azure-network-ops

Azure Network Operations

MCP Server

• Command: python mcp-servers/azure-network-mcp/azure_network_mcp_server.py (stdio transport)
• Requires: AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID
• Read-only: All operations are List/Get -- no create/modify/delete
• Auth: DefaultAzureCredential (service principal or Azure CLI fallback)

Available Tools (19)

Subscription (1)

Tool	What It Does
azure_list_subscriptions	List all accessible Azure subscriptions

VNet Topology (3)

Tool	What It Does
azure_list_vnets	List all VNets with address space, subnet/peering count
azure_get_vnet_details	Full VNet details: subnets (NSG, route table, delegations), peerings, DNS
azure_get_vnet_peerings	VNet peering status with traffic forwarding settings

NSG Security (3)

Tool	What It Does
azure_list_nsgs	List all NSGs with association info and orphan detection
azure_get_nsg_rules	All rules (custom + default) sorted by priority
azure_get_effective_security_rules	Effective aggregated rules for a NIC

Compliance (1)

Tool	What It Does
azure_audit_nsg_compliance	CIS Azure Foundations Benchmark audit (rules 6.1-6.4)

ExpressRoute (2)

Tool	What It Does
azure_get_expressroute_status	Circuit status, peering config, provisioning state
azure_get_expressroute_routes	Learned route table for a peering

VPN Gateway (1)

Tool	What It Does
azure_get_vpn_gateway_status	Gateway config, connections, BGP settings

Firewall (2)

Tool	What It Does
azure_list_firewalls	List Azure Firewalls with SKU and policy association
azure_get_firewall_policy	Policy details: rule collections, threat intel, IDPS

Load Balancer (2)

Tool	What It Does
azure_list_load_balancers	List LBs with frontend/backend/probe summary
azure_get_lb_backend_health	Backend pool health per member

Application Gateway / Front Door (1)

Tool	What It Does
azure_get_app_gateway_health	App GW config, WAF, backend health; Front Door routing

Supporting Services (3)

Tool	What It Does
azure_get_route_tables	Route tables, UDRs, effective routes for a NIC
azure_get_network_watcher_status	Network Watcher availability, connection monitors, flow logs
azure_get_private_endpoints	Private Endpoints with DNS zone associations
azure_get_dns_zones	DNS zones (public/private) and record sets

Workflow: VNet Topology Audit

When asked "show me our Azure network" or "audit Azure VNets":

1. azure_list_subscriptions -- discover available subscriptions
2. azure_list_vnets -- get all VNets in the target subscription
3. For each VNet: azure_get_vnet_details -- subnets, peerings, DNS, NSGs
4. azure_get_vnet_peerings -- check peering state (Connected/Disconnected)
5. Report: VNet count, subnet utilization, peering health, orphaned NSGs

Workflow: Hybrid Connectivity Check

When asked "check ExpressRoute status" or "is the VPN tunnel up":

1. azure_get_expressroute_status -- circuit provisioning, peering state
2. azure_get_expressroute_routes -- verify learned routes from on-prem
3. azure_get_vpn_gateway_status -- VPN connection status, BGP peers
4. Report: circuit health, learned route count, tunnel status, bytes transferred

Workflow: Security Posture Assessment

When asked "audit NSG rules" or "check security posture":

1. azure_audit_nsg_compliance -- run CIS benchmark against all NSGs
2. azure_list_nsgs -- identify orphaned NSGs
3. For flagged NSGs: azure_get_nsg_rules -- review offending rules
4. azure_get_effective_security_rules -- verify effective rules on critical NICs
5. Report: findings by severity, remediation steps, orphan count

Important Rules

• Read-only: Never attempt to create, modify, or delete Azure resources
• Subscription-scoped: Always specify or use default subscription_id
• GAIT logging: All tool calls are audit-logged with timestamp, operation, and result
• Multi-subscription: Pass subscription_id to query across subscriptions
• Rate limits: Azure ARM allows ~1200 reads/5min per tenant; server auto-retries on 429

Environment Variables

Variable	Required	Description
AZURE_TENANT_ID	Yes	Azure AD tenant ID
AZURE_CLIENT_ID	Yes	Service principal client ID
AZURE_CLIENT_SECRET	Yes	Service principal secret
AZURE_SUBSCRIPTION_ID	Yes	Default subscription