private_endpoint_map

Instructions

Implementation Reference

• src/tools/architecture/private-endpoint-map.ts:36-69 (handler)

  The handler function that executes the private_endpoint_map tool logic. It takes validated args, calls Anthropic Claude with an architecture system prompt to generate private endpoint Bicep code, DNS zones, NSG rules, and other Azure networking artifacts.

  export async function handlePrivateEndpoint(args: unknown): Promise<string> {
    return runTool('private_endpoint_map', args, Schema, async ({ services, impactLevel, vnetCidr, dnsZoneSubscriptionId }) => {
      const response = await anthropic.messages.create({
        model: MODEL,
        max_tokens: getTokenBudget('private_endpoint_map'),
        system: ARCHITECTURE_SYSTEM,
        messages: [
          {
            role: 'user',
            content: `Generate the complete private endpoint architecture for these Azure services at ${impactLevel}.
  
  **Services:** ${services.join(', ')}
  **Impact Level:** ${impactLevel}
  ${vnetCidr ? `**VNet CIDR:** ${vnetCidr}` : ''}
  ${dnsZoneSubscriptionId ? `**DNS Zone Subscription:** ${dnsZoneSubscriptionId}` : ''}
  
  Provide:
  1. Which services REQUIRE private endpoints at ${impactLevel} (with NIST control rationale)
  2. Which services RECOMMEND but don't require private endpoints
  3. All private DNS zones needed (exact zone names: privatelink.*.azure.com)
  4. Subnet requirements and CIDR recommendations (with justification)
  5. Complete Bicep for all private endpoints and DNS zone group linkages
  6. NSG rules required to allow private endpoint traffic
  7. DNS forwarding configuration for hybrid on-prem scenarios
  8. GCC High-specific endpoint differences where applicable
  
  Use actual Azure private link DNS zone names and ARM resource types.`,
          },
        ],
      });
  
      return response.content[0].type === 'text' ? response.content[0].text : '';
    });
  }

• src/tools/architecture/private-endpoint-map.ts:29-34 (schema)

  Zod schema for validating inputs: services (array of strings, 1-50 items), impactLevel (enum: fedramp-moderate/fedramp-high/il4/il5), optional vnetCidr and dnsZoneSubscriptionId.

  const Schema = z.object({
    services: z.array(z.string().max(500)).min(1).max(50),
    impactLevel: z.enum(['fedramp-moderate', 'fedramp-high', 'il4', 'il5']),
    vnetCidr: z.string().max(500).optional(),
    dnsZoneSubscriptionId: z.string().max(500).optional(),
  });

• src/tools/architecture/private-endpoint-map.ts:10-27 (schema)

  MCP input schema definition for the private_endpoint_map tool, declaring the JSON Schema for services, impactLevel, vnetCidr, and dnsZoneSubscriptionId parameters.

    inputSchema: {
      type: 'object' as const,
      properties: {
        services: {
          type: 'array',
          items: { type: 'string' },
          description: 'Azure services e.g. ["Key Vault","Storage Account","AKS"]',
        },
        impactLevel: {
          type: 'string',
          enum: ['fedramp-moderate', 'fedramp-high', 'il4', 'il5'],
        },
        vnetCidr: { type: 'string', description: 'VNet CIDR e.g. "10.0.0.0/16"' },
        dnsZoneSubscriptionId: { type: 'string', description: 'Subscription ID for private DNS zones' },
      },
      required: ['services', 'impactLevel'],
    },
  };

• src/tools/index.ts:84-86 (registration)

  Missing tool name's default handler returns an error

    default:
      throw new Error(`Unknown tool: ${name}`);
  }

• src/utils/tool-runner.ts:22-31 (helper)

  Token budget configuration for private_endpoint_map (4096 max_tokens) and timeout configuration (30000ms), both used by the runTool helper.

    private_endpoint_map: 4096,
    devsecops_scorecard: 3072,
    bigbang_validate: 3072,
    gcc_high_guidance: 2048,
    signing_config: 2048,
    azure_service_selector: 2048,
    ironbank_lookup: 1024,
    govcloud_quickstart: 1024,
    bicep_analyze: 4096,
  };