SAP RCA MCP Server

Python MCP server that enables AI agents to perform Root Cause Analysis on SAP systems by querying Azure Log Analytics data.

Architecture

AI Agent (Azure AI Foundry / Claude / Copilot Studio)
    │  MCP Tool Calls
    ▼
FastMCP Server (server.py)
    ├── get_schema        → schema_registry.py  (table/column metadata)
    ├── execute_query     → la_client.py         (validated KQL execution)
    ├── analyze_results   → domain_knowledge.py  (SAP error classification)
    └── run_full_rca      → rca_orchestrator.py  (8-step automated workflow)
    │
    ▼
Azure Log Analytics (read-only KQL queries via Managed Identity)

Related MCP server: CloudWatch Log Analyst MCP

The 4 Tools

Prerequisites

• Python 3.11+

• Azure CLI (az) installed

• Access to the Azure Log Analytics workspace (Workspace ID needed)

• Role Log Analytics Reader assigned to your account (or Managed Identity)

Setup

# 1. Clone / navigate to this folder
cd C:\Users\padmajat\Documents\AMS-Agentic-RCA\MCP

# 2. Create virtual environment
python -m venv .venv
.venv\Scripts\activate          # Windows
# source .venv/bin/activate     # Linux/macOS

# 3. Install dependencies
pip install -r requirements.txt

# 4. Configure
copy .env.example .env
# Edit .env and fill in AZURE_LOG_ANALYTICS_WORKSPACE_ID and AZURE_TENANT_ID

# 5. Authenticate (local development)
az login

Configuration (.env)

AZURE_LOG_ANALYTICS_WORKSPACE_ID=<your-workspace-guid>
AZURE_TENANT_ID=<your-tenant-id>

On Azure with Managed Identity, only the workspace ID is needed — leave all AZURE_CLIENT_* fields blank.

Running

stdio mode (Claude Desktop, MCP Inspector, Azure AI Foundry local)

python server.py
# or:
mcp dev server.py

SSE/HTTP mode (Azure App Service deployment)

pip install uvicorn
uvicorn server:mcp --host 0.0.0.0 --port 8000

The SSE endpoint will be: http://localhost:8000/sse

Connect to Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "sap-rca": {
      "command": "python",
      "args": ["C:/Users/padmajat/Documents/AMS-Agentic-RCA/MCP/server.py"],
      "env": {
        "AZURE_LOG_ANALYTICS_WORKSPACE_ID": "<your-workspace-id>",
        "AZURE_TENANT_ID": "<your-tenant-id>"
      }
    }
  }
}

Connect to Azure AI Foundry

In Azure AI Foundry, add an MCP connection pointing to: https://<your-app-service>.azurewebsites.net/sse

Example Agent Conversation

Focused query workflow:

Agent → get_schema(["SapNetweaver_ShortDumps_CL"])
Agent → execute_query("SapNetweaver_ShortDumps_CL | where serverTimestamp_t > ago(4h) | where SID_s == 'CHA' | take 100")
Agent → analyze_results(results, "short_dumps", context="SID=CHA, last 4h")

Full automated RCA:

Agent → run_full_rca(sid="CHA", time_range_hours=4, issue_description="Multiple batch job failures")
← Returns complete 8-step RCA report

Registered Tables

Currently registered (1 of 7):

Adding a New Table Schema

1. Provide the schema CSV (columns + description) — same format as SchemaforMCP-Details.csv.

2. Add a new entry to schema_registry.py following the existing SapNetweaver_ShortDumps_CL entry as a template.

3. If the table needs domain-specific analysis logic, add a _analyze_<type>() function to tools/analyze_results.py.

4. Add a KQL template to _KQL_TEMPLATES in tools/rca_orchestrator.py.

5. Restart the server — no other changes needed.

Security Notes

• execute_query blocks all KQL management commands (.ingest, .drop, .set, etc.)

• run_full_rca uses parameterised KQL templates — SID values are validated before substitution

• All credentials are loaded from environment variables — no secrets in code

• On Azure, use Managed Identity; do not store AZURE_CLIENT_SECRET in App Service config

⚠ Outstanding Questions (Action Required)

Before the server can connect to your workspace, you need to provide: