de en es ja ko ru zh

mcp-azure

Name: mcp-azure
Author: dockndevai

by dockndevai

Overview Schema Source Related Servers Discussions Admin

TypeScript

Remote

mcp-azure

License: MIT npm

Azure용 Model Context Protocol 서버입니다. Azure Portal 뒤에 있는 프로그래매틱 계층인 Azure Resource Manager API를 통해 동작하며, MCP 지원 클라이언트(Claude Desktop, Claude Code, Cursor, Codex 등)가 Azure 리소스를 조회하고 운영할 수 있게 해줍니다. AI 에이전트가 안전한 경계 안에서 움직이도록 하는 거버넌스 계층이 포함되어 있습니다.

제공 기능

인벤토리(Inventory) — 구독, 위치, 리소스 그룹, 리소스를 조회하고 ARM ID로 모든 리소스를 가져올 수 있습니다.
운영(Operations) — 승인된 지역에 리소스 그룹을 만들고, 모든 리소스에 태그를 병합하며, VM 전원 상태를 제어합니다(start / stop / restart / deallocate).
수명 주기(Lifecycle) — 보호 장치가 갖춰진 리소스 그룹 및 개별 리소스 삭제를 실행합니다.
거버넌스 내장 — 액세스 모드, 구독/리소스 그룹 허용 목록, 보호된 리소스 그룹, 신규 그룹용 지역 허용 목록, 삭제 게이팅, 고영향 삭제에 대한 타자 확인(typed confirmation), dry-run, JSON 감사 로깅까지 지원합니다.

Related MCP server: Azure MCP Server

거버넌스 및 보안 모델

항목	플래그	기본값	효과
서버가 무엇을 할 수 있나요?	`AZURE_MODE`	`read-only`	`read-only` → 인벤토리, `read-write` → 리소스 그룹 생성·태그·VM 전원, `admin` → 삭제. 모드를 초과하는 도구는 등록되지 않습니다.
어느 구독을 허용 하나요?	`AZURE_SUBSCRIPTION_ALLOWLIST`	(모두)	다른 구독에 대한 작업은 거부됩니다.
어느 리소스 그룹을 허용하나요?	`AZURE_RESOURCE_GROUP_ALLOWLIST`	(모두)	목록에 없는 리소스 그룹에 대한 작업은 거부됩니다.
영구 읽기 전용 그룹	`AZURE_PROTECTED_RESOURCE_GROUPS`	(없음)	읽기 가능, 절대 변경 불가능.
승인된 지역	`AZURE_LOCATION_ALLOWLIST`	(모든 위치)	새 리소스 그룹은 여기에서만 생성할 수 있습니다.
삭제를 허용할까?	`AZURE_ALLOW_DELETE`	`false`	삭제하려면 이 항목 및 admin 모드가 필요합니다.
타입 확인	`AZURE_REQUIRE_CONFIRMATION`	`true`	삭제 시 `confirm` 값이 대상 이름과 일치해야 합니다. 단순 boolean이 아닙니다.
미리 보기	`AZURE_DRY_RUN`	`false`	쓰기/관리자 도구가 의도만 기록하고 동작을 실행하지 않습니다.
감사 기록	`AZURE_AUDIT_LOG`	`true`	보호된 작업마다 JSON 감사 기록이 stderr로 출력됩니다.

도구

읽기(Read-only+): list_subscriptions, list_locations, list_resource_groups, list_resources, get_resource

쓰기(read-write+): create_resource_group, tag_resource, control_vm

관리자(admin): delete_resource_group, delete_resource (모두 AZURE_ALLOW_DELETE와 타입 확인 confirm 필요)

빠른 시작 — 에이전트에 추가하기

npm의 @dockndevai/mcp-azure 로 배포되어 있습니다. Entra ID 서비스 주체와 함께 npx 로 실행됩니다. 각 클라이언트의 자세한 사용법은 docs/CLIENTS.md를, 전체 환경 변수는 .env.example를 참조하세요.

Claude Code

claude mcp add azure -e AZURE_TENANT_ID="…" -e AZURE_CLIENT_ID="…" -e AZURE_CLIENT_SECRET="…" -e AZURE_SUBSCRIPTION_ID="…" -e AZURE_MODE="read-only" -- npx -y @dockndevai/mcp-azure

Claude Desktop · Cursor · Windsurf

{
  "mcpServers": {
    "azure": {
      "command": "npx",
      "args": ["-y", "@dockndevai/mcp-azure"],
      "env": {
        "AZURE_TENANT_ID": "…",
        "AZURE_CLIENT_ID": "…",
        "AZURE_CLIENT_SECRET": "…",
        "AZURE_SUBSCRIPTION_ID": "…",
        "AZURE_MODE": "read-only"
      }
    }
  }
}

예시 프롬프트

"내 구독의 모든 리소스 그룹과 각 그룹이 어느 지역에 있는지 나열해 줘"
"rg-web 그룹의 모든 리소스를 보여 줘"
"app-plan 리소스에 env=prod 및 owner=team-a 태그를 지정해 줘" (read-write 필요)
"rg-ci의 build-agent VM을 중지해 줘" (read-write 필요)

소스에서 실행(개발)

npm install
npm run build
node dist/index.js   # with the environment variables set

개발

npm run dev
npm test          # governance policy: modes, scoping, location allowlist, delete + confirmation
npm run typecheck

배포

공식 MCP 레지스트리용 server.json과 npm 소유권 검증용 mcpName이 포함되어 있습니다. **PUBLISHING.md**를 참조하세요.

라이선스

MIT

Available Tools

5 tools

get_resourceGet resourceB

Read-onlyIdempotent

Fetch a resource by its full ARM id. Provide the api-version for the resource type.

Name	Required	Description	Default
`apiVersion`	Yes	API version for this resource type, e.g. 2023-07-01
`resourceId`	Yes	Full ARM resource id (/subscriptions/…/providers/…)

TDQS

B3.4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, so the safety profile is fully covered. The description adds only that an API version must be supplied, which is prerequisite-flavored but reveals nothing about auth, throttling, or return shape; with annotations doing the heavy lifting, this is adequate but minimal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core action and its key input. No filler or redundancy; every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only fetch of a single resource, the description plus rich annotations are nearly sufficient. Since no output schema exists, one might expect a brief note on what is returned, but the tool's nature makes that largely inferable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with both params documented (full ARM id format, API version example), so the schema already carries the semantics. The description restates the same two inputs without adding format, syntax, or validation detail beyond the schema, making the baseline 3 correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Fetch a resource by its full ARM id'), which contrasts naturally with the list_* siblings. It clearly distinguishes single-resource retrieval from enumeration, though it does not explicitly name an alternative sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only usage-adjacent sentence ('Provide the api-version for the resource type') is a parameter instruction rather than guidance on when to use this tool. There is no mention of when to prefer it over list_resources or any prerequisite/exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_locationsList locationsC

Read-onlyIdempotent

List the regions available to a subscription.

Name	Required	Description	Default
`subscription`	No	Subscription id (defaults to AZURE_SUBSCRIPTION_ID)

TDQS

C2.9/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds little beyond that—it doesn't mention pagination, output format, or the significance of 'available' regions (e.g., availability for deployment).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, concise sentence that is front-loaded with the action and resource. No extraneous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with full schema coverage and annotations, the description is adequate but minimal. It lacks any mention of the return structure or sorting, and does not provide usage context. Output schema is absent, but for a list operation the return format could be inferred.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the single parameter (subscription) is fully documented in the schema, including the default behavior. The description adds no parameter details, so a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (list) and resource (locations/regions) scoped to a subscription. It is distinguishable from siblings like list_resources and list_resource_groups, though it slightly uses 'locations' and 'regions' interchangeably without clarifying this.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives like list_resources or list_subscriptions. The context of needing a subscription's regions is implied but not stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_resource_groupsList resource groupsB

Read-onlyIdempotent

List resource groups in a subscription (filtered by allowlist).

Name	Required	Description	Default
`subscription`	No	Subscription id (defaults to AZURE_SUBSCRIPTION_ID)

TDQS

B3.2/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint, so the safety/behavior profile is well covered. The description adds an unexplained 'allowlist' filter constraint but doesn't say who controls it, whether access failures are surfaced, or how results are ordered or paginated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence, front-loaded with the action. The parenthetical is terse to the point of being unclear, but there is no waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-required-param list tool with rich annotations and full schema coverage, the core need is met. However, the unexplained allowlist filtering leaves an agent unsure whether calls will silently return empty or fail, which is meaningful context for a discovery tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single parameter 'subscription' is fully documented in the schema including its AZURE_SUBSCRIPTION_ID default. The description adds nothing beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb+resource ('List resource groups') with a scope qualifier ('in a subscription'). It's distinguishable from siblings like list_subscriptions and list_resources, though the parentheses note about allowlist filtering is cryptic and unexplained.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'filtered by allowlist' implies a usage constraint but never states when to use this versus list_resources, whether the allowlist is user-configurable, or what happens when a subscription isn't in the allowlist. No explicit when/when-not guidance or alternatives named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_resourcesList resourcesB

Read-onlyIdempotent

List resources in a subscription, or within a specific resource group.

Name	Required	Description	Default
`subscription`	No	Subscription id (defaults to AZURE_SUBSCRIPTION_ID)
`resourceGroup`	No	Limit to this resource group

TDQS

B3.4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint, covering the safety profile. The description adds only the scoping behavior (subscription-wide or resource-group-limited), which is useful context but duplicated by the parameter schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no wasted words. The scope constraint is stated immediately and nothing else is needed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list tool with full annotation coverage and 100% schema coverage, the description supplies adequate scope context. It omits return-shape details, but no output schema exists and the tool is straightforward enough that this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, documenting both optional parameters including the default subscription behavior. The description adds no format or semantic detail beyond what the schema already provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (resources) with scope (subscription or resource group). It implicitly separates itself from siblings like list_resource_groups and get_resource, but never names or explicitly contrasts them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance or alternatives are given. The agent is not told when to prefer this over get_resource or list_resource_groups, nor any prerequisites for either scope.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_subscriptionsList subscriptionsA

Read-onlyIdempotent

List subscriptions the service principal can see (filtered by allowlist).

Name	Required	Description	Default
No parameters

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds useful behavioral context beyond those annotations by clarifying that results are filtered by allowlist and limited to what the service principal can see. There is no contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. The core listing action, the resource, and the filtering behavior are all communicated efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list operation with rich annotations, the description is complete: an agent knows what resource is being listed and what population filter applies. The return shape is self-evident from the verb 'List', and no additional prerequisites or caveats are needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters and the schema coverage is 100%, so there is no parameter-level information for the description to add. The description instead clarifies the output scope, which is appropriate for a no-argument tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource ('subscriptions') and a clear verb ('List'), and adds an important scope qualifier: only those the service principal can see and that pass the allowlist filter. This makes it easy to distinguish from sibling list tools operating on locations, resource groups, or resources.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended context is clear: use this when you need subscriptions visible to the service principal. It does not explicitly state when not to use it or name alternatives, but the sibling tool names and the resource-focused wording make the appropriate selection reasonably inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

4 tool updatesv0.2.2Sep 13, 2026
- Changedget_resource1 field changed
  - removedInput schema / additionalProperties
```
Removed value: -false
```
- Changedlist_locations1 field changed
  - removedInput schema / additionalProperties
```
Removed value: -false
```
- Changedlist_resource_groups1 field changed
  - removedInput schema / additionalProperties
```
Removed value: -false
```
- Changedlist_resources1 field changed
  - removedInput schema / additionalProperties
```
Removed value: -false
```
5 tool updatesv0.1.1Aug 29, 2026
- First observedget_resource
- First observedlist_locations
- First observedlist_resource_groups
- First observedlist_resources
- First observedlist_subscriptions

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.7/5.0

Scored 2026-09-13 19:31 across 5 tools

Disambiguation5/5

Each tool targets a distinct Azure resource type or action: subscriptions, locations, resource groups, resource lists, and single resource retrieval. The boundary between list_resources and get_resource is clear (collection vs. individual by ARM id). No overlapping purposes.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern: list_subscriptions, list_locations, list_resource_groups, list_resources, get_resource. The single get_ prefix is predictable and fits the same convention.

Tool Count5/5

Five tools is well within the typical 3–15 range and each tool serves a clear, non-redundant purpose for Azure resource discovery. The set is concise and focused.

Completeness3/5

The surface covers listing and getting Azure resources but omits any create, update, or delete operations for resource groups or resources, as well as deployment and provider management. These are notable gaps for a general Azure management MCP.

Maintenance

ActivityActive

ResponsivenessSyncing

Resources

Related MCP Connectors

OneDroid Synapse
ai.onedroid
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
Security Observability
1
https://synapse.onedroid.ai/agent/mcp
Leash
io.github.open-leash
Hosted remote MCP for protected account access, permissions, activity history and supported undo.
Security Monitoring Developer Tools
1
https://secure.lea.sh/mcp
ZopDev MCP
dev.zop
Cloud cost, inventory and governance on AWS/Azure/GCP. Read-only by default, optional scoped writes
Cloud Platforms Security
1
https://api.zop.dev/mcp-server
Toolstile
io.github.toolstile
Managed MCP gateway with OAuth, per-agent permissions, shared accounts and activity logs.
Security Agent Orchestration Observability
1
https://mcp.toolstile.com/mcp

Related MCP Servers

Azure Resource MCP Server
Cloud Platforms Databases
tim10002
F
license
Not graded
quality
D
maintenance
Provides tools for listing and querying Azure resources directly from any MCP client, allowing you to efficiently browse your Azure infrastructure and analyze costs without leaving your workflow.
Updated 2 years ago (2025-03-25 17:45 UTC)
3
-
Azure MCP Server
Cloud Platforms Virtualization
idofrizler
A
license
Not graded
quality
D
maintenance
An MCP server for interacting with Azure. Contains some common Compute and Networking actions, and extensible to add many more.
Updated 2 years ago (2025-04-06 17:02 UTC)
1
Apache 2.0
mcp-azure-toolkit
Cloud Platforms Developer Tools
TemidireAdesiji
A
license
Not graded
quality
D
maintenance
An MCP server that exposes core Azure services as read-mostly tools any MCP client can call, including Blob Storage, Key Vault, Service Bus, and Resource Manager.
Updated 5 months ago (2026-06-08 22:46 UTC)
1
MIT
azure-mcp-platform
AI & Machine Learning Cloud Platforms Security
akkireddy-challa
A
license
A
quality
C
maintenance
MCP server for Azure resource management, AI Foundry, and Entra ID — inspect and operate Azure infrastructure through AI agents.
Updated 2 months ago (2026-09-08 04:46 UTC)
3
MIT