Skip to main content
mcpSource-backed
Azure logo

Azure MCP Server for Claude

Official Microsoft Azure MCP server that connects Claude and other MCP clients to Azure subscriptions, resource groups, storage, databases, Key Vault, Monitor, App Service, AKS, AI Search, Cosmos DB, RBAC, pricing, and other Azure services through local stdio or self-hosted HTTP transports.

by Microsoft · submitted by oktofeesh1·added 2026-06-04·
Review first review before installing

Open the source and read safety notes before installing.

Citation facts

Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.

Source URLs
https://learn.microsoft.com/en-us/azure/developer/azure-mcp-server/, https://github.com/microsoft/mcp
Brand
Azure
Brand domain
azure.microsoft.com
Brand asset source
brandfetch
Safety notes
Start in read-only mode and narrow the exposed namespaces or individual tools before enabling broader Azure access. Microsoft documents read-only mode, namespace filters, single-tool mode, and learn mode as controls for reducing the active MCP surface., Azure MCP tools can inspect and manage real cloud resources. Depending on the tool and RBAC role, actions can create, update, delete, deploy, restart, query, or reconfigure resources and can incur cloud spend., Keep human approval on destructive, cost-bearing, deployment, RBAC, Key Vault, database, storage, messaging, and production-environment actions. Do not disable user confirmation for high-risk or sensitive-data commands unless the automation environment is tightly controlled., The server authenticates with Azure credentials available to the local machine or hosted environment. Limit the credential chain with `AZURE_TOKEN_CREDENTIALS`, managed identities, service principals, and least-privilege Azure RBAC where practical., For self-hosted HTTP deployments, configure Entra ID inbound authentication, outbound authentication strategy, network exposure, logging, and per-user versus server-identity audit requirements before sharing the endpoint., Docker setup uses Azure credential environment variables such as `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET`; protect those values and never commit the env file., Microsoft documents telemetry environment variables for the server. Review `AZURE_MCP_COLLECT_TELEMETRY` and `AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT` before using the server in sensitive environments., This is the Azure services MCP server. It is distinct from the Azure DevOps MCP server, which focuses on work items, repositories, pull requests, pipelines, wikis, and test plans.
Privacy notes
Tool results can expose tenant IDs, subscription IDs, resource groups, resource names, tags, deployment outputs, Azure Monitor logs, metrics, pricing data, quotas, RBAC assignments, policy data, app settings, database metadata, storage account and blob metadata, and service-specific configuration., Key Vault, App Configuration, Storage, database, Service Bus, Event Hubs, Communication Services, and deployment tools may expose secrets, connection strings, keys, certificates, message contents, sample records, or customer data when the authenticated identity has permission., Microsoft documents user confirmation for tools that handle sensitive data, including Key Vault secrets, connection strings, passwords, certificate private keys, and other confidential values. Treat those prompts as a required guardrail rather than friction., MCP client logs, AI transcripts, local terminal history, hosted server logs, prompt traces, generated runbooks, and downstream tickets can retain Azure resource inventory and returned data outside Azure's original access and retention boundaries., Remote HTTP deployments require Entra ID bearer tokens on inbound requests and a configured outbound Azure authentication strategy. Choose On-Behalf-Of when per-user RBAC and audit trails matter, and managed identity only when the shared-server identity model is acceptable., Read-only mode reduces mutation risk, but it does not make returned Azure metadata or data safe to share with untrusted models, logs, chats, or third-party tools.
Author
Microsoft
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-04

Decision playbook

Review trust signals before you adopt

Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.

Compare context
Selected

0

Current score

78

Baseline

Delta

No baseline selected

No major trust-signal divergence detected in the current selection.

Source and provenance checks

Complete

Confirm ownership and provenance before trusting install instructions.

  • Source link availableRequired

    Open the canonical repository and verify ownership.

    Done
  • Source provenance statusRequired

    Marked as source-backed.

    Done
  • Metadata reviewed

    Registry metadata indicates a reviewed listing.

    Done

Safety and privacy checks

Complete

Validate risk disclosures before installation or API wiring.

  • Safety notes presentRequired

    Review the listed safety guidance before running commands.

    Done
  • Privacy notes presentRequired

    Review data handling notes before connecting accounts or secrets.

    Done
  • Trust level risk gateRequired

    Trust level does not block evaluation.

    Done

Package and install checks

Needs review

Check package metadata and artifact integrity signals.

  • Install payload available

    Install or copy payload is available for review.

    Done
  • Package verification flag

    No package verification flag provided.

    Pending
  • Checksum metadata

    No checksum provided for downloaded artifact.

    Pending

Compare-driven decision checks

Needs review

Use compare context to validate trade-offs before adoption.

  • Compare tray has multiple entries

    Add at least one more entry to compare trust differences.

    Pending
  • Baseline comparison available

    No baseline peer selected yet.

    Pending
  • Diverging trust signals identified

    No major trust-signal divergence found.

    Pending

Setup at a glance

CLI install

Copy-ready — paste the snippet to get started.

20 minutes

Adoption plan

Balanced adoption plan

Current risk score 16/100. Use staged verification before broader rollout.

Risk 16

Pre-adoption checks

Validate source and review signals before any execution.

  • Confirm source provenanceRequired

    Source URL/provenance metadata is present.

    Done
  • Confirm metadata review state

    Listing has review metadata.

    Done
  • Verify install payload

    Install/config payload exists and can be inspected.

    Done

Security checks

Confirm safety, privacy, and package integrity signals.

  • Review safety notesRequired

    Safety notes are present.

    Done
  • Review privacy notesRequired

    Privacy notes are present.

    Done
  • Verify package integrity metadata

    No package verification/checksum metadata.

    Pending

Rollout

Adopt in controlled steps based on the selected plan.

  • Run in isolated sandbox firstRequired

    Use a constrained sandbox and observe behavior across multiple tasks.

    Pending
  • Roll out graduallyRequired

    Roll out to a small cohort before wider usage.

    Pending
  • Set monitoring and fallback

    Define rollback path and monitor errors after adoption.

    Pending

Evidence readiness

Evidence readiness matrix · balanced

Required evidence gates are covered (5/6 signals complete).

Risk 15

Source provenance

Present

Source repository/provenance is listed.

Required in this preset

Metadata review

Present

Review metadata is present.

Required in this preset

Safety notes

Present

Safety notes are present.

Required in this preset

Privacy notes

Present

Privacy notes are present.

Optional in this preset

Package integrity

Missing

Package integrity metadata is missing.

Optional in this preset

Install payload

Present

Install payload is available.

Required in this preset

Required evidence gates are covered for this preset.

Decision timeline

Decision timeline · balanced

5/6 steps complete with no blocking gaps for this preset.

Risk 14

triage

Confirm source provenanceRequired

Source/provenance metadata is available.

Done

triage

Check metadata review statusRequired

Review metadata is available.

Done

verify

Review safety notesRequired

Safety notes are available.

Done

verify

Review privacy notes

Privacy notes are available.

Done

verify

Validate package integrity metadata

Package integrity metadata is missing.

Pending

rollout

Verify install payload and commandsRequired

Install payload is available.

Done

No required blockers for this timeline preset.

Prerequisite readiness

Prerequisite readiness

6 prerequisites to line up before setup. Have accounts and credentials ready first. Includes a review or approval gate.

0/6 ready
Account & credentials4Install & runtime1Review & approval120 minutes

Safety & privacy surface

Safety & privacy surface

8 safety and 6 privacy notes across 7 risk areas. Review closely: credentials & tokens, permissions & scopes, network access, third-party handling.

7 areas
  • SafetyGeneralStart in read-only mode and narrow the exposed namespaces or individual tools before enabling broader Azure access. Microsoft documents read-only mode, namespace filters, single-tool mode, and learn mode as controls for reducing the active MCP surface.
  • SafetyPermissions & scopesAzure MCP tools can inspect and manage real cloud resources. Depending on the tool and RBAC role, actions can create, update, delete, deploy, restart, query, or reconfigure resources and can incur cloud spend.
  • SafetyExecution & processesKeep human approval on destructive, cost-bearing, deployment, RBAC, Key Vault, database, storage, messaging, and production-environment actions. Do not disable user confirmation for high-risk or sensitive-data commands unless the automation environment is tightly controlled.
  • SafetyCredentials & tokensThe server authenticates with Azure credentials available to the local machine or hosted environment. Limit the credential chain with `AZURE_TOKEN_CREDENTIALS`, managed identities, service principals, and least-privilege Azure RBAC where practical.
  • SafetyNetwork accessFor self-hosted HTTP deployments, configure Entra ID inbound authentication, outbound authentication strategy, network exposure, logging, and per-user versus server-identity audit requirements before sharing the endpoint.
  • SafetyCredentials & tokensDocker setup uses Azure credential environment variables such as `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET`; protect those values and never commit the env file.
  • SafetyTelemetryMicrosoft documents telemetry environment variables for the server. Review `AZURE_MCP_COLLECT_TELEMETRY` and `AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT` before using the server in sensitive environments.
  • SafetyNetwork accessThis is the Azure services MCP server. It is distinct from the Azure DevOps MCP server, which focuses on work items, repositories, pull requests, pipelines, wikis, and test plans.
  • PrivacyExecution & processesTool results can expose tenant IDs, subscription IDs, resource groups, resource names, tags, deployment outputs, Azure Monitor logs, metrics, pricing data, quotas, RBAC assignments, policy data, app settings, database metadata, storage account and blob metadata, and service-specific configuration.
  • PrivacyCredentials & tokensKey Vault, App Configuration, Storage, database, Service Bus, Event Hubs, Communication Services, and deployment tools may expose secrets, connection strings, keys, certificates, message contents, sample records, or customer data when the authenticated identity has permission.
  • PrivacyCredentials & tokensMicrosoft documents user confirmation for tools that handle sensitive data, including Key Vault secrets, connection strings, passwords, certificate private keys, and other confidential values. Treat those prompts as a required guardrail rather than friction.
  • PrivacyExecution & processesMCP client logs, AI transcripts, local terminal history, hosted server logs, prompt traces, generated runbooks, and downstream tickets can retain Azure resource inventory and returned data outside Azure's original access and retention boundaries.
  • PrivacyCredentials & tokensRemote HTTP deployments require Entra ID bearer tokens on inbound requests and a configured outbound Azure authentication strategy. Choose On-Behalf-Of when per-user RBAC and audit trails matter, and managed identity only when the shared-server identity model is acceptable.
  • PrivacyThird-party handlingRead-only mode reduces mutation risk, but it does not make returned Azure metadata or data safe to share with untrusted models, logs, chats, or third-party tools.

Safety notes

  • Start in read-only mode and narrow the exposed namespaces or individual tools before enabling broader Azure access. Microsoft documents read-only mode, namespace filters, single-tool mode, and learn mode as controls for reducing the active MCP surface.
  • Azure MCP tools can inspect and manage real cloud resources. Depending on the tool and RBAC role, actions can create, update, delete, deploy, restart, query, or reconfigure resources and can incur cloud spend.
  • Keep human approval on destructive, cost-bearing, deployment, RBAC, Key Vault, database, storage, messaging, and production-environment actions. Do not disable user confirmation for high-risk or sensitive-data commands unless the automation environment is tightly controlled.
  • The server authenticates with Azure credentials available to the local machine or hosted environment. Limit the credential chain with `AZURE_TOKEN_CREDENTIALS`, managed identities, service principals, and least-privilege Azure RBAC where practical.
  • For self-hosted HTTP deployments, configure Entra ID inbound authentication, outbound authentication strategy, network exposure, logging, and per-user versus server-identity audit requirements before sharing the endpoint.
  • Docker setup uses Azure credential environment variables such as `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET`; protect those values and never commit the env file.
  • Microsoft documents telemetry environment variables for the server. Review `AZURE_MCP_COLLECT_TELEMETRY` and `AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT` before using the server in sensitive environments.
  • This is the Azure services MCP server. It is distinct from the Azure DevOps MCP server, which focuses on work items, repositories, pull requests, pipelines, wikis, and test plans.

Privacy notes

  • Tool results can expose tenant IDs, subscription IDs, resource groups, resource names, tags, deployment outputs, Azure Monitor logs, metrics, pricing data, quotas, RBAC assignments, policy data, app settings, database metadata, storage account and blob metadata, and service-specific configuration.
  • Key Vault, App Configuration, Storage, database, Service Bus, Event Hubs, Communication Services, and deployment tools may expose secrets, connection strings, keys, certificates, message contents, sample records, or customer data when the authenticated identity has permission.
  • Microsoft documents user confirmation for tools that handle sensitive data, including Key Vault secrets, connection strings, passwords, certificate private keys, and other confidential values. Treat those prompts as a required guardrail rather than friction.
  • MCP client logs, AI transcripts, local terminal history, hosted server logs, prompt traces, generated runbooks, and downstream tickets can retain Azure resource inventory and returned data outside Azure's original access and retention boundaries.
  • Remote HTTP deployments require Entra ID bearer tokens on inbound requests and a configured outbound Azure authentication strategy. Choose On-Behalf-Of when per-user RBAC and audit trails matter, and managed identity only when the shared-server identity model is acceptable.
  • Read-only mode reduces mutation risk, but it does not make returned Azure metadata or data safe to share with untrusted models, logs, chats, or third-party tools.

Prerequisites

  • Azure subscription, tenant, and RBAC permissions for the resources Claude should inspect or manage.
  • MCP-capable client that can run local stdio servers or connect to a self-hosted HTTP MCP endpoint.
  • Azure authentication through Azure CLI, Azure PowerShell, Visual Studio, Visual Studio Code, Azure Developer CLI, browser login, service principal environment variables, workload identity, or managed identity.
  • Node.js 20 LTS or later and `npx` for the `@azure/mcp` package, or `uvx` for `msmcp-azure`, or .NET 10 Preview 6 or later for `Azure.Mcp`.
  • Clear subscription, tenant, namespace, read-only, and tool exposure plan before connecting an autonomous agent to Azure resources.
  • Secret-handling plan for Azure credentials, MCP client configuration, Docker `.env` files, server logs, terminal history, and AI transcripts.

Schema details

Install type
cli
Troubleshooting
No
Source repository stats
Scope
Source repo
Collection metadata
Estimated setup
20 minutes
Difficulty
advanced
Full copyable content
{
  "mcpServers": {
    "Azure MCP Server": {
      "command": "npx",
      "args": [
        "-y",
        "@azure/mcp@latest",
        "server",
        "start"
      ]
    }
  }
}

About this resource

Content

The Azure MCP Server is Microsoft's official MCP server for working with Azure resources from Claude and other MCP-capable clients. It connects an assistant to Azure subscriptions and services through a local stdio server or a self-hosted HTTP server, using Azure authentication and RBAC instead of copied portal screenshots or manually pasted resource details.

The strongest use case is developer-side Azure work where the assistant needs fresh, permissioned cloud context: list resource groups, inspect storage containers, check Cosmos DB or PostgreSQL resources, query Azure Monitor, retrieve pricing or quota information, reason about RBAC assignments, generate Azure CLI guidance, or look up Azure best-practice recommendations before changing infrastructure.

Features

  • Official Microsoft implementation in the microsoft/mcp repository.
  • Local stdio server through @azure/mcp, Azure.Mcp, or msmcp-azure.
  • Self-hosted HTTP mode for remote deployments on Azure Container Apps.
  • Azure Identity based authentication using local developer credentials, service principals, workload identity, managed identity, or hosted HTTP authentication flows.
  • Azure RBAC-backed access to subscriptions, resource groups, and individual services.
  • Read-only mode for preventing write operations.
  • Namespace and individual tool filtering so a client can expose only the Azure services required for the task.
  • Learn mode for command and parameter discovery without executing Azure operations.
  • Sensitive-data confirmation for tools that may return secrets, connection strings, passwords, certificate private keys, or other confidential values.
  • Tool coverage across Azure AI Search, App Configuration, Cosmos DB, Key Vault, Monitor, RBAC, Redis, Storage, App Service, Functions, AKS, SQL, PostgreSQL, MySQL, Service Bus, Event Hubs, Event Grid, Azure Policy, pricing, quotas, Resource Health, Well-Architected guidance, and more.
  • Setup paths for VS Code, Visual Studio, IntelliJ, Eclipse, Cursor, Cline, Windsurf, GitHub Copilot CLI, package managers, Docker, and custom MCP clients.
  • Sovereign cloud support through the --cloud option or AZURE_CLOUD environment variable.

Use Cases

  • Ask Claude to inventory resource groups, storage accounts, app services, AKS clusters, databases, or Azure AI resources before making infrastructure changes.
  • Query Azure Monitor logs or metrics while investigating a failed deployment, incident, or performance regression.
  • Inspect RBAC assignments, policy state, quotas, and pricing before planning a deployment.
  • Generate Azure CLI or Azure Developer CLI guidance from natural-language intent while keeping Azure context in the same MCP session.
  • Work in read-only mode while drafting a migration plan, cost review, incident summary, or architecture audit.
  • Narrow the server to namespaces such as storage, keyvault, cosmos, monitor, or aks when the assistant only needs a bounded Azure surface.
  • Self-host an HTTP Azure MCP endpoint for approved agents that need shared access through Entra ID controlled authentication.

Installation

Claude Code with the Node package

Authenticate to Azure first with an approved method such as az login, Visual Studio Code Azure sign-in, Azure PowerShell, Azure Developer CLI, or managed identity.

Add the stdio server with the official npm package:

claude mcp add azure-mcp -- npx -y @azure/mcp@latest server start

Confirm the package can list tools before using it in a high-trust workspace:

npx -y @azure/mcp@latest tools list

Other package-manager options

Use the .NET tool when your environment standardizes on NuGet:

dotnet tool install Azure.Mcp

Use the Python package when your environment standardizes on uvx:

uvx --from msmcp-azure azmcp server start

Configuration

Basic MCP client configuration

{
  "mcpServers": {
    "Azure MCP Server": {
      "command": "npx",
      "args": [
        "-y",
        "@azure/mcp@latest",
        "server",
        "start"
      ]
    }
  }
}

Python-based configuration

{
  "mcpServers": {
    "Azure MCP Server": {
      "command": "uvx",
      "args": [
        "--from",
        "msmcp-azure",
        "azmcp",
        "server",
        "start"
      ]
    }
  }
}

VS Code extension controls

Microsoft's VS Code extension exposes server controls for mode, enabled services, and read-only behavior:

{
  "azureMcp.serverMode": "namespace",
  "azureMcp.enabledServices": ["storage", "keyvault"],
  "azureMcp.readOnly": true
}

Restart the MCP server after changing the exposed namespaces or read-only setting.

Sovereign cloud selection

Use the command-line cloud option or AZURE_CLOUD when working outside Azure Public Cloud:

azmcp server start --cloud AzureUSGovernment
AZURE_CLOUD=AzureChinaCloud azmcp server start

Examples

Ask read-only prompts first:

Use the Azure MCP Server to list my Azure subscriptions and resource groups.
Use Azure MCP in read-only mode to list storage accounts in this subscription
and summarize which resource groups they belong to.
Use Azure MCP to query Azure Monitor for errors in this Log Analytics workspace
from the last hour, then summarize the recurring failure patterns.
Use Azure MCP learn mode to show which storage and key vault tools are
available before running any Azure operation.

Use explicit boundaries before allowing write-capable work:

Use only the staging subscription and the appservice namespace. Draft the
deployment plan first, then wait for approval before changing any resource.

Source notes

  • Microsoft Learn documents the Azure MCP Server as the official way to manage Azure resources through natural-language commands from GitHub Copilot, custom AI agents, and MCP-compatible clients.
  • The official microsoft/mcp repository hosts the Azure MCP Server under servers/Azure.Mcp.Server and documents the npm, NuGet, PyPI, Docker, IDE, and remote hosting setup paths.
  • Microsoft Learn documents developer credentials, managed identity, Azure RBAC, read-only mode, namespace and tool filtering, learn mode, tool annotations, user confirmation for sensitive data, and remote HTTP authentication behavior.
  • The npm package @azure/mcp, NuGet package Azure.Mcp, PyPI package msmcp-azure, and Microsoft Container Registry image all map back to the official Microsoft Azure MCP Server documentation and repository.

Duplicate check

This entry covers Microsoft's general Azure MCP Server for Azure cloud resources and services. It is intentionally separate from the existing Azure DevOps MCP Server entry, which focuses on Azure DevOps organizations, work items, repositories, pull requests, pipelines, wikis, and test plans. Before submission, the content tree and open PRs were checked for azure-mcp-server, Azure MCP Server, @azure/mcp, Azure.Mcp.Server, and the official microsoft/mcp Azure server path; no existing direct Azure MCP Server content entry or open content PR was found.

Disclosure

This is a source-backed listing for an official Microsoft open-source MCP server. The submitter is not affiliated with Microsoft, and no sponsorship, affiliate relationship, or paid placement is involved.

Source citations

Add this badge to your README

Show that Azure MCP Server for Claude is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.

Listed on HeyClaude
[![Listed on HeyClaude](https://heyclau.de/badge/mcp/azure-mcp-server.svg)](https://heyclau.de/entry/mcp/azure-mcp-server)

How it compares

Azure MCP Server for Claude side by side with 2 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.

Field

Official Microsoft Azure MCP server that connects Claude and other MCP clients to Azure subscriptions, resource groups, storage, databases, Key Vault, Monitor, App Service, AKS, AI Search, Cosmos DB, RBAC, pricing, and other Azure services through local stdio or self-hosted HTTP transports.

Open dossier

Official Microsoft Azure DevOps MCP server for querying work items, pull requests, repositories, pipelines, wikis, test plans, and project metadata through remote HTTP or local stdio transports.

Open dossier

Google Cloud gcloud MCP server from googleapis that lets Claude run approved gcloud CLI commands with allowlist and denylist controls for cloud resource inspection, automation, and operations.

Open dossier
Next steps
Trust
Review statusReviewedMaintainer reviewedReviewedMaintainer reviewedReviewedMaintainer reviewed
Package trustPackage not verifiedPackage not verifiedPackage not verified
Source provenanceSource-backedSource-backedSource-backed
Submitteroktofeesh1oktofeesh1oktofeesh1
Install riskReview firstReview firstReview first
Notes Safety ✓ Privacy ✓ Safety ✓ Privacy ✓ Safety ✓ Privacy ✓
BrandAzure logoAzureAzure logoAzuregcloud MCP Server logogcloud MCP Server
Categorymcpmcpmcp
SourceSource-backedSource-backedSource-backed
AuthorMicrosoftMicrosoftGoogle APIs
Added2026-06-042026-06-032026-06-06
Platforms
Harness
Source repo
Safety notesStart in read-only mode and narrow the exposed namespaces or individual tools before enabling broader Azure access. Microsoft documents read-only mode, namespace filters, single-tool mode, and learn mode as controls for reducing the active MCP surface. Azure MCP tools can inspect and manage real cloud resources. Depending on the tool and RBAC role, actions can create, update, delete, deploy, restart, query, or reconfigure resources and can incur cloud spend. Keep human approval on destructive, cost-bearing, deployment, RBAC, Key Vault, database, storage, messaging, and production-environment actions. Do not disable user confirmation for high-risk or sensitive-data commands unless the automation environment is tightly controlled. The server authenticates with Azure credentials available to the local machine or hosted environment. Limit the credential chain with `AZURE_TOKEN_CREDENTIALS`, managed identities, service principals, and least-privilege Azure RBAC where practical. For self-hosted HTTP deployments, configure Entra ID inbound authentication, outbound authentication strategy, network exposure, logging, and per-user versus server-identity audit requirements before sharing the endpoint. Docker setup uses Azure credential environment variables such as `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, and `AZURE_CLIENT_SECRET`; protect those values and never commit the env file. Microsoft documents telemetry environment variables for the server. Review `AZURE_MCP_COLLECT_TELEMETRY` and `AZURE_MCP_COLLECT_TELEMETRY_MICROSOFT` before using the server in sensitive environments. This is the Azure services MCP server. It is distinct from the Azure DevOps MCP server, which focuses on work items, repositories, pull requests, pipelines, wikis, and test plans.Start with read-only mode for investigation. The remote server supports the `X-MCP-Readonly: true` header, and the local server supports domain filtering so agents only load the Azure DevOps areas they need. Azure DevOps write-capable tools can create or update work items, pull requests, pull request comments, branches, wiki pages, test plans, test suites, test cases, and pipeline runs. Keep manual approval on any operation that changes project state. Treat Azure DevOps PATs, Microsoft Entra tokens, Azure CLI sessions, and MCP configuration as sensitive credentials. Do not paste tokens into prompts, commit them to repositories, or share them in issue/PR threads. Use toolsets, domains, project defaults, and team defaults to keep the MCP surface narrow. Loading every repo, work item, wiki, pipeline, and test plan tool can confuse the model and expose more context than the task needs. The remote MCP server is in public preview. Preview behavior, available tools, supported clients, and authentication requirements can change before general availability.gcloud MCP Server executes gcloud CLI commands with the permissions of the active gcloud account. Allowed commands can create, update, delete, deploy, scale, list, export, or configure Google Cloud resources depending on IAM permissions and selected services. The server blocks command substitution, pipes, redirection, SSH-style commands, interactive commands, and a default set of sensitive command prefixes, but allowed gcloud commands can still have real infrastructure, billing, IAM, and data impact. Use allowlists for narrow workflows and service account impersonation with limited roles when possible. Require human approval for IAM, billing, networking, firewall, storage, database, secret, deployment, delete, and production-impacting commands.
Privacy notesTool results can expose tenant IDs, subscription IDs, resource groups, resource names, tags, deployment outputs, Azure Monitor logs, metrics, pricing data, quotas, RBAC assignments, policy data, app settings, database metadata, storage account and blob metadata, and service-specific configuration. Key Vault, App Configuration, Storage, database, Service Bus, Event Hubs, Communication Services, and deployment tools may expose secrets, connection strings, keys, certificates, message contents, sample records, or customer data when the authenticated identity has permission. Microsoft documents user confirmation for tools that handle sensitive data, including Key Vault secrets, connection strings, passwords, certificate private keys, and other confidential values. Treat those prompts as a required guardrail rather than friction. MCP client logs, AI transcripts, local terminal history, hosted server logs, prompt traces, generated runbooks, and downstream tickets can retain Azure resource inventory and returned data outside Azure's original access and retention boundaries. Remote HTTP deployments require Entra ID bearer tokens on inbound requests and a configured outbound Azure authentication strategy. Choose On-Behalf-Of when per-user RBAC and audit trails matter, and managed identity only when the shared-server identity model is acceptable. Read-only mode reduces mutation risk, but it does not make returned Azure metadata or data safe to share with untrusted models, logs, chats, or third-party tools.Tool results can expose organization names, project names, teams, iteration data, capacity information, work item titles and fields, comments, attachments, pull request discussions, repository file content, branch names, commit metadata, pipeline logs, build artifacts, wiki pages, test plans, and search results. Work item comments, PR threads, pipeline logs, wiki pages, and attachments often contain customer data, production incident details, credentials, internal URLs, unreleased roadmap information, employee names, or security findings. MCP client logs, AI transcripts, generated code comments, local terminal history, and downstream ticket summaries can retain Azure DevOps content outside the original Azure DevOps audit, permission, and retention model. Microsoft Entra authentication exposes the user's organizational identity to the MCP client and constrains access to the authenticated user's Azure DevOps permissions.gcloud output can reveal project IDs, resource names, regions, IAM bindings, service accounts, logs, errors, labels, metadata, URLs, secrets references, billing context, and infrastructure topology. Authentication state, ADC files, service account impersonation details, access tokens, project IDs, and local gcloud configuration should stay out of prompts and repository files. Command output may be retained by the MCP client, model provider, terminal logs, shell history, and chat transcripts. Avoid broad listing or export commands against production projects unless data handling and retention have been reviewed.
Prerequisites
  • Azure subscription, tenant, and RBAC permissions for the resources Claude should inspect or manage.
  • MCP-capable client that can run local stdio servers or connect to a self-hosted HTTP MCP endpoint.
  • Azure authentication through Azure CLI, Azure PowerShell, Visual Studio, Visual Studio Code, Azure Developer CLI, browser login, service principal environment variables, workload identity, or managed identity.
  • Node.js 20 LTS or later and `npx` for the `@azure/mcp` package, or `uvx` for `msmcp-azure`, or .NET 10 Preview 6 or later for `Azure.Mcp`.
  • Azure DevOps organization and project membership for the resources Claude should access
  • Microsoft Entra ID connected Azure DevOps organization for the remote MCP server
  • Visual Studio Code or Visual Studio for the Microsoft-supported remote MCP preview path
  • Node.js 20 or later and npx for the optional local `@azure-devops/mcp` stdio server
  • Node.js 20 or newer with npm or another compatible package runner.
  • Google Cloud CLI installed and authenticated.
  • Active gcloud account, project, and configuration scoped to the intended environment.
  • Least-privilege user or service account impersonation for the allowed cloud actions.
Install
npx -y @azure/mcp@latest server start
claude mcp add azure-devops -- npx -y @azure-devops/mcp YOUR_AZURE_DEVOPS_ORG
npx -y @google-cloud/gcloud-mcp
Config
{
  "mcpServers": {
    "Azure MCP Server": {
      "command": "uvx",
      "args": [
        "--from",
        "msmcp-azure",
        "azmcp",
        "server",
        "start"
      ]
    }
  }
}
Manual-only setup:
{
  "servers": {
    "ado-remote-mcp": {
      "url": "https://mcp.dev.azure.com/YOUR_AZURE_DEVOPS_ORG",
      "type": "http",
      "headers": {
        "X-MCP-Toolsets": "repos,wiki,wit",
        "X-MCP-Readonly": "true"
      }
    }
  },
  "inputs": []
}
{
  "mcpServers": {
    "gcloud": {
      "command": "npx",
      "args": [
        "-y",
        "@google-cloud/gcloud-mcp"
      ],
      "type": "stdio"
    }
  }
}
Citations
ClaimUnclaimedUnclaimedUnclaimed
Open 3 picks in the interactive comparison tool

Related guides

Signals

Loading live community signals…

More like this, weekly

A short, calm digest of reviewed Claude resources. Unsubscribe any time.