Skip to main content
Glama
SH-G401
by SH-G401

BetterAzureMCP

CI npm License: MIT Node.js 22+

A read-only Model Context Protocol server for Azure, built for one job: helping developers debug their Azure applications from GitHub Copilot, VS Code and other MCP clients.

Ask "why is orders-api returning 500s since this morning?" and the assistant can check resource health, recent configuration changes, failed deployments, Application Insights exceptions, container logs and pod restarts, without you opening the portal.

  • Stable. Every tool call has a hard deadline. Sign-in never waits on a hidden browser window. Nothing but protocol messages is written to stdout. No auto-updates and no runtime downloads.

  • Private. The server only talks to Azure's own API endpoints, enforced by an allowlist in code. No telemetry, no analytics, no third parties.

  • Read-only. Write operations are blocked at the HTTP layer, not just left out of the tool list. Values that look like secrets are masked before they leave the server.

  • Focused. 20 tools that cover the debugging path, instead of hundreds of per-service wrappers competing for the model's attention.

Contents

Related MCP server: azure-compliance-mcp

Quick start

You need Node.js 22 or later and an Azure login through the Azure CLI (az login), the Azure Developer CLI (azd auth login) or Azure PowerShell (Connect-AzAccount).

npm install -g betterazuremcp
az login
betterazuremcp doctor

doctor checks the setup and tells you what to fix:

betterazuremcp 1.0.0 doctor

  ok    Node.js version: 22.22.2
  ok    Azure sign-in: dev@contoso.com (tenant 8a1c...e42f) via Azure CLI (az login)
  ok    Subscriptions: 3 accessible, 3 enabled
  ok    Azure Resource Graph: reachable, 412 resources indexed

Then add the server to your client.

Client setup

Install in VS Code Install in VS Code Insiders

Every client starts the server the same way: the command betterazuremcp, over stdio, with no arguments.

VS Code (GitHub Copilot)

Use the install button above, or add this to .vscode/mcp.json (or MCP: Open User Configuration for all workspaces):

{
  "servers": {
    "azure": {
      "type": "stdio",
      "command": "betterazuremcp"
    }
  }
}

The tools are available in Copilot Chat in Agent mode.

GitHub Copilot Desktop

  1. Open Settings (gear icon, bottom left) → MCP Servers → Add custom server.

  2. Name: azure. Transport: stdio. Command: betterazuremcp.

  3. Save. The server starts with the next chat.

Visual Studio, Copilot CLI, Claude Desktop and others are covered in docs/clients.md.

Tools

Finding things

Tool

What it does

azure_context

Who you are signed in as, the directory, your subscriptions and the current subscription. Switches subscription or directory.

azure_find_resources

Finds resources by name, type, resource group, location or tag across all subscriptions.

azure_resource_graph_query

KQL against Azure Resource Graph, for inventory questions across subscriptions.

azure_get_resource

The full definition of any resource by ID.

What is wrong with this resource?

Tool

What it does

azure_resource_health

Azure's own view of the resource's availability, recent outages, and active service issues.

azure_recent_changes

Configuration changes in the last 14 days, with before and after values and who made them.

azure_activity_log

Deployments, restarts, scaling and other operations, and why they failed.

azure_telemetry_locations

Where the resource's logs go: workspaces, Application Insights, storage, Event Hubs, and which tables to query.

azure_metrics

Platform metrics such as CPU, memory, HTTP 5xx, latency and restarts, summarized.

Telemetry

Tool

What it does

azure_logs_query

KQL against a Log Analytics workspace, an Application Insights resource, or one resource's logs.

azure_appinsights_failures

One-call triage: failure rate, failing operations, top exceptions, failing dependencies, slowest operations.

azure_appinsights_trace

Every request, dependency call, exception and trace of one operation, in time order.

Platforms

Tool

What it does

azure_appservice_overview

App Service and Function app state, runtime, plan, key settings, logging, slots, deployments, functions.

azure_appservice_logs

The latest application or platform log lines from the app's log files.

azure_diagnostics

Azure's built-in "Diagnose and solve problems" detectors for App Service and Container Apps.

azure_containerapp_overview

Container App revisions, replicas, restart counts, ingress, scale rules and containers.

azure_containerapp_logs

Console and system logs of a Container App.

azure_aks_overview

AKS cluster state, version and upgrades, node pools, networking and add-ons.

azure_aks_workloads

Failing pods, Warning events, unavailable deployments and unhealthy nodes, live from the cluster.

azure_aks_pod_logs

Pod logs, including the previous instance of a crashing container.

Results start with a one-line summary followed by compact JSON, and are capped in size so they do not flood the model's context.

Things to ask:

  • "orders-api has been returning 500s since 9:00. Find out why."

  • "What changed in resource group rg-orders-prod in the last 24 hours?"

  • "Show the slowest operations of the checkout service this week and trace one of them."

  • "Why does the latest revision of the payments container app not become healthy?"

  • "Which pods in the shop namespace of aks-prod are crash-looping, and what do their logs say?"

Permissions

The server can only see what your account can see. Most tools work with the Reader role. A few need more:

Tools

Role needed

All tools, at the scope you want to inspect

Reader

azure_appservice_logs (reads log files through Kudu)

A role with Microsoft.Web/sites/publish/Action, such as Website Contributor

azure_aks_workloads, azure_aks_pod_logs

Azure Kubernetes Service Cluster User Role, plus read access inside the cluster (Azure Kubernetes Service RBAC Reader, or a Kubernetes view binding). The cluster must use Entra ID integration.

When a role is missing, the tool says which one and suggests an alternative that works with Reader.

Current subscription

The server remembers the subscription and directory (Entra tenant) you worked in most recently, so the assistant does not have to ask where to look every time.

  • It follows your work. Whenever a tool reads a resource in a subscription, that subscription becomes the current one. Tools that need a scope, such as the activity log and recent changes, use it when you don't name another.

  • The assistant knows it. The current subscription is part of the server's instructions at the start of every session, and azure_context shows it.

  • Switching is one sentence. "Switch to the Staging subscription" or "look in the fabrikam.onmicrosoft.com directory" makes the assistant call azure_context with the new choice, which is then remembered.

  • It survives restarts and stays local. The choice is stored in a small file in your user profile: ~/.local/state/betterazuremcp/context.json on Linux, ~/Library/Application Support/betterazuremcp/ on macOS, %APPDATA%\betterazuremcp\ on Windows. It holds only IDs and display names. Delete it to forget, or set BETTERAZUREMCP_REMEMBER_CONTEXT=false.

If the remembered directory stops working for your login, for example after you sign in with another account, the server falls back to your default directory and forgets the old choice. BETTERAZUREMCP_TENANT_ID and BETTERAZUREMCP_SUBSCRIPTIONS always take precedence.

Configuration

Configuration is optional and done through environment variables. Most clients let you set them in the server entry ("env": { ... }).

Variable

Default

Description

BETTERAZUREMCP_TENANT_ID

tenant of your login

Tenant to sign in to. Set this if you have access to several tenants.

BETTERAZUREMCP_CREDENTIAL

auto

auto tries environment variables, Azure CLI, Azure Developer CLI and Azure PowerShell, in that order. Or pin one: azurecli, azd, azurepowershell, environment, managedidentity.

BETTERAZUREMCP_TIMEOUT_SECONDS

60

Deadline for a single tool call (5–600).

BETTERAZUREMCP_MAX_RESPONSE_KB

12

Size limit for a single tool result (2–256).

BETTERAZUREMCP_SUBSCRIPTIONS

all accessible

Comma-separated subscription IDs. The server then reads only from these subscriptions, enforced for every request.

BETTERAZUREMCP_MAX_MEMORY_MB

1024

The server stops itself if it ever uses more memory than this. The client restarts it on the next call.

BETTERAZUREMCP_REMEMBER_CONTEXT

true

Remember the subscription and directory you worked in last. Set to false to turn it off.

BETTERAZUREMCP_STATE_DIR

per-user app data folder

Where the remembered context is stored.

BETTERAZUREMCP_SHOW_SECRETS

false

Set to true to stop masking secret values. Not recommended.

BETTERAZUREMCP_LOG_LEVEL

info

error, warn, info or debug. Logs go to stderr, which clients show in their output panel.

Behind a corporate proxy, set HTTPS_PROXY (and NO_PROXY if needed).

Privacy and safety

  • Where data goes. Requests go only to Azure Resource Manager (management.azure.com), the Log Analytics query API (api.loganalytics.io), your App Service apps' Kudu sites (*.scm.azurewebsites.net) and your AKS API servers (*.azmk8s.io). Any other host is refused before a request is made.

  • What is sent. Only the Azure API calls needed to answer a tool call. There is no telemetry, crash reporting or update check.

  • What cannot happen. PUT, PATCH and DELETE are blocked, and so is every POST that is not a known read. Kudu access is limited to log files, and Kubernetes access to pod, event, deployment and node status and pod logs. Secrets, config maps, exec and calls such as listKeys are blocked by the same rules.

  • Prompt injection. Logs, messages and tags can contain text written by anyone. Results that carry such text are marked as untrusted, and text that reads like instructions to an AI assistant is flagged with a warning. The server limits what an injected instruction could achieve: it does not request secret values, cannot write, and can only reach Azure endpoints of resources you can already read.

  • What the AI sees. Your MCP client passes tool results to its language model. Values that look like secrets (passwords, keys, connection strings, SAS tokens) are masked first, and app setting values are not requested. Masking is pattern-based and cannot catch everything: logs and telemetry contain whatever your application wrote, so a secret your app logged in an unusual format can reach the model. Use an MCP client and model you trust with your logs.

The full model is in SECURITY.md. These are design properties backed by tests, not a warranty; see the license.

Troubleshooting

Start with betterazuremcp doctor. It checks sign-in, subscriptions and connectivity, and prints what to fix.

Symptom

Fix

"Not signed in to Azure"

Run az login in a terminal. The client does not need to be restarted.

Signed in, but no subscriptions or 403 errors

You may be in the wrong tenant. Run az login --tenant <tenant> or set BETTERAZUREMCP_TENANT_ID.

The client cannot start betterazuremcp

The client may not see your PATH. Use the full path from which betterazuremcp (macOS/Linux) or where betterazuremcp (Windows). See docs/clients.md for Windows.

Timeouts on large queries

Narrow the query, or raise BETTERAZUREMCP_TIMEOUT_SECONDS.

AKS tools cannot reach a private cluster

Private API servers are only reachable from their network. Use azure_logs_query with Container Insights tables instead.

Server logs appear in your client's MCP output (in VS Code: MCP: List Servers → azure → Show Output). Set BETTERAZUREMCP_LOG_LEVEL=debug for more detail.

Building from source

git clone https://github.com/SH-G401/BetterAzureMCP.git
cd BetterAzureMCP
npm ci
npm run build
npm link    # puts the `betterazuremcp` command on your PATH

Contributing

Issues and pull requests are welcome. See CONTRIBUTING.md for the development setup and ground rules, and docs/architecture.md for how the code fits together. The reasoning behind the design is in docs/RESEARCH.md and docs/PLAN.md, and docs/COMPLAINTS.md tracks user complaints about the official Azure MCP Server and what we do about each.

License

MIT. The npm package bundles open-source dependencies into a single file; their licenses are in dist/THIRD_PARTY_NOTICES.txt.

BetterAzureMCP is an independent project. It is not affiliated with, endorsed by or supported by Microsoft. Microsoft and Azure are trademarks of the Microsoft group of companies.

Available Tools

20 tools
azure_activity_logActivity logA
Read-onlyIdempotent

Lists control-plane operations from the Azure activity log: deployments, restarts, scaling, configuration updates, role assignments, and their failures, with the caller and error message. Scope it to a resource, a resource group or a whole subscription. Set onlyFailures to see only failed operations.

ParametersJSON Schema
NameRequiredDescriptionDefault
hoursNoHow many hours to look back (default 24, max 2160).
limitNoMaximum events (default 50).
scopeYesResource ID, resource group ID (/subscriptions/<id>/resourceGroups/<name>) or subscription ID path (/subscriptions/<id>).
onlyFailuresNoOnly return failed operations and errors.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so safety is covered. The description adds behavioral context about the content returned (caller and error message) and the scoping options, which goes beyond the structured fields. It does not mention pagination or error handling, but that is minor given the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no redundancy. The purpose is front-loaded in the first sentence, and the second adds actionable usage guidance. Every clause earns its place, making it an exemplar of concision.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only log-listing tool, the description covers the essential aspects: what is returned, how to scope, and filtering. The lack of an output schema is partially mitigated by mentioning the caller and error message. It does not detail the event structure or pagination behavior, but these are either inferable or covered by parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters. The description enhances meaning for 'scope' by explaining the three scoping levels, and for 'onlyFailures' by stating its purpose. This adds value over the schema, though it does not elaborate on 'hours' or 'limit' beyond their defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Lists') and resource ('control-plane operations from the Azure activity log'), and gives concrete examples (deployments, restarts, scaling, etc.) that make its purpose unmistakable. It also differentiates itself from sibling log tools by explicitly scoping to control-plane operations, which is distinct from data-plane logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: how to scope (resource, resource group, subscription) and how to filter (onlyFailures). However, it does not explicitly name alternatives or state when not to use this tool, leaving the differentiation to implication rather than direct guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_aks_overviewAKS cluster overviewA
Read-onlyIdempotent

Summarizes an AKS cluster from Azure Resource Manager: power and provisioning state, Kubernetes version and available upgrades, node pools (size, count, autoscaling, state), networking, identity and access mode, and enabled add-ons such as Container Insights. Also tells whether azure_aks_workloads and azure_aks_pod_logs can reach this cluster.

ParametersJSON Schema
NameRequiredDescriptionDefault
clusterIdYesResource ID of a Microsoft.ContainerService/managedClusters AKS cluster.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly/openWorld/idempotent behavior. The description adds valuable behavioral context by specifying what aspects are summarized and by disclosing that it reports reachability for azure_aks_workloads and azure_aks_pod_logs. This goes well beyond the annotations and helps the agent understand what to expect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, both of which earn their place. The first is dense but organized and front-loaded with the primary purpose; the second adds a unique capability that is important for tool selection among siblings.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only overview tool with one well-documented parameter and strong annotations, the description is complete. It lists the categories of information returned and includes the cross-tool reachability detail, so an agent has enough context to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 100% coverage for the single clusterId parameter, including its meaning as a Resource ID. The description adds no additional parameter-level detail beyond mentioning that the summary comes from Azure Resource Manager, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool summarizes an AKS cluster and enumerates the exact information it covers: power and provisioning state, Kubernetes version and upgrades, node pools, networking, identity, and add-ons. This distinguishes it from generic get_resource tools and from sibling tools like azure_aks_workloads and azure_aks_pod_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the tool's scope evident: use it for a high-level overview of an AKS cluster and to check whether related workload/log tools can reach that cluster. It doesn't explicitly state when not to use it or name alternatives, but the context is clear enough given the sibling tool list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_aks_pod_logsAKS pod logsA
Read-onlyIdempotent

Reads the last log lines of a pod container in an AKS cluster through the Kubernetes API (read-only). Set previous to true to read the logs of the previous, crashed instance of a container in CrashLoopBackOff. Find pod names with azure_aks_workloads.

ParametersJSON Schema
NameRequiredDescriptionDefault
podYesKubernetes pod name.
previousNoRead logs of the previous (crashed) container instance.
clusterIdYesResource ID of a Microsoft.ContainerService/managedClusters AKS cluster.
containerNoContainer name. Required when the pod has more than one container.
namespaceYesKubernetes namespace name.
tailLinesNoMaximum lines (default 200).
sinceMinutesNoOnly lines from the last N minutes.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the operation read-only and idempotent; the description adds useful behavioral context by specifying the Kubernetes API route, read-only semantics, and how 'previous' exposes logs from crashed container instances. This goes beyond the structured annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no fluff: the main purpose is front-loaded, the special 'previous' behavior is explained, and a useful sibling lookup hint is included. Every sentence contributes operational guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter tool, the schema covers parameter details and annotations cover safety/idempotency. The description adds the missing operational context: how to get crashed-instance logs and where to find pod names, making the tool fully usable without further lookups.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents parameters like pod, namespace, clusterId, container, tailLines, and sinceMinutes. The description adds value by explaining the purpose of 'previous' and directing users to find pod names, but most parameter semantics remain in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Reads' and the specific resource: last log lines of a pod container in an AKS cluster via the Kubernetes API. It distinguishes this from log analytics or container app logs by scoping to AKS pod containers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool, including the CrashLoopBackOff scenario with 'previous' and a pointer to azure_aks_workloads for finding pod names. It does not explicitly contrast it with other log-query siblings, but the AKS pod-scoped use case is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_aks_workloadsAKS workloadsA
Read-onlyIdempotent

Reads live workload state from an AKS cluster's Kubernetes API with your Entra ID account (read-only). view "problems" (default) returns only what needs attention: failing or restarting pods, recent Warning events, deployments that are not fully available, and nodes that are not ready. Other views list everything: "pods", "events", "deployments", "nodes". Optionally limit to one namespace.

ParametersJSON Schema
NameRequiredDescriptionDefault
viewNoWhat to show (default problems).problems
limitNoMaximum items per list (default 100).
clusterIdYesResource ID of a Microsoft.ContainerService/managedClusters AKS cluster.
namespaceNoKubernetes namespace name.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, non-destructive, and idempotent; the description adds that authentication uses the caller's Entra ID account and that the data is live from the Kubernetes API. It also defines what 'problems' filters to, providing behavioral detail beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences front-load the core read-only workload purpose, explain the default behavior, enumerate views, and state the optional namespace. No filler or repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with a small parameter set, the description covers purpose, auth, views, and namespace scoping. There is no output schema, but the absence of a return-format description is a minor gap because the semantics of each view are already explained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is complete, so the baseline is a 3. The description adds real value by explaining the semantic difference between the 'problems' view and the 'everything' views, and by noting that namespace is optional; 'limit' remains schema-described but not enriched.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Reads live workload state from an AKS cluster's Kubernetes API'. It enumerates distinct views and explains what the default 'problems' view returns, making the tool easy to distinguish from siblings like azure_aks_overview and azure_aks_pod_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The default 'problems' view is presented as the triage/high-signal path and other views are described as listing everything, which is clear usage context. However, it never explicitly contrasts this tool with sibling tools such as azure_aks_overview or azure_aks_pod_logs, so an agent must infer when this one should be selected instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_appinsights_failuresApplication failures overviewA
Read-onlyIdempotent

One-call triage of an application from Application Insights: request volume and failure rate, the most frequent failed operations, top exceptions, failing dependencies (databases, HTTP calls, queues) and the slowest operations. Each entry carries a sample operation ID to pass to azure_appinsights_trace for the full end-to-end transaction.

ParametersJSON Schema
NameRequiredDescriptionDefault
roleNoOnly this cloud role (service name), for apps that share one Application Insights resource.
hoursNoHow many hours to look back (default 24, max 720).
appInsightsIdYesApplication Insights resource ID, or the ID of an app (App Service, Function app, Container App) linked to one.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds behavioral context by detailing what the overview includes (top exceptions, failing dependencies, slowest operations) and that each entry carries an operation ID for trace handoff, which is useful beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no redundancy. The first sentence front-loads the purpose and content of the overview; the second sentence explains the operation ID handoff to the sibling tool. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must convey what the tool returns, and it does so comprehensively: request volume, failure rate, failed operations, exceptions, dependencies, slow operations, and operation IDs. It does not detail pagination/limits, but for a triage overview with all parameters documented and annotations covering safety, this is sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% per the context signals, and each parameter (role, hours, appInsightsId) already has a descriptive definition in the schema. The description does not add parameter-level semantics beyond implicitly referencing the app and the one-call nature, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'One-call triage of an application from Application Insights' and enumerates the exact failure-related data returned: request volume, failure rate, failed operations, exceptions, dependencies, and slow operations. This specific verb-resource pairing clearly distinguishes it from sibling tools like azure_appinsights_trace (which it names) and generic logging/query tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly positions this as an initial triage tool, and explicitly instructs the agent to pass the sample operation ID to azure_appinsights_trace for full end-to-end transaction details. It does not explicitly state when not to use it or name alternative tools for non-failure investigations, but the context is clear enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_appinsights_traceEnd-to-end transactionA
Read-onlyIdempotent

Shows everything recorded for one operation ID in Application Insights, in time order: the incoming request, outgoing dependency calls, exceptions with stack details, and log traces, across all services. Get operation IDs from azure_appinsights_failures (sampleOperationId) or from a log query.

ParametersJSON Schema
NameRequiredDescriptionDefault
hoursNoHow many hours to look back (default 168, max 720).
operationIdYesOperation ID (trace ID).
appInsightsIdYesApplication Insights resource ID, or the ID of an app (App Service, Function app, Container App) linked to one.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent annotations, it discloses that results are time-ordered and include request, dependency, exception, and trace data across services. This gives an accurate picture of the call result without an output schema, and there is no contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two information-dense sentences with zero waste. The core result is front-loaded, and the cross-reference to the failures tool is placed at the end.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only trace tool with no output schema, the description enumerates what will be returned and in what order, while the schema and annotations handle parameters and side effects. An agent has enough context to call and interpret this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all three parameters with 100% description coverage. The description adds real value by pointing to azure_appinsights_failures.sampleOperationId and clarifying that operationId is the trace key.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Uses a specific verb ('Shows') with a precise resource ('everything recorded for one operation ID'), enumerates content and ordering, and notes cross-service scope. This clearly differentiates it from service-specific log tools like azure_appservice_logs and azure_containerapp_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes the use case: trace one operation end-to-end across services, and tells agents where to obtain valid operation IDs. It stops short of explicitly stating when not to use it or naming the alternative for single-service logs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_appservice_logsApp Service logsA
Read-onlyIdempotent

Reads the most recent log lines of an App Service or Function app from its log files (Kudu). Linux: source "app" is the container stdout/stderr (your application output), "platform" is container start, stop and crash events. Windows: "app" is application logging (must be enabled), "platform" is the Windows event log (IIS and runtime errors). For logs older than the files on disk, use azure_logs_query.

ParametersJSON Schema
NameRequiredDescriptionDefault
linesNoMaximum lines per instance (default 100).
sourceNoWhich log to read (default app).app
resourceIdYesResource ID of a Microsoft.Web/sites app or sites/slots slot.

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds valuable behavioral context beyond those annotations: it identifies Kudu as the underlying source, explains Linux vs. Windows behavior for each source value, and notes that Windows application logging must be enabled. It does not cover every behavior such as pagination or authentication, but the added detail is meaningful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense but every sentence earns its place: the main verb-resource statement, Linux source semantics, Windows source semantics, and the routing to azure_logs_query for older logs. It is front-loaded and contains no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only log tool with strong annotations and a fully documented input schema, the description covers the key context: source selection, OS differences, a prerequisite, and the sibling tool for older logs. It does not describe the output format, but no output schema exists and the purpose is clear enough for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 even without elaboration. The description goes beyond the schema by explaining what 'app' and 'platform' mean on Linux and Windows, and it contextualizes the 'lines' parameter with 'most recent log lines.' This adds real value to the bare parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair: 'Reads the most recent log lines of an App Service or Function app' from Kudu log files. It distinguishes itself from azure_logs_query by explicitly noting the older-logs case, so an agent can tell this tool apart from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete when-to-use guidance: this tool reads recent on-disk log lines, and 'For logs older than the files on disk, use azure_logs_query.' It also provides per-OS guidance for the 'source' parameter, including a prerequisite for Windows app logging, making the selection decision explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_appservice_overviewApp Service overviewA
Read-onlyIdempotent

Summarizes an App Service or Function app (or a deployment slot) for debugging: state, runtime stack, plan and scale, key configuration (Always On, health check, TLS, workers), logging settings, slots, recent deployments and, for Function apps, the functions. App setting and connection string values are never read.

ParametersJSON Schema
NameRequiredDescriptionDefault
resourceIdYesResource ID of a Microsoft.Web/sites app or sites/slots slot.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior, lowering the bar. The description adds a meaningful behavioral guarantee: 'App setting and connection string values are never read.' This is valuable context beyond what the annotations provide and helps the agent avoid expecting sensitive values in the output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is packed with useful enumerations, including state, runtime stack, plan/scale, configuration, logging, slots, deployments, and functions. It front-loads the verb and target resource, and the final sentence adds an important constraint without any filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must communicate what the tool returns, and it does so thoroughly by listing all major sections: state, stack, plan, configuration, logging, slots, deployments, and functions. The explicit statement about not reading secrets also clarifies an important boundary for a potentially sensitive Azure resource.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the resourceId parameter is already documented as a Microsoft.Web/sites app or sites/slots slot. The description reinforces the resource scope but does not add new semantic detail beyond the schema, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Summarizes'), a specific resource type ('App Service or Function app or a deployment slot'), and a clear purpose ('for debugging'). It also enumerates the exact aspects covered, which distinguishes it from sibling tools like azure_appservice_logs or azure_get_resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for debugging' gives clear context for when to use this tool: when an agent needs a broad overview of an App Service, Function app, or slot before digging into logs or metrics. It does not explicitly name alternatives or state when not to use it, so it falls short of a fully explicit routing guideline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_containerapp_logsContainer App logsA
Read-onlyIdempotent

Reads recent Container App logs from the environment's Log Analytics workspace. source "console" is your containers' stdout/stderr; "system" is platform events: revision provisioning, image pulls, probe failures, crashes and scaling. Filter by revision or by text. Results are oldest first.

ParametersJSON Schema
NameRequiredDescriptionDefault
hoursNoHow many hours to look back (default 1, max 720).
limitNoMaximum lines (default 100).
searchNoOnly lines containing this text (case-insensitive).
sourceNoWhich log to read (default console).console
revisionNoOnly this revision name.
resourceIdYesResource ID of a Microsoft.App/containerApps app.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safety profile is covered and the bar is lower. The description adds value beyond annotations by explaining source semantics, the workspace location, and the 'oldest first' ordering. It does not contradict the read-only annotation; 'Reads' is consistent with readOnlyHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences with zero filler: purpose and workspace first, then source semantics, then filtering and ordering. The most decision-critical info (what the tool reads) is front-loaded and every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-param read-only tool with 100% schema coverage and no output schema, the description covers the key agent decision points: what it reads, which source to choose, how to filter, and result ordering. Minor gap: it doesn't describe the return format, but for a log reader that is self-evident and acceptable absent an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description goes beyond the schema by defining what the source enum values mean concretely ('console' = stdout/stderr; 'system' = revision provisioning, image pulls, probe failures, crashes, scaling) and by mapping 'Filter by revision or by text' to the revision/search parameters. This adds real meaning the schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Reads recent Container App logs') plus the backing store (Log Analytics workspace). It distinguishes itself from log siblings (azure_aks_pod_logs, azure_appservice_logs, azure_logs_query) by defining the two log sources and their content, so an agent can tell what this tool uniquely provides.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear internal guidance on when to pick 'console' vs 'system' by enumerating what each contains, and explains filtering by revision/text. However, it never names or routes to alternative tools such as azure_aks_pod_logs or azure_appservice_logs, so when-not-to-use-this guidance is left to inference rather than stated explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_containerapp_overviewContainer App overviewA
Read-onlyIdempotent

Summarizes a Container App for debugging: provisioning and running state, ingress, containers (image, CPU, memory, probes), scale rules, revisions with health and traffic, and the replicas of active revisions with container restart counts and states. Use azure_containerapp_logs for console and system logs.

ParametersJSON Schema
NameRequiredDescriptionDefault
resourceIdYesResource ID of a Microsoft.App/containerApps app.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, covering the safety profile. The description adds meaningful behavioral detail beyond this: it explains that the tool retrieves a broad multi-section snapshot, includes restart counts and states of replicas, and scopes to active revisions. This is useful context that annotations do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and uses the second sentence to point to the correct sibling tool for logs. The first sentence is long but every listed item represents a distinct part of the returned overview, so the length is justified rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description enumerates the full scope of the overview: provisioning/running state, ingress, container specs, probes, scale rules, revisions, traffic, and replica restart counts. It also handles the main adjacent need—logs—by naming azure_containerapp_logs. For a one-parameter read-only tool, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the sole resourceId parameter is already documented as the resource ID of a Microsoft.App/containerApps app. The description does not add further parameter-level nuance, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Summarizes a Container App for debugging.' It then enumerates the exact categories covered (state, ingress, containers, scale rules, revisions, replicas), making it unmistakable what this tool does and how it differs from log-focused siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context ('for debugging') and explicitly routes console/system log needs to azure_containerapp_logs. It does not exhaustively contrast with azure_get_resource or the other overview tools, but the resource-scoped summary purpose is clear enough for most selection scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_contextAzure sign-in and subscriptionsA
Read-onlyIdempotent

Shows who you are signed in to Azure as, which tenant is used, and the subscriptions you can read. Call this first when you need a subscription ID, or when another tool reports an authentication or permission problem.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide a thorough safety profile: readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds no significant operational behavior beyond what annotations cover, aside from reinforcing that subscriptions are readable. No contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences front-load the output contents and then provide practical call-first guidance. There is no filler, and every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only context tool, the description sufficiently explains what it returns, when to call it, and why it matters. There is no output schema, but the listed information—identity, tenant, and readable subscriptions—is enough for an agent to decide whether to invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there are no parameter semantics for the description to clarify; per the zero-parameter baseline this is a 4. The description's mention of subscription IDs is context for the tool's output, not parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: it 'Shows' the signed-in Azure identity, tenant, and readable subscriptions. This clearly distinguishes it from sibling tools, which focus on logs, metrics, and resource data rather than account context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit trigger conditions: 'Call this first when you need a subscription ID, or when another tool reports an authentication or permission problem.' It lacks an explicit 'when not to use' or named alternatives, but the guidance is unambiguous and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_diagnosticsBuilt-in diagnosticsA
Read-onlyIdempotent

Runs Azure's built-in "Diagnose and solve problems" detectors for App Service, Function apps and Container Apps. These analyze platform data you cannot query yourself: crashes, restarts, HTTP 5xx breakdowns, CPU and memory pressure, SNAT port exhaustion, deployment and container start failures. Call without detector to list the available detectors, then call again with a detector id.

ParametersJSON Schema
NameRequiredDescriptionDefault
hoursNoHow many hours to look back (default 24, max 720).
detectorNoDetector id. Omit to list detectors.
resourceIdYesResource ID of an App Service, Function app, slot, Container App or Container Apps environment.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, non-destructive, idempotent behavior, so the description only needs to add behavioral context. It does add meaningful specifics: the two-step list-then-run pattern and the fact that it surfaces managed platform diagnostics not available through direct queries. No contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly structured: first sentence states the action and scope, second lists the valuable diagnostic categories, third gives the call pattern. Every sentence earns its place with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tool with no output schema, the description covers what the tool does, which resources it targets, why an agent would choose it, and how to sequence calls. It does not describe result shape or pagination, but given the rich annotations and clear workflow, the agent has enough to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters are already documented. The description reinforces the detector parameter's omit-to-list behavior and gives workflow guidance, but it does not add substantive semantic detail beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-plus-resource ('Runs Azure's built-in 'Diagnose and solve problems' detectors') and names the exact resource types (App Service, Function apps, Container Apps). It further lists concrete diagnostic outcomes (crashes, restarts, HTTP 5xx, CPU/memory pressure, SNAT exhaustion), making the tool's scope unmistakable and distinguishing it from generic log or metrics siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear workflow: call without a detector to list detectors, then call again with a detector id. It also signals the appropriate context ('platform data you cannot query yourself'), which implies when to prefer this over raw log/metrics tools, though it does not explicitly name alternatives or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_find_resourcesFind Azure resourcesA
Read-onlyIdempotent

Finds Azure resources by name, type, resource group, location or tag, across all your subscriptions at once. Returns resource IDs you can pass to other tools, plus type, location, SKU and provisioning state. Example: {"name": "orders-api", "type": "Microsoft.Web/sites"}. Common types: Microsoft.Web/sites (App Service and Functions), Microsoft.App/containerApps, Microsoft.ContainerService/managedClusters (AKS), Microsoft.Insights/components (Application Insights), Microsoft.OperationalInsights/workspaces (Log Analytics).

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNoPart of the resource name (case-insensitive).
tagsNoTags that must all match exactly, for example {"env": "prod"}.
typeNoExact resource type, for example Microsoft.Web/sites.
limitNoMaximum results (default 50).
locationNoAzure region, for example westeurope.
resourceGroupNoExact resource group name.
subscriptionIdsNoSubscription IDs to search. Omit to search every subscription you have access to.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds useful behavioral detail beyond that: it searches across all subscriptions, returns resource IDs plus type, location, SKU, and provisioning state, and gives representative Azure resource types. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly written: one sentence establishes what the tool does, one sentence states return value value and fields, and the example plus common-types list are compact and directly useful. No filler or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only search tool with no output schema, the description covers the essential context: what can be searched, that it spans subscriptions, what fields come back, how results are useful for downstream tools, and common type values. An agent has enough to invoke it correctly without inspecting other resources.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents all parameters with 100% coverage, so the baseline is 3. The description adds value by translating the parameter surface into a natural-language filter list, providing a concrete example combining name and type, and mapping common Azure type strings to friendly names like App Service, Functions, and AKS.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: finds Azure resources by name, type, resource group, location, or tag across all subscriptions at once. It also describes what is returned. It does not explicitly contrast itself with sibling tools like azure_resource_graph_query or azure_get_resource, so sibling differentiation is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when you need to discover resources across subscriptions by structured filters and obtain IDs for other tools. It does not state when not to use it or explicitly mention alternatives, even though sibling tools such as azure_resource_graph_query and azure_get_resource likely overlap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_get_resourceGet Azure resource detailsA
Read-onlyIdempotent

Returns the full Azure Resource Manager definition of one resource: configuration, SKU, identity, networking and state. Works for any resource type, including child resources such as deployment slots. Secret values are masked. Get the resource ID from azure_find_resources.

ParametersJSON Schema
NameRequiredDescriptionDefault
apiVersionNoOptional. By default the newest stable API version is used.
resourceIdYesFull resource ID, for example /subscriptions/<id>/resourceGroups/<group>/providers/Microsoft.Web/sites/<name>.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With four annotations (readOnlyHint, idempotentHint, openWorldHint, destructiveHint=false) already covering the safety and side-effect profile, the description adds genuinely useful behavior beyond them: 'Secret values are masked' warns the agent not to expect live credentials in the response, and the child-resource scope clarifies what 'any resource type' includes. No contradiction with annotations is present. It stops short of describing error behavior for nonexistent resources, but the masked-secrets disclosure is a meaningful value-add.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences with zero waste: primary behavior first, then scope, then the critical caveat, then the sourcing hint. Each sentence carries distinct information and the most important facts are front-loaded ahead of the auxiliary guidance. This is appropriately sized for a two-parameter read-only tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool (2 params, 1 required, no nested objects), the description covers all invocation-relevant ground: what it returns and its field inventory (partially compensating for the absent output schema), scope boundaries, a response caveat, and how to obtain the one required parameter. The four annotations complete the safety picture. The only omission—error handling for missing resources—is minor and does not affect correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both resourceId (including a full path example) and apiVersion (including default behavior) already documented, so the baseline is 3. The description contributes one extra parameter-level insight—that resourceId should be sourced from azure_find_resources—which helps the agent obtain the required argument correctly. That lifts it a notch above the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Returns the full Azure Resource Manager definition of one resource,' then enumerates the content (configuration, SKU, identity, networking, state). Explicitly noting it works for 'any resource type, including child resources such as deployment slots' distinguishes it from the resource-specific siblings like azure_aks_overview and azure_containerapp_overview. The 'one resource' scope cleanly separates it from the discovery tools azure_find_resources and azure_resource_graph_query.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear, actionable context: it is the generic full-definition lookup for any resource, and it explicitly directs the agent to 'Get the resource ID from azure_find_resources,' naming the exact sibling that supplies the required parameter. However, it never states when not to use it or that resource-specific overview tools exist as alternatives for deeper domain views, so it lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_logs_queryQuery logs (KQL)A
Read-onlyIdempotent

Runs a KQL query against Azure Monitor Logs. scope can be a Log Analytics workspace (queries the whole workspace), an Application Insights resource, or any other resource (only that resource's logs, from every workspace it sends to). Application Insights tables: AppRequests, AppDependencies, AppExceptions, AppTraces. App Service: AppServiceHTTPLogs, AppServiceConsoleLogs. AKS: ContainerLogV2, KubePodInventory, KubeEvents. Example: {"scope": "", "query": "AppRequests | where Success == false | summarize count() by ResultCode, Name | top 10 by count_"}. Use azure_telemetry_locations to find the right scope.

ParametersJSON Schema
NameRequiredDescriptionDefault
hoursNoHow many hours to look back (default 24, max 2160).
limitNoMaximum rows (default 100).
queryYesKQL query.
scopeYesResource ID of a Log Analytics workspace, Application Insights resource, or any resource.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, non-destructive, idempotent behavior. The description adds valuable behavioral context by explaining how the scope parameter affects query results (whole workspace vs. specific resource) and provides example tables for different resource types, going beyond annotation-provided safety hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core action. Every sentence earns its place: scope explanation, table examples, a query example, and a pointer to the helper tool. It is concise despite its length, with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with no output schema, the description covers scope behavior, query examples, and a scope-finding helper. It is sufficiently complete for an agent to call it correctly, though it does not describe the return format or error handling, which are minor gaps given the annotations and schema coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions cover all 4 parameters (100% coverage), but the description enriches the scope parameter with detailed semantics about what each scope type queries and gives a concrete query example. This adds meaning beyond the schema's generic descriptions, though hours/limit are not elaborated beyond schema defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Runs a KQL query against Azure Monitor Logs' and elaborates on scope types (workspace, Application Insights, or any resource), making the tool's function unambiguous. It implicitly differentiates from specialized siblings by being the general-purpose KQL tool, and the scope semantics are precise.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives context on when to use this tool (for arbitrary KQL queries) and explicitly points to azure_telemetry_locations for finding the right scope. However, it does not explicitly mention when to prefer specialized siblings like azure_appservice_logs or azure_containerapp_logs, so it lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_metricsAzure Monitor metricsA
Read-onlyIdempotent

Reads platform metrics for any resource: CPU, memory, requests, HTTP 5xx, response time, restarts, queue length, DTU and so on. Call without metrics to list the metrics a resource offers. With metrics, returns min/avg/max/latest per series and a downsampled time series. Example: {"resourceId": "...sites/orders-api", "metrics": ["Http5xx", "HttpResponseTime"], "hours": 6}. Split by a dimension with filter, e.g. "Instance eq '*'".

ParametersJSON Schema
NameRequiredDescriptionDefault
hoursNoHow many hours to look back (default 1, max 720).
filterNoDimension filter, e.g. "StatusCode eq '500'" or "Instance eq '*'" to split by instance.
metricsNoMetric names. Omit to list available metrics.
intervalNoTime grain. Chosen automatically from the time range if omitted.
resourceIdYesResource ID.
aggregationNoAggregation. Default: each metric's primary aggregation.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false. The description adds behavioral detail beyond those: the return shape (min/avg/max/latest per series plus downsampled series), the list mode, and dimension-splitting via filter. It does not mention response limits or pagination, but these are minor for a read-only metrics tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and information-dense: it states the resource, enumerates typical metrics, explains both call modes, describes the return shape, and gives a concrete example. Every sentence earns its place, and the most important facts are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 100% parameter schema coverage, strong annotations, and no output schema, the description provides a good picture of behavior and returns. It explains list mode, aggregation shape, downsampling, and filtering. It could mention the output structure more explicitly, but the tool is simple enough that this is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaningful parameter behavior: omitting metrics triggers a listing mode, and filter is used to split by dimension (e.g., 'Instance eq \'*\''). The inline example ties resourceId, metrics, and hours together, going beyond the schema's field-level definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as reading platform metrics for any Azure resource and gives concrete examples (CPU, memory, HTTP 5xx, response time). It distinguishes this from sibling tools centered on logs, activity, or resource health by focusing specifically on platform metrics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains two usage modes: omit metrics to list available metrics, or provide metrics to retrieve aggregations and time series. It does not explicitly name alternatives or exclusions, but the purpose is specific enough that an agent can infer when metrics are the right data source.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_recent_changesRecent resource changesA
Read-onlyIdempotent

Lists configuration changes to a resource, or to every resource in a resource group or subscription, over the last hours (up to 14 days): what changed, the before and after values, who changed it and through which client. Use it to answer "what changed before this broke?".

ParametersJSON Schema
NameRequiredDescriptionDefault
hoursNoHow many hours to look back (default 24, max 336).
limitNoMaximum changes (default 50).
scopeYesResource ID, resource group ID (/subscriptions/<id>/resourceGroups/<name>) or subscription ID path (/subscriptions/<id>).

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), so the description adds useful behavioral context: the 14-day lookback window, the configuration-change scope, and the returned detail fields. It does not discuss pagination or data availability delays, but for a read-only tool this is a minor gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler: the first front-loads the verb, resource, scope, and time range, and the second gives a concrete diagnostic use case. Every clause adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with a small, fully documented parameter set and no output schema, the description covers what it returns, the supported scopes, the time window, and the motivating use case. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all three parameters. The description adds context about what the list contains but no new parameter-level detail, matching the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Lists configuration changes') with an explicit resource and scope ('to a resource, or to every resource in a resource group or subscription'). It names the exact output fields (what changed, before/after values, who, client), making it clearly distinguishable from sibling log/telemetry tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The line 'Use it to answer "what changed before this broke?"' gives an explicit, concrete use case. It does not, however, mention when not to use it or point to an alternative sibling, so it stops short of the full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_resource_graph_queryQuery Azure Resource GraphA
Read-onlyIdempotent

Runs a KQL query against Azure Resource Graph: a fast, read-only index of every resource across your subscriptions. Useful tables: resources, resourcecontainers (subscriptions and resource groups), resourcechanges (recent property changes), healthresources (availability), advisorresources, policyresources. Examples: "resources | where type =~ 'microsoft.web/sites' | summarize count() by location"; "resourcechanges | where properties.changeAttributes.timestamp > ago(1d) | project properties.targetResourceId, properties.changeType, properties.changes | take 20". Use azure_find_resources for simple lookups.

ParametersJSON Schema
NameRequiredDescriptionDefault
topNoMaximum rows (default 100).
queryYesKQL query.
skipTokenNoContinuation token from a previous call, to fetch the next page.
subscriptionIdsNoSubscription IDs to search. Omit to search every subscription you have access to.
managementGroupIdsNoManagement group IDs to query instead of subscriptions.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, and the description reinforces this by calling the index 'read-only.' It adds useful behavioral context: the data source spans all accessible subscriptions, key tables are enumerated, and example queries show the kind of KQL usage expected. It does not mention pagination or API limits, but annotations cover the core safety profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded: definition, useful tables, concrete examples, and routing to an alternative. Each sentence contributes meaningful guidance without unnecessary fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex KQL query tool with no output schema, the description provides table guidance, example queries, and scope context, which is strong. It does not explain return shape or pagination flow, but the schema covers parameters and arbitrary KQL output is hard to fully specify; overall an agent has enough to call this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter. The description's examples indirectly show how the query parameter is used, but it adds no explicit detail about top, skipToken, subscriptionIds, or managementGroupIds beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific verb ('Runs a KQL query') and a specific resource ('Azure Resource Graph'), and clarifies scope ('every resource across your subscriptions'). It also explicitly distinguishes itself from azure_find_resources, so an agent can tell them apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete guidance on when to use this tool and when not to: 'Use azure_find_resources for simple lookups.' It also provides useful table names and example queries, making the intended use case clear and separating it from sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_resource_healthResource health and service issuesA
Read-onlyIdempotent

Shows whether Azure itself reports a resource as healthy: its current availability, recent availability changes with Azure's stated reason, and active Azure service issues affecting the subscription. Use it early when an app is down, to tell a platform problem apart from an application problem.

ParametersJSON Schema
NameRequiredDescriptionDefault
resourceIdYesResource ID to check.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, so the description doesn't need to restate safety. It adds value by specifying the output includes availability, recent changes with Azure's stated reason, and active service issues—details not covered by annotations. No contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The primary function is stated first, followed by usage context. Every phrase earns its place, and the description is front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only health check with a single parameter and no output schema, the description covers the essential information: what it returns and when to use it. It's complete enough for an agent to invoke correctly without additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents resourceId as 'Resource ID to check' with 100% coverage. The description adds no additional parameter semantics beyond implying the resource is Azure-managed. Since the schema handles it, a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports Azure's own health assessment of a resource, including current availability, recent changes with reasons, and active service issues. It explicitly frames the purpose as distinguishing platform problems from application problems, which distinguishes it from sibling tools like azure_activity_log or azure_metrics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance to use this tool early when an app is down, to differentiate platform vs. application issues. It implies the alternative is to check application logs or other diagnostics, though it doesn't name specific sibling tools. This is clear enough for an agent to choose appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

azure_telemetry_locationsWhere does telemetry go?A
Read-onlyIdempotent

Finds where a resource's logs and telemetry are stored: diagnostic settings (Log Analytics workspaces, storage accounts, Event Hubs, with the enabled log categories), linked Application Insights, Container Apps environment logging, and AKS Container Insights. Returns the resource IDs to use with azure_logs_query and azure_appinsights_failures, and which tables to query. Call this before querying logs for a resource you have not looked at yet.

ParametersJSON Schema
NameRequiredDescriptionDefault
resourceIdYesResource ID, for example an App Service, Container App or AKS cluster.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint false, so the safety profile is covered. The description adds useful behavioral detail by listing the types of telemetry sinks it resolves and stating that it returns both resource IDs and tables to query.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, information-dense, and front-loaded with the core action. The second sentence clearly states when to invoke the tool. No filler or redundant phrasing is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a resource-discovery tool with no output schema, the description explains what will be returned, how to use the results, and when to call it. It does not cover edge cases like unsupported resources or absence of telemetry configuration, but the core information an agent needs is presente.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter resourceId has 100% schema description coverage, so the baseline is 3. The description repeats the resource type examples from the schema but does not add substantial new semantics beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: finding where a resource's logs and telemetry are stored. It enumerates specific storage destinations and explicitly distinguishes this discovery tool from log-querying capabilities by saying it returns resource IDs and table names to use with query tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear usage instruction: call this before querying logs for a resource you have not looked at yet. It does not explicitly mention when not to use it or name alternative discovery tools, but the placement as a prerequisite to azure_logs_query and azure_appinsights_failures provides strong contextual guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 20 tool updatesv1.0.0
    • First observedazure_activity_log
    • First observedazure_aks_overview
    • First observedazure_aks_pod_logs
    • First observedazure_aks_workloads
    • First observedazure_appinsights_failures
    • First observedazure_appinsights_trace
    • First observedazure_appservice_logs
    • First observedazure_appservice_overview
    • First observedazure_containerapp_logs
    • First observedazure_containerapp_overview
    • First observedazure_context
    • First observedazure_diagnostics
    • First observedazure_find_resources
    • First observedazure_get_resource
    • First observedazure_logs_query
    • First observedazure_metrics
    • First observedazure_recent_changes
    • First observedazure_resource_graph_query
    • First observedazure_resource_health
    • First observedazure_telemetry_locations

TDQS

A4.2/5.0

Scored across 20 tools

Disambiguation4/5

Most tools are clearly distinct by resource type (App Service vs AKS vs Container Apps) and by action (overview vs logs vs metrics vs query). However, azure_logs_query and azure_appinsights_failures both query application telemetry and could be confused, though one is a raw query and the other is a pre-built triage. Also, azure_appservice_logs and azure_containerapp_logs are similar but differ by platform.

Naming Consistency4/5

The naming pattern is mostly consistent with a resource prefix (azure_<resourcetype>_<action>), e.g., azure_appservice_logs, azure_containerapp_overview, azure_aks_workloads. However, there are several tools that break this pattern: azure_context, azure_find_resources, azure_resource_graph_query, and azure_logs_query lack a clear resource type in the name, making them less predictable. But the overall style is still uniform (snake_case, resource-first).

Tool Count4/5

With 20 tools, this is at the upper edge of a well-scoped set. Each tool covers a specific debugging need, and there is no redundancy or bloat. It feels slightly heavy because azure_get_resource could be redundant with azure_find_resources plus the ARM API, but it's still reasonable given the breadth of Azure services covered.

Completeness5/5

The tool surface is remarkably complete for the domain of Azure debugging. It covers resource discovery (find_resources, resource_graph_query), state (get_resource, resource_health), metrics (azure_metrics), logs (appservice_logs, containerapp_logs, aks_pod_logs, logs_query), diagnostics (azure_diagnostics, appinsights_failures), telemetry locations (azure_telemetry_locations), and change tracking (azure_recent_changes, activity_log). It provides a full lifecycle for investigating any Azure resource, and the ability to drill down from broad to specific.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    D
    maintenance
    Provides tools for listing and querying Azure resources directly from any MCP client, allowing you to efficiently browse your Azure infrastructure and analyze costs without leaving your workflow.
    3
    -
  • A
    license
    A
    quality
    C
    maintenance
    Enables read-only querying of Azure Log Analytics and Azure Resource Graph through MCP, supporting KQL queries, workspace discovery, and resource inventory exploration with Azure RBAC authentication.
    5
    2
    MIT