What can you do with this server?

It is an MCP server for safely inventorying and operating Azure resources via the Azure Resource Manager API, with role-based governance. * Inventory (read-only): list subscriptions, list locations, list resource groups, list resources, and get a resource by full ARM ID. * Write operations: create resource groups in approved locations, merge tags onto resources, and control VM power state (start/stop/restart/deallocate). * Admin operations: delete resource groups and individual resources, gated by AZURE_ALLOW_DELETE and typed confirmation. * Governance controls: access modes (read-only, read-write, admin), subscription/resource-group allowlists, protected resource groups, location allowlist, dry-run mode, audit logging, and interactive human approval for destructive actions.

How do I use mcp-azure?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-azure List all resource groups in my subscription and show their locations." That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

de en es ja ko ru zh

mcp-azure

by dockndevai

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

mcp-azure

License: MIT npm

A Model Context Protocol server for Azure (via the Azure Resource Manager API — the programmatic layer behind the Azure Portal). It lets an MCP-capable client (Claude Desktop, Claude Code, Cursor, Codex, …) inventory and operate Azure resources — with a governance layer that keeps an AI agent inside safe boundaries.

What this offers

Inventory — list subscriptions, locations, resource groups, and resources; get any resource by ARM id.
Operations — create resource groups (in approved regions), merge tags onto any resource, and control VM power state (start / stop / restart / deallocate).
Lifecycle — delete resource groups and individual resources, guarded.
Governance built in — access modes, subscription/resource-group allowlists, protected resource groups, a location allowlist for new groups, delete gating, typed confirmation for high-impact deletes, dry-run, and JSON audit logging.

Related MCP server: Azure MCP Server

Governance & security model

Concern	Flag	Default	Effect
What can the server do?	`AZURE_MODE`	`read-only`	`read-only` → inventory; `read-write` → create RG, tag, VM power; `admin` → deletes. Tools above the mode are never registered.
Which subscriptions?	`AZURE_SUBSCRIPTION_ALLOWLIST`	(all)	Operations on other subscriptions are refused.
Which resource groups?	`AZURE_RESOURCE_GROUP_ALLOWLIST`	(all)	Operations outside the list are refused.
Read-only-forever groups	`AZURE_PROTECTED_RESOURCE_GROUPS`	(none)	Readable, never mutable.
Approved regions	`AZURE_LOCATION_ALLOWLIST`	(any)	New resource groups may only be created here.
Can it delete?	`AZURE_ALLOW_DELETE`	`false`	Deletes need this and admin mode.
Typed confirmation	`AZURE_REQUIRE_CONFIRMATION`	`true`	Deletes require `confirm` to equal the target name — not just a boolean.
Preview	`AZURE_DRY_RUN`	`false`	Write/admin tools validate + log intent, then return.
Audit trail	`AZURE_AUDIT_LOG`	`true`	JSON line to stderr per guarded operation.
Interactive confirmation	(automatic)	—	Destructive & high-impact actions prompt the human to approve via MCP elicitation before running; clients without elicitation fall back to the `_ALLOW_` gate.

Tools

Read (read-only+): list_subscriptions, list_locations, list_resource_groups, list_resources, get_resource

Write (read-write+): create_resource_group, tag_resource, control_vm

Admin (admin): delete_resource_group, delete_resource (both need AZURE_ALLOW_DELETE + typed confirm)

Quickstart — add to your agent

Published on npm as @dockndevai/mcp-azure. Runs via npx with an Entra ID service principal. See docs/CLIENTS.md for every client and .env.example for all variables.

Claude Code

claude mcp add azure -e AZURE_TENANT_ID="…" -e AZURE_CLIENT_ID="…" -e AZURE_CLIENT_SECRET="…" -e AZURE_SUBSCRIPTION_ID="…" -e AZURE_MODE="read-only" -- npx -y @dockndevai/mcp-azure

Claude Desktop · Cursor · Windsurf

{
  "mcpServers": {
    "azure": {
      "command": "npx",
      "args": ["-y", "@dockndevai/mcp-azure"],
      "env": {
        "AZURE_TENANT_ID": "…",
        "AZURE_CLIENT_ID": "…",
        "AZURE_CLIENT_SECRET": "…",
        "AZURE_SUBSCRIPTION_ID": "…",
        "AZURE_MODE": "read-only"
      }
    }
  }
}

Example prompts

"List all resource groups in my subscription and which region each is in"
"Show every resource in the rg-web group"
"Tag the app-plan resource with env=prod and owner=team-a" (needs read-write)
"Stop the build-agent VM in rg-ci" (needs read-write)

Run from source (development)

npm install
npm run build
node dist/index.js   # with the environment variables set

Develop

npm run dev
npm test          # governance policy: modes, scoping, location allowlist, delete + confirmation
npm run typecheck

Publishing

Ships a server.json for the official MCP registry and an mcpName for npm ownership validation. See PUBLISHING.md.

License

MIT

Available Tools

5 tools

get_resourceGet resourceA

Read-onlyIdempotent

Fetch a resource by its full ARM id. Provide the api-version for the resource type.

ParametersJSON Schema

Name	Required	Description	Default
`apiVersion`	Yes	API version for this resource type, e.g. 2023-07-01
`resourceId`	Yes	Full ARM resource id (/subscriptions/…/providers/…)

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The word 'Fetch' aligns with the annotations (readOnlyHint=true, idempotentHint=true, destructiveHint=false), but the description adds no behavioral context beyond what the annotations already provide. It does not mention failure modes, existence handling, or auth requirements. No contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The core action is front-loaded, and the second sentence gives the one essential usage detail. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, read-only GET tool with two required string parameters, the description is largely sufficient: it identifies the target and the required inputs. It could be more complete by stating the return shape or error behavior, especially since there is no output schema, but the core calling contract is clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents resourceId and apiVersion. The description adds little beyond restating 'full ARM id' and 'api-version for the resource type.' Baseline 3 is appropriate because the schema carries the semantic weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Fetch a resource by its full ARM id.' This clearly distinguishes it from the list_* sibling tools, which enumerate resources rather than fetch a single one. The required id-based access makes the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the main usage scenario: call this when you have a full ARM resource id and need the resource. It also tells the caller to provide the api-version. However, it does not explicitly contrast with list_resources or state when not to use this tool, so the guidance is mostly implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_locationsList locationsA

Read-onlyIdempotent

List the regions available to a subscription.

ParametersJSON Schema

Name	Required	Description	Default
`subscription`	No	Subscription id (defaults to AZURE_SUBSCRIPTION_ID)

TDQS

A3.9/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds that the listing is scoped to a subscription, providing mild behavioral context, but does not mention pagination, ordering, or return format. This does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, short sentence containing only the essential verb and resource. It is front-loaded and contains no filler or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity, read-only list tool with one optional, fully documented parameter and rich annotations, the description is complete enough. The absence of an output schema is not a significant gap because the tool's name and description make the return type obvious.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with the sole parameter 'subscription' already documented as defaulting to AZURE_SUBSCRIPTION_ID. The description adds no additional parameter-level semantics, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and resource ('regions available to a subscription'), making the tool's purpose clear. It is readily distinguished from sibling tools like list_subscriptions, list_resource_groups, and list_resources because it targets locations/regions specifically.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the resource type, but the description does not explicitly state when to use this tool over alternatives or mention any exclusions. For a simple list operation this is acceptable, yet no direct comparison to siblings is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_resource_groupsList resource groupsA

Read-onlyIdempotent

List resource groups in a subscription (filtered by allowlist).

ParametersJSON Schema

Name	Required	Description	Default
`subscription`	No	Subscription id (defaults to AZURE_SUBSCRIPTION_ID)

TDQS

A3.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false, covering the safety profile. The description adds a genuinely useful behavioral trait beyond annotations: the result list is filtered by an allowlist, meaning it may not reflect every resource group in the subscription. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with zero filler. 'List resource groups in a subscription (filtered by allowlist)' conveys resource, scope, and a behavioral caveat in nine words, and every element earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, one-optional-parameter listing tool, the definition is essentially complete: annotations carry safety and open-world semantics, the schema covers the parameter, and the description explains the allowlist filtering. The only shortfall is the absence of any sibling-routing context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the subscription parameter is fully documented in the schema. The description adds no parameter-level detail beyond the schema; its 'in a subscription' phrasing merely mirrors the existing parameter semantics. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (List), a distinct resource (resource groups), and a scope (in a subscription), and adds the allowlist filtering nuance. It is clearly differentiated from sibling tools by resource type — list_resources and list_subscriptions are obviously different — though it never names them or explicitly contrasts itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus list_subscriptions, list_resources, or get_resource. There are no exclusions, prerequisites, or alternative-routing hints; the only usage signal is the implied one from the verb and resource type.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_resourcesList resourcesA

Read-onlyIdempotent

List resources in a subscription, or within a specific resource group.

ParametersJSON Schema

Name	Required	Description	Default
`subscription`	No	Subscription id (defaults to AZURE_SUBSCRIPTION_ID)
`resourceGroup`	No	Limit to this resource group

TDQS

A3.8/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds the resource-group filtering capability but does not disclose behaviors like pagination, large-result handling, or the output shape. This is acceptable for a straightforward read-only list operation but not highly transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. Every clause contributes meaning: the verb, the resource type, and the optional scope qualifier.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list operation with two optional parameters and full schema coverage, the description is nearly complete. The only minor gap is that, with no output schema, it does not describe the return payload shape or pagination, but this is not essential for a safe, idempotent listing operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with the schema already documenting that subscription defaults to AZURE_SUBSCRIPTION_ID and resourceGroup limits results to that group. The description's mention of 'within a specific resource group' reinforces but does not add meaning beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource type ('resources') and clearly defines the two scopes it supports: a whole subscription or a single resource group. This distinguishes it from sibling tools like list_resource_groups and get_resource, which operate on different resources or cardinality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'in a subscription, or within a specific resource group' indicates when to use the tool based on scope, but it does not explicitly state when to prefer a sibling such as get_resource for a single resource or list_resource_groups for groups. The usage guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_subscriptionsList subscriptionsA

Read-onlyIdempotent

List subscriptions the service principal can see (filtered by allowlist).

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds useful behavioral context beyond those annotations by clarifying that results are filtered by allowlist and limited to what the service principal can see. There is no contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. The core listing action, the resource, and the filtering behavior are all communicated efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list operation with rich annotations, the description is complete: an agent knows what resource is being listed and what population filter applies. The return shape is self-evident from the verb 'List', and no additional prerequisites or caveats are needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters and the schema coverage is 100%, so there is no parameter-level information for the description to add. The description instead clarifies the output scope, which is appropriate for a no-argument tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource ('subscriptions') and a clear verb ('List'), and adds an important scope qualifier: only those the service principal can see and that pass the allowlist filter. This makes it easy to distinguish from sibling list tools operating on locations, resource groups, or resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended context is clear: use this when you need subscriptions visible to the service principal. It does not explicitly state when not to use it or name alternatives, but the sibling tool names and the resource-focused wording make the appropriate selection reasonably inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

5 tool updatesv0.1.1Aug 29, 2026
- First observedget_resource
- First observedlist_locations
- First observedlist_resource_groups
- First observedlist_resources
- First observedlist_subscriptions

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.1/5.0

Scored 2026-08-30 20:10 across 5 tools

Disambiguation5/5

Each tool targets a distinct level of the Azure hierarchy: subscriptions, locations, resource groups, resource collection, and individual resources by ARM ID. There is no overlap between them, and list_resources clearly differs from get_resource by operating on collections rather than a single resource.

Naming Consistency5/5

All tools follow a consistent snake_case verb_noun pattern: list_* for collection operations and get_ for a single resource fetch. The naming is predictable and uniform across the entire set.

Tool Count5/5

Five tools is well-scoped for a read-only Azure resource explorer. Each tool covers a meaningful and distinct part of the subscription/resource group/resource hierarchy without unnecessary duplication or bloat.

Completeness4/5

The tool set provides solid coverage for read-only Azure inventory: subscriptions, regions, resource groups, resource listing, and individual resource retrieval. Minor gaps exist such as no direct get for a subscription or resource group by name, and no write/management operations, but that appears to align with the apparent read-only purpose.

Maintenance

ActivityMaintained

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Related MCP Connectors

OneDroid SynapseOAuth
ai.onedroid
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
Security Observability
1
ZopDev MCPOAuth
dev.zop
Cloud cost, inventory and governance on AWS/Azure/GCP. Read-only by default, optional scoped writes
Cloud Platforms Security
1
copilotcliswitchgate-mcp
com.clauxel.copilotcliswitchgate
Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid
CI/CD & DevOps Feature Flags Developer Tools
2
a2aidentitytoll-mcp
com.clauxel.a2aidentitytoll
Remote MCP for A2A caller identity, scope policy, verdict receipts, and audit history.
Security Autonomous Agents
2

Related MCP Servers

Azure Resource MCP Server
Cloud Platforms Databases
tim10002
F
license
Not graded
quality
D
maintenance
Provides tools for listing and querying Azure resources directly from any MCP client, allowing you to efficiently browse your Azure infrastructure and analyze costs without leaving your workflow.
Updated a year ago (2025-03-25 17:45 UTC)
3
-
Azure MCP Server
Cloud Platforms Virtualization
idofrizler
A
license
Not graded
quality
D
maintenance
An MCP server for interacting with Azure. Contains some common Compute and Networking actions, and extensible to add many more.
Updated a year ago (2025-04-06 17:02 UTC)
1
Apache 2.0
mcp-azure-toolkit
Cloud Platforms Developer Tools
TemidireAdesiji
A
license
Not graded
quality
D
maintenance
An MCP server that exposes core Azure services as read-mostly tools any MCP client can call, including Blob Storage, Key Vault, Service Bus, and Resource Manager.
Updated 3 months ago (2026-06-08 22:46 UTC)
1
MIT
azure-compliance-mcp
Cloud Platforms Monitoring Security
vivekanjana76
A
license
A
quality
B
maintenance
Enables natural-language queries about Azure resource compliance, including VM compliance, patch status, orphaned RBAC, and infrastructure health, through read-only MCP tools.
Updated 2 months ago (2026-07-18 10:38 UTC)
3
MIT