azure_service_selector

Instructions

Implementation Reference

• src/tools/architecture/azure-service-selector.ts:40-73 (handler)

  The handler function 'handleServiceSelect' that executes the tool logic. It validates args via Zod schema, then calls Anthropic Claude with the ARCHITECTURE_SYSTEM prompt to recommend Azure services for government workloads.

  export async function handleServiceSelect(args: unknown): Promise<string> {
    return runTool('azure_service_selector', args, Schema, async ({ requirement, impactLevel, constraints, existingServices }) => {
      const response = await anthropic.messages.create({
        model: MODEL,
        max_tokens: getTokenBudget('azure_service_selector'),
        system: ARCHITECTURE_SYSTEM,
        messages: [
          {
            role: 'user',
            content: `Select the right Azure service(s) for this government workload requirement.
  
  **Requirement:** ${requirement}
  **Impact Level:** ${impactLevel}
  **Constraints:** ${(constraints ?? []).length > 0 ? (constraints ?? []).join(', ') : 'None specified'}
  **Existing Services:** ${(existingServices ?? []).length > 0 ? (existingServices ?? []).join(', ') : 'None specified'}
  
  For each recommendation provide:
  - Service name and exact SKU/tier recommendation
  - Why it's the right choice for ${impactLevel}
  - GCC High availability (Yes / No / Limited — be specific about limitations)
  - FedRAMP authorization status
  - Key compliance configurations required out of the box
  - What NOT to use and why (common mistakes at this impact level)
  - Cost implication: $ / $$ / $$$
  - Integration notes with existing services
  
  If multiple services are viable, rank them and explain the trade-offs.`,
          },
        ],
      });
  
      return response.content[0].type === 'text' ? response.content[0].text : '';
    });
  }

• src/tools/architecture/azure-service-selector.ts:6-31 (schema)

  The tool schema definition 'serviceSelectTool' — defines name 'azure_service_selector', description, and inputSchema with requirement (string), impactLevel (enum: fedramp-moderate/high/il4/il5), constraints (string array), and existingServices (string array).

  export const serviceSelectTool = {
    name: 'azure_service_selector',
    description:
      'Select the right Azure service for a government workload requirement with compliance rationale, GCC High availability confirmation, and alternatives analysis.',
    inputSchema: {
      type: 'object' as const,
      properties: {
        requirement: { type: 'string', description: 'Describe what you need to accomplish' },
        impactLevel: {
          type: 'string',
          enum: ['fedramp-moderate', 'fedramp-high', 'il4', 'il5'],
        },
        constraints: {
          type: 'array',
          items: { type: 'string' },
          description: 'e.g. ["no-public-endpoint","fips-140-2-required","cac-piv-auth"]',
        },
        existingServices: {
          type: 'array',
          items: { type: 'string' },
          description: 'Azure services already in the environment',
        },
      },
      required: ['requirement', 'impactLevel'],
    },
  };

• src/tools/architecture/azure-service-selector.ts:33-38 (schema)

  Zod validation schema for runtime input validation: requirement max 500 chars, impactLevel enum, constraints max 20 items each 500 chars, existingServices max 20 items each 500 chars.

  const Schema = z.object({
    requirement: z.string().max(500),
    impactLevel: z.enum(['fedramp-moderate', 'fedramp-high', 'il4', 'il5']),
    constraints: z.array(z.string().max(500)).max(20).default([]),
    existingServices: z.array(z.string().max(500)).max(20).default([]),
  });

• src/tools/index.ts:11-87 (registration)

  Import of serviceSelectTool and handleServiceSelect from azure-service-selector module.

  import { serviceSelectTool, handleServiceSelect } from './architecture/azure-service-selector.js';
  import { gccHighTool, handleGccHigh } from './architecture/gcc-high-guidance.js';
  import { privateEndpointTool, handlePrivateEndpoint } from './architecture/private-endpoint-map.js';
  
  import { bigbangValidateTool, handleBigbangValidate } from './platform-one/bigbang-validate.js';
  import { bigbangHardenTool, handleBigbangHarden } from './platform-one/bigbang-harden.js';
  import { ironbankLookupTool, handleIronbankLookup } from './platform-one/ironbank-lookup.js';
  import { addonConfiguratorTool, handleAddonConfigurator } from './platform-one/addon-configurator.js';
  
  import { pipelineAuditTool, handlePipelineAudit } from './pipeline/pipeline-audit.js';
  import { signingConfigTool, handleSigningConfig } from './pipeline/signing-config.js';
  import { devsecopsScoreCardTool, handleDevsecopsScorecard } from './pipeline/devsecops-scorecard.js';
  
  import { sspSectionTool, handleSspSection } from './documents/ssp-section.js';
  import { contingencyPlanTool, handleContingencyPlan } from './documents/contingency-plan.js';
  
  import { govcloudQuickstartTool, handleGovcloudQuickstart } from './govcloud-quickstart.js';
  
  export const allTools = [
    // Compliance
    bicepAnalyzeTool,
    bicepRemediateTool,
    controlLookupTool,
    controlNarrativeTool,
    poamGenerateTool,
    atoReadinessTool,
    oscalFragmentTool,
    // Architecture
    landingZoneTool,
    landingZoneReferenceTool,
    serviceSelectTool,
    gccHighTool,
    privateEndpointTool,
    // Platform One
    bigbangValidateTool,
    bigbangHardenTool,
    ironbankLookupTool,
    addonConfiguratorTool,
    // Pipeline
    pipelineAuditTool,
    signingConfigTool,
    devsecopsScoreCardTool,
    // Documents
    sspSectionTool,
    contingencyPlanTool,
    // Meta
    govcloudQuickstartTool,
  ];
  
  export async function handleToolCall(name: string, args: unknown): Promise<string> {
    switch (name) {
      case 'bicep_analyze':         return handleBicepAnalyze(args);
      case 'bicep_remediate':       return handleBicepRemediate(args);
      case 'control_lookup':        return handleControlLookup(args);
      case 'control_narrative':     return handleControlNarrative(args);
      case 'poam_generate':         return handlePoamGenerate(args);
      case 'ato_readiness':         return handleAtoReadiness(args);
      case 'oscal_fragment':        return handleOscalFragment(args);
      case 'landing_zone_design':   return handleLandingZone(args);
      case 'landing_zone_reference': return handleLandingZoneReference(args);
      case 'azure_service_selector': return handleServiceSelect(args);
      case 'gcc_high_guidance':     return handleGccHigh(args);
      case 'private_endpoint_map':  return handlePrivateEndpoint(args);
      case 'bigbang_validate':      return handleBigbangValidate(args);
      case 'bigbang_harden':        return handleBigbangHarden(args);
      case 'ironbank_lookup':       return handleIronbankLookup(args);
      case 'addon_configurator':    return handleAddonConfigurator(args);
      case 'pipeline_audit':        return handlePipelineAudit(args);
      case 'signing_config':        return handleSigningConfig(args);
      case 'devsecops_scorecard':   return handleDevsecopsScorecard(args);
      case 'ssp_section':           return handleSspSection(args);
      case 'contingency_plan':      return handleContingencyPlan(args);
      case 'govcloud_quickstart':   return handleGovcloudQuickstart(args);
      default:
        throw new Error(`Unknown tool: ${name}`);
    }
  }

• src/tools/index.ts:71-87 (registration)

  Registration in the tool dispatch switch statement: case 'azure_service_selector' maps to handleServiceSelect(args).

      case 'azure_service_selector': return handleServiceSelect(args);
      case 'gcc_high_guidance':     return handleGccHigh(args);
      case 'private_endpoint_map':  return handlePrivateEndpoint(args);
      case 'bigbang_validate':      return handleBigbangValidate(args);
      case 'bigbang_harden':        return handleBigbangHarden(args);
      case 'ironbank_lookup':       return handleIronbankLookup(args);
      case 'addon_configurator':    return handleAddonConfigurator(args);
      case 'pipeline_audit':        return handlePipelineAudit(args);
      case 'signing_config':        return handleSigningConfig(args);
      case 'devsecops_scorecard':   return handleDevsecopsScorecard(args);
      case 'ssp_section':           return handleSspSection(args);
      case 'contingency_plan':      return handleContingencyPlan(args);
      case 'govcloud_quickstart':   return handleGovcloudQuickstart(args);
      default:
        throw new Error(`Unknown tool: ${name}`);
    }
  }