English Français العربية

io.github.dockndevai/mcp-azure

السجل الرسمي السحابة وDevOps

Azure Resource Manager inventory & ops for AI agents — governed, confirmation-gated.

الشيفرة المصدرية التوثيق

التثبيت

أضف هذا إلى إعدادات MCP في عميلك (Claude Desktop: claude_desktop_config.json، وCursor: ‏.cursor/mcp.json، ويستخدم VS Code وغيره الصيغة نفسها «mcpServers»).

NPM package @dockndevai/mcp-azure
Claude Code 
claude mcp add mcp-azure -e 'AZURE_TENANT_ID=<AZURE_TENANT_ID>' -e 'AZURE_CLIENT_ID=<AZURE_CLIENT_ID>' -e 'AZURE_CLIENT_SECRET=<your azure_client_secret>' -e 'AZURE_SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID>' -e 'AZURE_MODE=<AZURE_MODE>' -- npx -y @dockndevai/mcp-azure@0.3.0
إعداد JSON (Claude Desktop وCursor وVS Code) 
{
    "mcpServers": {
        "mcp-azure": {
            "command": "npx",
            "args": [
                "-y",
                "@dockndevai/mcp-azure@0.3.0"
            ],
            "env": {
                "AZURE_TENANT_ID": "<AZURE_TENANT_ID>",
                "AZURE_CLIENT_ID": "<AZURE_CLIENT_ID>",
                "AZURE_CLIENT_SECRET": "<your azure_client_secret>",
                "AZURE_SUBSCRIPTION_ID": "<AZURE_SUBSCRIPTION_ID>",
                "AZURE_MODE": "<AZURE_MODE>"
            }
        }
    }
}

متغيرات البيئة

  • AZURE_TENANT_ID إلزامي Entra ID tenant id.
  • AZURE_CLIENT_ID إلزامي App registration (service principal) client id.
  • AZURE_CLIENT_SECRET إلزامي سري Service principal client secret.
  • AZURE_SUBSCRIPTION_ID Default subscription id.
  • AZURE_MODE Access mode: read-only | read-write | admin.

التوثيق

مأخوذ من ملف README للمشروع على GitHub ويُحدَّث أسبوعيًا. تفتح الروابط على GitHub.

المحتويات
  1. mcp-azure
  2. What this offers
  3. Governance & security model
  4. Tools
  5. Quickstart — add to your agent
  6. Example prompts
  7. Run from source (development)
  8. Develop
  9. Publishing
  10. License

mcp-azure

A Model Context Protocol server for Azure (via the Azure Resource Manager API — the programmatic layer behind the Azure Portal). It lets an MCP-capable client (Claude Desktop, Claude Code, Cursor, Codex, …) inventory and operate Azure resources — with a governance layer that keeps an AI agent inside safe boundaries.

What this offers

  • Inventory — list subscriptions, locations, resource groups, and resources; get any resource by ARM id.
  • Operations — create resource groups (in approved regions), merge tags onto any resource, and control VM power state (start / stop / restart / deallocate).
  • Lifecycle — delete resource groups and individual resources, guarded.
  • Governance built in — access modes, subscription/resource-group allowlists, protected resource groups, a location allowlist for new groups, delete gating, typed confirmation for high-impact deletes, dry-run, and JSON audit logging.

Governance & security model

ConcernFlagDefaultEffect
What can the server do?AZURE_MODEread-onlyread-only → inventory; read-write → create RG, tag, VM power; admin → deletes. Tools above the mode are never registered.
Which subscriptions?AZURE_SUBSCRIPTION_ALLOWLIST(all)Operations on other subscriptions are refused.
Which resource groups?AZURE_RESOURCE_GROUP_ALLOWLIST(all)Operations outside the list are refused.
Read-only-forever groupsAZURE_PROTECTED_RESOURCE_GROUPS(none)Readable, never mutable.
Approved regionsAZURE_LOCATION_ALLOWLIST(any)New resource groups may only be created here.
Can it delete?AZURE_ALLOW_DELETEfalseDeletes need this and admin mode.
Typed confirmationAZURE_REQUIRE_CONFIRMATIONtrueDeletes require confirm to equal the target name — not just a boolean.
PreviewAZURE_DRY_RUNfalseWrite/admin tools validate + log intent, then return.
Audit trailAZURE_AUDIT_LOGtrueJSON line to stderr per guarded operation.
Interactive confirmation(automatic)—Destructive & high-impact actions prompt the human to approve via MCP elicitation before running; clients without elicitation fall back to the *_ALLOW_* gate.

Tools

Read (read-only+): list_subscriptions, list_locations, list_resource_groups, list_resources, get_resource

Write (read-write+): create_resource_group, tag_resource, control_vm

Admin (admin): delete_resource_group, delete_resource (both need AZURE_ALLOW_DELETE + typed confirm)

Quickstart — add to your agent

Published on npm as @dockndevai/mcp-azure. Runs via npx with an Entra ID service principal. See docs/CLIENTS.md for every client and .env.example for all variables.

Claude Code

claude mcp add azure -e AZURE_TENANT_ID="…" -e AZURE_CLIENT_ID="…" -e AZURE_CLIENT_SECRET="…" -e AZURE_SUBSCRIPTION_ID="…" -e AZURE_MODE="read-only" -- npx -y @dockndevai/mcp-azure

Claude Desktop · Cursor · Windsurf

{
  "mcpServers": {
    "azure": {
      "command": "npx",
      "args": ["-y", "@dockndevai/mcp-azure"],
      "env": {
        "AZURE_TENANT_ID": "…",
        "AZURE_CLIENT_ID": "…",
        "AZURE_CLIENT_SECRET": "…",
        "AZURE_SUBSCRIPTION_ID": "…",
        "AZURE_MODE": "read-only"
      }
    }
  }
}

Example prompts

  • "List all resource groups in my subscription and which region each is in"
  • "Show every resource in the rg-web group"
  • "Tag the app-plan resource with env=prod and owner=team-a" (needs read-write)
  • "Stop the build-agent VM in rg-ci" (needs read-write)

Run from source (development)

npm install
npm run build
node dist/index.js   # with the environment variables set

Develop

npm run dev
npm test          # governance policy: modes, scoping, location allowlist, delete + confirmation
npm run typecheck

Publishing

Ships a server.json for the official MCP registry and an mcpName for npm ownership validation. See PUBLISHING.md.

License

MIT

الأسئلة الشائعة

ما هو io.github.dockndevai/mcp-azure؟

Azure Resource Manager inventory & ops for AI agents — governed, confirmation-gated.

كيف أثبّت io.github.dockndevai/mcp-azure؟

يعمل على جهازك. في Claude Code: claude mcp add mcp-azure -e 'AZURE_TENANT_ID=<AZURE_TENANT_ID>' -e 'AZURE_CLIENT_ID=<AZURE_CLIENT_ID>' -e 'AZURE_CLIENT_SECRET=<your azure_client_secret>' -e 'AZURE_SUBSCRIPTION_ID=<AZURE_SUBSCRIPTION_ID>' -e 'AZURE_MODE=<AZURE_MODE>' -- npx -y @dockndevai/mcp-azure@0.3.0. وفي العملاء الآخرين، الصق إعداد JSON من هذه الصفحة في إعدادات MCP الخاصة بهم.

هل يحتاج io.github.dockndevai/mcp-azure إلى مفتاح API؟

نعم. يتطلب AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET، وتضبطها في إعداداته.

هل io.github.dockndevai/mcp-azure مفتوح المصدر؟

نعم. شيفرته متاحة على GitHub بترخيص MIT.

من يصون io.github.dockndevai/mcp-azure؟

ينشره dockndevai. يدرجه AI.tn لكنه لا يصونه ولا يوصي به.

من سجل MCP الرسمي. الإدراج ليس توصية: راجع شيفرة الخادم وصلاحياته قبل منحه الوصول إلى بياناتك.