Summary: A read-only, Entra-protected MCP server for searching and retrieving fictitious HSE procedures and incident lessons within an authorized site scope.
Search HSE knowledge across procedures and incident lessons with grounding metadata.
Search global and site-authorized HSE procedures by query, category, site IDs, and limit.
Retrieve a single authorized HSE procedure by procedure ID.
Search 200 fictitious HSE incidents by query, severity, site IDs, and limit, including the full matching count independent of the limit.
Authorization is fail-closed via Entra bearer-token validation and app-role site scope; tool arguments cannot expand access.
Records are demonstration-only and not operational safety guidance.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@OGE HSE MCP Find HSE procedures about working at height"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
This repository provisions an Entra-protected, read-only remote MCP server containing fictitious HSE procedures and incidents. It is a demonstration only; none of the records are operational safety guidance.
Copy .env.example to .env and set the variables.
Install with py -m pip install -e ".[dev]".
Run oge-hse-seed.
Run tests with py -m pytest -q.
Related MCP server: SSO MCP Server
The script reads deployment-specific values only from .env:
.\scripts\provision.ps1It creates the resource API registration when needed, provisions Azure Container Apps and Azure Container Registry, builds the image in ACR, and prints the MCP URL and resource API scope. It does not grant tenant-wide consent or create Microsoft 365 integrations; those are explicit administrator review steps described in docs/microsoft-365-integration.md.
Remove all demonstration Azure resources and the Entra app registration with .\scripts\remove.ps1.
search_hse_knowledge: Search procedures and incident lessons with grounding metadata.
search_procedures: Search global and site-authorized HSE procedures.
get_procedure: Retrieve one authorized procedure.
search_incidents: Search 200 fictitious incidents across the two authorized demo sites and report the full matching count independently of the result limit.
Authorization is fail-closed. The HTTP bearer token is validated for signature, issuer, audience, expiry, and required delegated scope. Site access comes from Entra app roles in the configured claim named by HSE_ENTRA_SITE_CLAIM; a tool argument can't expand that scope.
Copilot Studio custom connector with OBO OAuth: bind the MCP server to a specific HSE agent while preserving delegated user identity.
Microsoft 365 federated connector: expose live, read-only HSE retrieval through a tenant-local connector in supported Microsoft 365 Copilot experiences.
Architecture and rollout comparison: compare the agent-specific and tenant-local federated paths.
Get one HSE procedure when it is global or in the caller's authorized site scope.
Inputs: procedure_id (required), site_ids. Returns: object
Search current HSE procedures and incident lessons for grounded answers.
Inputs: query (required), limit, site_ids. Returns: object
Search fictitious HSE incidents in the caller's authorized site scope.
Inputs: limit, query, severity, site_ids. Returns: object
Search current HSE procedures in the caller's authorized site scope.
Inputs: limit, query, category, site_ids. Returns: object
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 4 tools
search_procedures and search_incidents are clearly scoped, but search_hse_knowledge overlaps with both by searching procedures and incident lessons. An agent may be uncertain whether to use the broad knowledge search or the specific procedure/incident search for a given query.
Tool names consistently follow a verb_noun pattern using snake_case: search_hse_knowledge, search_procedures, search_incidents, and get_procedure. The one get_* tool is a natural singular retrieval counterpart to the search_* tools.
Four tools is a well-scoped set for an HSE knowledge and incident search server. Each tool serves a distinct retrieval need without unnecessary bulk.
The read-only search and retrieval workflow is well covered: procedures can be searched and retrieved, incidents can be searched, and a combined knowledge search exists. A dedicated get_incident or incident-lesson detail tool is missing, but agents can likely work around it via search_hse_knowledge.
Location compliance evidence, policies and SOPs with admin-controlled write approvals.
Read-only finance and operations controls for AI agents with evidence and safe next actions.
Governed company knowledge over MCP. Synthetic read-only demo; customer Atlas by contract.
Read-only senior-care exit routes, duplicate-referral deadlines, and templates; no PII or sending.
