the source enum values mean concretely ('console' = stdout/stderr; 'system' = revision provisioning, image pulls, probe failures, crashes, scaling) and by mapping 'Filter by revision or by text' to the revision/search parameters. This adds real meaning the schema lacks.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Reads recent Container App logs') plus the backing store (Log Analytics workspace). It distinguishes itself from log siblings (azure_aks_pod_logs, azure_appservice_logs, azure_logs_query) by defining the two log sources and their content, so an agent can tell what this tool uniquely provides.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear internal guidance on when to pick 'console' vs 'system' by enumerating what each contains, and explains filtering by revision/text. However, it never names or routes to alternative tools such as azure_aks_pod_logs or azure_appservice_logs, so when-not-to-use-this guidance is left to inference rather than stated explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_containerapp_overviewContainer App overviewARead-onlyIdempotent
Summarizes a Container App for debugging: provisioning and running state, ingress, containers (image, CPU, memory, probes), scale rules, revisions with health and traffic, and the replicas of active revisions with container restart counts and states. Use azure_containerapp_logs for console and system logs.
| Name | Required | Description | Default |
|---|---|---|---|
| resourceId | Yes | Resource ID of a Microsoft.App/containerApps app. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, covering the safety profile. The description adds meaningful behavioral detail beyond this: it explains that the tool retrieves a broad multi-section snapshot, includes restart counts and states of replicas, and scopes to active revisions. This is useful context that annotations do not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and uses the second sentence to point to the correct sibling tool for logs. The first sentence is long but every listed item represents a distinct part of the returned overview, so the length is justified rather than padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description enumerates the full scope of the overview: provisioning/running state, ingress, container specs, probes, scale rules, revisions, traffic, and replica restart counts. It also handles the main adjacent need—logs—by naming azure_containerapp_logs. For a one-parameter read-only tool, nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the sole resourceId parameter is already documented as the resource ID of a Microsoft.App/containerApps app. The description does not add further parameter-level nuance, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Summarizes a Container App for debugging.' It then enumerates the exact categories covered (state, ingress, containers, scale rules, revisions, replicas), making it unmistakable what this tool does and how it differs from log-focused siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context ('for debugging') and explicitly routes console/system log needs to azure_containerapp_logs. It does not exhaustively contrast with azure_get_resource or the other overview tools, but the resource-scoped summary purpose is clear enough for most selection scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_contextAzure sign-in and subscriptionsARead-onlyIdempotent
Shows who you are signed in to Azure as, which tenant is used, and the subscriptions you can read. Call this first when you need a subscription ID, or when another tool reports an authentication or permission problem.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide a thorough safety profile: readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds no significant operational behavior beyond what annotations cover, aside from reinforcing that subscriptions are readable. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences front-load the output contents and then provide practical call-first guidance. There is no filler, and every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only context tool, the description sufficiently explains what it returns, when to call it, and why it matters. There is no output schema, but the listed information—identity, tenant, and readable subscriptions—is enough for an agent to decide whether to invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there are no parameter semantics for the description to clarify; per the zero-parameter baseline this is a 4. The description's mention of subscription IDs is context for the tool's output, not parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: it 'Shows' the signed-in Azure identity, tenant, and readable subscriptions. This clearly distinguishes it from sibling tools, which focus on logs, metrics, and resource data rather than account context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit trigger conditions: 'Call this first when you need a subscription ID, or when another tool reports an authentication or permission problem.' It lacks an explicit 'when not to use' or named alternatives, but the guidance is unambiguous and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_diagnosticsBuilt-in diagnosticsARead-onlyIdempotent
Runs Azure's built-in "Diagnose and solve problems" detectors for App Service, Function apps and Container Apps. These analyze platform data you cannot query yourself: crashes, restarts, HTTP 5xx breakdowns, CPU and memory pressure, SNAT port exhaustion, deployment and container start failures. Call without detector to list the available detectors, then call again with a detector id.
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | How many hours to look back (default 24, max 720). | |
| detector | No | Detector id. Omit to list detectors. | |
| resourceId | Yes | Resource ID of an App Service, Function app, slot, Container App or Container Apps environment. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, non-destructive, idempotent behavior, so the description only needs to add behavioral context. It does add meaningful specifics: the two-step list-then-run pattern and the fact that it surfaces managed platform diagnostics not available through direct queries. No contradiction with annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is tightly structured: first sentence states the action and scope, second lists the valuable diagnostic categories, third gives the call pattern. Every sentence earns its place with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with no output schema, the description covers what the tool does, which resources it targets, why an agent would choose it, and how to sequence calls. It does not describe result shape or pagination, but given the rich annotations and clear workflow, the agent has enough to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters are already documented. The description reinforces the detector parameter's omit-to-list behavior and gives workflow guidance, but it does not add substantive semantic detail beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-plus-resource ('Runs Azure's built-in 'Diagnose and solve problems' detectors') and names the exact resource types (App Service, Function apps, Container Apps). It further lists concrete diagnostic outcomes (crashes, restarts, HTTP 5xx, CPU/memory pressure, SNAT exhaustion), making the tool's scope unmistakable and distinguishing it from generic log or metrics siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear workflow: call without a detector to list detectors, then call again with a detector id. It also signals the appropriate context ('platform data you cannot query yourself'), which implies when to prefer this over raw log/metrics tools, though it does not explicitly name alternatives or state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_find_resourcesFind Azure resourcesARead-onlyIdempotent
Finds Azure resources by name, type, resource group, location or tag, across all your subscriptions at once. Returns resource IDs you can pass to other tools, plus type, location, SKU and provisioning state. Example: {"name": "orders-api", "type": "Microsoft.Web/sites"}. Common types: Microsoft.Web/sites (App Service and Functions), Microsoft.App/containerApps, Microsoft.ContainerService/managedClusters (AKS), Microsoft.Insights/components (Application Insights), Microsoft.OperationalInsights/workspaces (Log Analytics).
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Part of the resource name (case-insensitive). | |
| tags | No | Tags that must all match exactly, for example {"env": "prod"}. | |
| type | No | Exact resource type, for example Microsoft.Web/sites. | |
| limit | No | Maximum results (default 50). | |
| location | No | Azure region, for example westeurope. | |
| resourceGroup | No | Exact resource group name. | |
| subscriptionIds | No | Subscription IDs to search. Omit to search every subscription you have access to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds useful behavioral detail beyond that: it searches across all subscriptions, returns resource IDs plus type, location, SKU, and provisioning state, and gives representative Azure resource types. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is tightly written: one sentence establishes what the tool does, one sentence states return value value and fields, and the example plus common-types list are compact and directly useful. No filler or repetition of the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only search tool with no output schema, the description covers the essential context: what can be searched, that it spans subscriptions, what fields come back, how results are useful for downstream tools, and common type values. An agent has enough to invoke it correctly without inspecting other resources.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents all parameters with 100% coverage, so the baseline is 3. The description adds value by translating the parameter surface into a natural-language filter list, providing a concrete example combining name and type, and mapping common Azure type strings to friendly names like App Service, Functions, and AKS.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource: finds Azure resources by name, type, resource group, location, or tag across all subscriptions at once. It also describes what is returned. It does not explicitly contrast itself with sibling tools like azure_resource_graph_query or azure_get_resource, so sibling differentiation is implied rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: when you need to discover resources across subscriptions by structured filters and obtain IDs for other tools. It does not state when not to use it or explicitly mention alternatives, even though sibling tools such as azure_resource_graph_query and azure_get_resource likely overlap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_get_resourceGet Azure resource detailsARead-onlyIdempotent
Returns the full Azure Resource Manager definition of one resource: configuration, SKU, identity, networking and state. Works for any resource type, including child resources such as deployment slots. Secret values are masked. Get the resource ID from azure_find_resources.
| Name | Required | Description | Default |
|---|---|---|---|
| apiVersion | No | Optional. By default the newest stable API version is used. | |
| resourceId | Yes | Full resource ID, for example /subscriptions/<id>/resourceGroups/<group>/providers/Microsoft.Web/sites/<name>. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With four annotations (readOnlyHint, idempotentHint, openWorldHint, destructiveHint=false) already covering the safety and side-effect profile, the description adds genuinely useful behavior beyond them: 'Secret values are masked' warns the agent not to expect live credentials in the response, and the child-resource scope clarifies what 'any resource type' includes. No contradiction with annotations is present. It stops short of describing error behavior for nonexistent resources, but the masked-secrets disclosure is a meaningful value-add.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences with zero waste: primary behavior first, then scope, then the critical caveat, then the sourcing hint. Each sentence carries distinct information and the most important facts are front-loaded ahead of the auxiliary guidance. This is appropriately sized for a two-parameter read-only tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool (2 params, 1 required, no nested objects), the description covers all invocation-relevant ground: what it returns and its field inventory (partially compensating for the absent output schema), scope boundaries, a response caveat, and how to obtain the one required parameter. The four annotations complete the safety picture. The only omission—error handling for missing resources—is minor and does not affect correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both resourceId (including a full path example) and apiVersion (including default behavior) already documented, so the baseline is 3. The description contributes one extra parameter-level insight—that resourceId should be sourced from azure_find_resources—which helps the agent obtain the required argument correctly. That lifts it a notch above the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Returns the full Azure Resource Manager definition of one resource,' then enumerates the content (configuration, SKU, identity, networking, state). Explicitly noting it works for 'any resource type, including child resources such as deployment slots' distinguishes it from the resource-specific siblings like azure_aks_overview and azure_containerapp_overview. The 'one resource' scope cleanly separates it from the discovery tools azure_find_resources and azure_resource_graph_query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear, actionable context: it is the generic full-definition lookup for any resource, and it explicitly directs the agent to 'Get the resource ID from azure_find_resources,' naming the exact sibling that supplies the required parameter. However, it never states when not to use it or that resource-specific overview tools exist as alternatives for deeper domain views, so it lacks explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_logs_queryQuery logs (KQL)ARead-onlyIdempotent
Runs a KQL query against Azure Monitor Logs. scope can be a Log Analytics workspace (queries the whole workspace), an Application Insights resource, or any other resource (only that resource's logs, from every workspace it sends to). Application Insights tables: AppRequests, AppDependencies, AppExceptions, AppTraces. App Service: AppServiceHTTPLogs, AppServiceConsoleLogs. AKS: ContainerLogV2, KubePodInventory, KubeEvents. Example: {"scope": "", "query": "AppRequests | where Success == false | summarize count() by ResultCode, Name | top 10 by count_"}. Use azure_telemetry_locations to find the right scope.
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | How many hours to look back (default 24, max 2160). | |
| limit | No | Maximum rows (default 100). | |
| query | Yes | KQL query. | |
| scope | Yes | Resource ID of a Log Analytics workspace, Application Insights resource, or any resource. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, non-destructive, idempotent behavior. The description adds valuable behavioral context by explaining how the scope parameter affects query results (whole workspace vs. specific resource) and provides example tables for different resource types, going beyond annotation-provided safety hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the core action. Every sentence earns its place: scope explanation, table examples, a query example, and a pointer to the helper tool. It is concise despite its length, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with no output schema, the description covers scope behavior, query examples, and a scope-finding helper. It is sufficiently complete for an agent to call it correctly, though it does not describe the return format or error handling, which are minor gaps given the annotations and schema coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions cover all 4 parameters (100% coverage), but the description enriches the scope parameter with detailed semantics about what each scope type queries and gives a concrete query example. This adds meaning beyond the schema's generic descriptions, though hours/limit are not elaborated beyond schema defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Runs a KQL query against Azure Monitor Logs' and elaborates on scope types (workspace, Application Insights, or any resource), making the tool's function unambiguous. It implicitly differentiates from specialized siblings by being the general-purpose KQL tool, and the scope semantics are precise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives context on when to use this tool (for arbitrary KQL queries) and explicitly points to azure_telemetry_locations for finding the right scope. However, it does not explicitly mention when to prefer specialized siblings like azure_appservice_logs or azure_containerapp_logs, so it lacks explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_metricsAzure Monitor metricsARead-onlyIdempotent
Reads platform metrics for any resource: CPU, memory, requests, HTTP 5xx, response time, restarts, queue length, DTU and so on. Call without metrics to list the metrics a resource offers. With metrics, returns min/avg/max/latest per series and a downsampled time series. Example: {"resourceId": "...sites/orders-api", "metrics": ["Http5xx", "HttpResponseTime"], "hours": 6}. Split by a dimension with filter, e.g. "Instance eq '*'".
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | How many hours to look back (default 1, max 720). | |
| filter | No | Dimension filter, e.g. "StatusCode eq '500'" or "Instance eq '*'" to split by instance. | |
| metrics | No | Metric names. Omit to list available metrics. | |
| interval | No | Time grain. Chosen automatically from the time range if omitted. | |
| resourceId | Yes | Resource ID. | |
| aggregation | No | Aggregation. Default: each metric's primary aggregation. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false. The description adds behavioral detail beyond those: the return shape (min/avg/max/latest per series plus downsampled series), the list mode, and dimension-splitting via filter. It does not mention response limits or pagination, but these are minor for a read-only metrics tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and information-dense: it states the resource, enumerates typical metrics, explains both call modes, describes the return shape, and gives a concrete example. Every sentence earns its place, and the most important facts are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 100% parameter schema coverage, strong annotations, and no output schema, the description provides a good picture of behavior and returns. It explains list mode, aggregation shape, downsampling, and filtering. It could mention the output structure more explicitly, but the tool is simple enough that this is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaningful parameter behavior: omitting metrics triggers a listing mode, and filter is used to split by dimension (e.g., 'Instance eq \'*\''). The inline example ties resourceId, metrics, and hours together, going beyond the schema's field-level definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as reading platform metrics for any Azure resource and gives concrete examples (CPU, memory, HTTP 5xx, response time). It distinguishes this from sibling tools centered on logs, activity, or resource health by focusing specifically on platform metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains two usage modes: omit metrics to list available metrics, or provide metrics to retrieve aggregations and time series. It does not explicitly name alternatives or exclusions, but the purpose is specific enough that an agent can infer when metrics are the right data source.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_recent_changesRecent resource changesARead-onlyIdempotent
Lists configuration changes to a resource, or to every resource in a resource group or subscription, over the last hours (up to 14 days): what changed, the before and after values, who changed it and through which client. Use it to answer "what changed before this broke?".
| Name | Required | Description | Default |
|---|---|---|---|
| hours | No | How many hours to look back (default 24, max 336). | |
| limit | No | Maximum changes (default 50). | |
| scope | Yes | Resource ID, resource group ID (/subscriptions/<id>/resourceGroups/<name>) or subscription ID path (/subscriptions/<id>). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive), so the description adds useful behavioral context: the 14-day lookback window, the configuration-change scope, and the returned detail fields. It does not discuss pagination or data availability delays, but for a read-only tool this is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler: the first front-loads the verb, resource, scope, and time range, and the second gives a concrete diagnostic use case. Every clause adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with a small, fully documented parameter set and no output schema, the description covers what it returns, the supported scopes, the time window, and the motivating use case. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all three parameters. The description adds context about what the list contains but no new parameter-level detail, matching the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Lists configuration changes') with an explicit resource and scope ('to a resource, or to every resource in a resource group or subscription'). It names the exact output fields (what changed, before/after values, who, client), making it clearly distinguishable from sibling log/telemetry tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The line 'Use it to answer "what changed before this broke?"' gives an explicit, concrete use case. It does not, however, mention when not to use it or point to an alternative sibling, so it stops short of the full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_resource_graph_queryQuery Azure Resource GraphARead-onlyIdempotent
Runs a KQL query against Azure Resource Graph: a fast, read-only index of every resource across your subscriptions. Useful tables: resources, resourcecontainers (subscriptions and resource groups), resourcechanges (recent property changes), healthresources (availability), advisorresources, policyresources. Examples: "resources | where type =~ 'microsoft.web/sites' | summarize count() by location"; "resourcechanges | where properties.changeAttributes.timestamp > ago(1d) | project properties.targetResourceId, properties.changeType, properties.changes | take 20". Use azure_find_resources for simple lookups.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Maximum rows (default 100). | |
| query | Yes | KQL query. | |
| skipToken | No | Continuation token from a previous call, to fetch the next page. | |
| subscriptionIds | No | Subscription IDs to search. Omit to search every subscription you have access to. | |
| managementGroupIds | No | Management group IDs to query instead of subscriptions. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, and the description reinforces this by calling the index 'read-only.' It adds useful behavioral context: the data source spans all accessible subscriptions, key tables are enumerated, and example queries show the kind of KQL usage expected. It does not mention pagination or API limits, but annotations cover the core safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: definition, useful tables, concrete examples, and routing to an alternative. Each sentence contributes meaningful guidance without unnecessary fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex KQL query tool with no output schema, the description provides table guidance, example queries, and scope context, which is strong. It does not explain return shape or pagination flow, but the schema covers parameters and arbitrary KQL output is hard to fully specify; overall an agent has enough to call this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter. The description's examples indirectly show how the query parameter is used, but it adds no explicit detail about top, skipToken, subscriptionIds, or managementGroupIds beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('Runs a KQL query') and a specific resource ('Azure Resource Graph'), and clarifies scope ('every resource across your subscriptions'). It also explicitly distinguishes itself from azure_find_resources, so an agent can tell them apart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete guidance on when to use this tool and when not to: 'Use azure_find_resources for simple lookups.' It also provides useful table names and example queries, making the intended use case clear and separating it from sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_resource_healthResource health and service issuesARead-onlyIdempotent
Shows whether Azure itself reports a resource as healthy: its current availability, recent availability changes with Azure's stated reason, and active Azure service issues affecting the subscription. Use it early when an app is down, to tell a platform problem apart from an application problem.
| Name | Required | Description | Default |
|---|---|---|---|
| resourceId | Yes | Resource ID to check. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the description doesn't need to restate safety. It adds value by specifying the output includes availability, recent changes with Azure's stated reason, and active service issues—details not covered by annotations. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The primary function is stated first, followed by usage context. Every phrase earns its place, and the description is front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only health check with a single parameter and no output schema, the description covers the essential information: what it returns and when to use it. It's complete enough for an agent to invoke correctly without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents resourceId as 'Resource ID to check' with 100% coverage. The description adds no additional parameter semantics beyond implying the resource is Azure-managed. Since the schema handles it, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports Azure's own health assessment of a resource, including current availability, recent changes with reasons, and active service issues. It explicitly frames the purpose as distinguishing platform problems from application problems, which distinguishes it from sibling tools like azure_activity_log or azure_metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance to use this tool early when an app is down, to differentiate platform vs. application issues. It implies the alternative is to check application logs or other diagnostics, though it doesn't name specific sibling tools. This is clear enough for an agent to choose appropriately.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
azure_telemetry_locationsWhere does telemetry go?ARead-onlyIdempotent
Finds where a resource's logs and telemetry are stored: diagnostic settings (Log Analytics workspaces, storage accounts, Event Hubs, with the enabled log categories), linked Application Insights, Container Apps environment logging, and AKS Container Insights. Returns the resource IDs to use with azure_logs_query and azure_appinsights_failures, and which tables to query. Call this before querying logs for a resource you have not looked at yet.
| Name | Required | Description | Default |
|---|---|---|---|
| resourceId | Yes | Resource ID, for example an App Service, Container App or AKS cluster. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false, so the safety profile is covered. The description adds useful behavioral detail by listing the types of telemetry sinks it resolves and stating that it returns both resource IDs and tables to query.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, information-dense, and front-loaded with the core action. The second sentence clearly states when to invoke the tool. No filler or redundant phrasing is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a resource-discovery tool with no output schema, the description explains what will be returned, how to use the results, and when to call it. It does not cover edge cases like unsupported resources or absence of telemetry configuration, but the core information an agent needs is presente.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter resourceId has 100% schema description coverage, so the baseline is 3. The description repeats the resource type examples from the schema but does not add substantial new semantics beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: finding where a resource's logs and telemetry are stored. It enumerates specific storage destinations and explicitly distinguishes this discovery tool from log-querying capabilities by saying it returns resource IDs and table names to use with query tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear usage instruction: call this before querying logs for a resource you have not looked at yet. It does not explicitly mention when not to use it or name alternative discovery tools, but the placement as a prerequisite to azure_logs_query and azure_appinsights_failures provides strong contextual guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
20 tool updates
v1.0.0- First observed
azure_activity_log - First observed
azure_aks_overview - First observed
azure_aks_pod_logs - First observed
azure_aks_workloads - First observed
azure_appinsights_failures - First observed
azure_appinsights_trace - First observed
azure_appservice_logs - First observed
azure_appservice_overview - First observed
azure_containerapp_logs - First observed
azure_containerapp_overview - First observed
azure_context - First observed
azure_diagnostics - First observed
azure_find_resources - First observed
azure_get_resource - First observed
azure_logs_query - First observed
azure_metrics - First observed
azure_recent_changes - First observed
azure_resource_graph_query - First observed
azure_resource_health - First observed
azure_telemetry_locations
TDQS
Scored across 20 tools
Most tools are clearly distinct by resource type (App Service vs AKS vs Container Apps) and by action (overview vs logs vs metrics vs query). However, azure_logs_query and azure_appinsights_failures both query application telemetry and could be confused, though one is a raw query and the other is a pre-built triage. Also, azure_appservice_logs and azure_containerapp_logs are similar but differ by platform.
The naming pattern is mostly consistent with a resource prefix (azure_<resourcetype>_<action>), e.g., azure_appservice_logs, azure_containerapp_overview, azure_aks_workloads. However, there are several tools that break this pattern: azure_context, azure_find_resources, azure_resource_graph_query, and azure_logs_query lack a clear resource type in the name, making them less predictable. But the overall style is still uniform (snake_case, resource-first).
With 20 tools, this is at the upper edge of a well-scoped set. Each tool covers a specific debugging need, and there is no redundancy or bloat. It feels slightly heavy because azure_get_resource could be redundant with azure_find_resources plus the ARM API, but it's still reasonable given the breadth of Azure services covered.
The tool surface is remarkably complete for the domain of Azure debugging. It covers resource discovery (find_resources, resource_graph_query), state (get_resource, resource_health), metrics (azure_metrics), logs (appservice_logs, containerapp_logs, aks_pod_logs, logs_query), diagnostics (azure_diagnostics, appinsights_failures), telemetry locations (azure_telemetry_locations), and change tracking (azure_recent_changes, activity_log). It provides a full lifecycle for investigating any Azure resource, and the ability to drill down from broad to specific.
Maintenance
Related MCP Connectors
The Cortex MCP server provides read-only access to real-time engineering context from the Cortex developer portal, allowing AI coding assistants to answer natural language questions about your organization's catalog (microservices, libraries, domains, teams, infrastructure), scorecards (engineering standards and best practices), initiatives (goals and deadlines), and Engineering Intelligence metrics. It includes tools for querying documentation, tracking personal entities, and accessing AI-assisted insights across the entire Cortex ecosystem.
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
- ZopDev MCPOAuthdev.zop
Cloud cost, inventory and governance on AWS/Azure/GCP. Read-only by default, optional scoped writes
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides tools for listing and querying Azure resources directly from any MCP client, allowing you to efficiently browse your Azure infrastructure and analyze costs without leaving your workflow.3-
- AlicenseAqualityBmaintenanceEnables natural-language queries about Azure resource compliance, including VM compliance, patch status, orphaned RBAC, and infrastructure health, through read-only MCP tools.3MIT
- AlicenseAqualityBmaintenanceProvides read-only access to Azure DevOps using your browser session, no PAT required. Enables browsing projects, repos, work items, pull requests, and feeds through MCP tools.128 npmMIT
- AlicenseAqualityCmaintenanceEnables read-only querying of Azure Log Analytics and Azure Resource Graph through MCP, supporting KQL queries, workspace discovery, and resource inventory exploration with Azure RBAC authentication.52MIT