dockndevai/mcp-azure

A Model Context Protocol server for **Azure** (via the Azure Resource Manager API — the programmatic layer behind the Azure Portal). It lets an MCP-capable client (Claude Desktop, Claude Code, Cursor, Codex, …) inventory and operate Azure resources — with a governance layer that keeps an AI agent inside safe boundaries.
What this offers
- **Inventory** — list subscriptions, locations, resource groups, and resources; get any resource by ARM id.
- **Operations** — create resource groups (in approved regions), merge tags onto any resource, and control VM power state (start / stop / restart / deallocate).
- **Lifecycle** — delete resource groups and individual resources, guarded.
- **Governance built in** — access modes, subscription/resource-group allowlists, protected resource groups, a location allowlist for new groups, delete gating, typed confirmation for high-impact deletes, dry-run, and JSON audit logging.
Governance & security model
| Concern | Flag | Default | Effect |
| --- | --- | --- | --- |
| What can the server do? | AZURE_MODE | read-only | read-only → inventory; read-write → create RG, tag, VM power; admin → deletes. Tools above the mode are **never registered**. |
| Which subscriptions? | AZURE_SUBSCRIPTION_ALLOWLIST | *(all)* | Operations on other subscriptions are refused. |
| Which resource groups? | AZURE_RESOURCE_GROUP_ALLOWLIST | *(all)* | Operations outside the list are refused. |
| Read-only-forever groups | AZURE_PROTECTED_RESOURCE_GROUPS | *(none)* | Readable, never mutable. |
| Approved regions | AZURE_LOCATION_ALLOWLIST | *(any)* | New resource groups may only be created here. |
| Can it delete? | AZURE_ALLOW_DELETE | false | Deletes need this **and** admin mode. |
| Typed confirmation | AZURE_REQUIRE_CONFIRMATION | true | Deletes require confirm to equal the target name — not just a boolean. |
| Preview | AZURE_DRY_RUN | false | Write/admin tools validate + log intent, then return. |
| Audit trail | AZURE_AUDIT_LOG | true | JSON line to stderr per guarded operation. |
| Interactive confirmation | *(automatic)* | — | Destructive & high-impact actions prompt the human to approve via MCP elicitation before running; clients without elicitation fall back to the *_ALLOW_* gate. |
Tools
**Read** (read-only+): list_subscriptions, list_locations, list_resource_groups, list_resources, get_resource
**Write** (read-write+): create_resource_group, tag_resource, control_vm
**Admin** (admin): delete_resource_group, delete_resource (both need AZURE_ALLOW_DELETE + typed confirm)