Mcp Azure

io.github.dockndevaiPublished by GitHub account dockndevaiv0.3.0Updated Oct 24, 2026

Azure Resource Manager inventory & ops for AI agents — governed, confirmation-gated.

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant inventory and operate Azure resources through Azure Resource Manager, with access modes, allowlists and confirmation g g

What you can do
List subscriptions, locations, resource groups and resources, and fetch any resource by ARM id (read-only mode and above). Create resource groups in approved regions, merge tags onto resources, and start, stop, restart or deallocate VMs (read-write mode and above). Delete resource groups and individual resources, gated by admin mode, a delete flag and typed confirmation. Apply governance: access modes, subscription and resource-group allowlists, protected groups, a location allowlist, dry-run and JSON audit logging to stderr.
When to use it
Useful when an assistant should inspect or manage Azure infrastructure from a chat client, for example listing resource groups, tagging resources or stopping a VM, while keeping the agent inside defined boundaries. Read-only mode suits inventory-only use.
Requirements
Runs locally via npx from the npm package, so Node.js is needed. Requires an Entra ID service principal: AZURE_TENANT_ID, AZURE_CLIENT_ID and AZURE_CLIENT_SECRET, plus optionally AZURE_SUBSCRIPTION_ID and AZURE_MODE. Network access to Azure Resource Manager. Desktop clients only.
Before you install
The service principal secret (AZURE_CLIENT_SECRET) is a credential granting Azure access; scope its role narrowly. Write and admin modes can create, tag, power-cycle and delete real Azure resources, and deletes need both AZURE_ALLOW_DELETE and admin mode. Keep the default read-only mode, allowlists and confirmation unless you intend otherwise.

Installation

In SourceWeft

  1. Open Mcp Azure in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-azure

[CI] [License: MIT] [npm]

A Model Context Protocol server for Azure (via the Azure Resource Manager API — the programmatic layer behind the Azure Portal). It lets an MCP-capable client (Claude Desktop, Claude Code, Cursor, Codex, …) inventory and operate Azure resources — with a governance layer that keeps an AI agent inside safe boundaries.

What this offers

  • Inventory — list subscriptions, locations, resource groups, and resources; get any resource by ARM id.
  • Operations — create resource groups (in approved regions), merge tags onto any resource, and control VM power state (start / stop / restart / deallocate).
  • Lifecycle — delete resource groups and individual resources, guarded.
  • Governance built in — access modes, subscription/resource-group allowlists, protected resource groups, a location allowlist for new groups, delete gating, typed confirmation for high-impact deletes, dry-run, and JSON audit logging.

Governance & security model

ConcernFlagDefaultEffect
What can the server do?AZURE_MODEread-onlyread-only → inventory; read-write → create RG, tag, VM power; admin → deletes. Tools above the mode are never registered.
Which subscriptions?AZURE_SUBSCRIPTION_ALLOWLIST(all)Operations on other subscriptions are refused.
Which resource groups?AZURE_RESOURCE_GROUP_ALLOWLIST(all)Operations outside the list are refused.
Read-only-forever groupsAZURE_PROTECTED_RESOURCE_GROUPS(none)Readable, never mutable.
Approved regionsAZURE_LOCATION_ALLOWLIST(any)New resource groups may only be created here.
Can it delete?AZURE_ALLOW_DELETEfalseDeletes need this and admin mode.
Typed confirmationAZURE_REQUIRE_CONFIRMATIONtrueDeletes require confirm to equal the target name — not just a boolean.
PreviewAZURE_DRY_RUNfalseWrite/admin tools validate + log intent, then return.
Audit trailAZURE_AUDIT_LOGtrueJSON line to stderr per guarded operation.
Interactive confirmation(automatic)—Destructive & high-impact actions prompt the human to approve via MCP elicitation before running; clients without elicitation fall back to the *_ALLOW_* gate.

Tools

Read (read-only+): list_subscriptions, list_locations, list_resource_groups, list_resources, get_resource

Write (read-write+): create_resource_group, tag_resource, control_vm

Admin (admin): delete_resource_group, delete_resource (both need AZURE_ALLOW_DELETE + typed confirm)

Quickstart — add to your agent

Published on npm as @dockndevai/mcp-azure. Runs via npx with an Entra ID service principal. See docs/CLIENTS.md for every client and .env.example for all variables.

Claude Code

bash
claude mcp add azure -e AZURE_TENANT_ID="…" -e AZURE_CLIENT_ID="…" -e AZURE_CLIENT_SECRET="…" -e AZURE_SUBSCRIPTION_ID="…" -e AZURE_MODE="read-only" -- npx -y @dockndevai/mcp-azure

Claude Desktop · Cursor · Windsurf

json
{  "mcpServers": {    "azure": {      "command": "npx",      "args": ["-y", "@dockndevai/mcp-azure"],      "env": {        "AZURE_TENANT_ID": "…",        "AZURE_CLIENT_ID": "…",        "AZURE_CLIENT_SECRET": "…",        "AZURE_SUBSCRIPTION_ID": "…",        "AZURE_MODE": "read-only"      }    }  }}

Example prompts

  • "List all resource groups in my subscription and which region each is in"
  • "Show every resource in the rg-web group"
  • "Tag the app-plan resource with env=prod and owner=team-a" (needs read-write)
  • "Stop the build-agent VM in rg-ci" (needs read-write)

Run from source (development)

bash
npm installnpm run buildnode dist/index.js   # with the environment variables set

Develop

bash
npm run devnpm test          # governance policy: modes, scoping, location allowlist, delete + confirmationnpm run typecheck

Publishing

Ships a server.json for the official MCP registry and an mcpName for npm ownership validation. See PUBLISHING.md.

License

MIT

Source: README.md at commit 1a5bb0c

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.3.0LatestSep 29, 2026
  2. v0.2.2Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts