Microsoft Fabric MCP Server

A production-grade Model Context Protocol server for Microsoft Fabric. Exposes Fabric operations as MCP tools over stdio (local) and Streamable HTTP (hosted/multi-user).

• TypeScript (ESM, Node 20+), REST-only (Fabric has no typed SDK)
• Transparent Long-Running Operation (LRO) handling — 202 + Location is polled to completion automatically
• Three auth modes: Azure CLI (az login), Service Principal (deploy path — Fabric has no PAT), OBO + Entra JWT (hosted)
• Per-tool RBAC, destructive-op guard, secret redaction, structured logging, retry + per-host circuit breaker
• Wraps the Fabric REST API, the Power BI API, and OneLake (per-resource token scopes)

Status: All phases complete — 105 tools across 17 domains, plus 4 resources and 4 prompts:

• core (11) · items (7) · lakehouses (7) · warehouses (4) · sqlendpoints (3) · shortcuts (4)
• notebooks (6) · pipelines (6) · jobs (6) · spark (6)
• semanticmodels (5) · reports (3) · dataflows (5)
• realtime (12: eventhouses, KQL databases, eventstreams) · onelake (5: files/dirs via DFS)
• git (7: workspace Git integration) · platform (8: deployment pipelines, connections, gateways)
• Resources: fabric://workspaces, fabric://workspace/{w}/items, …/lakehouses, …/item/{id}
• Prompts: medallion-architecture, document-workspace, build-etl, diagnose-refresh

Hardening: per-host circuit breaker, retry + Retry-After, transparent LRO polling, secret redaction, per-tool RBAC + destructive guard, audit logging, ESLint, Vitest suite (unit + live MCP-protocol test), Azure Pipelines CI.

1. Prerequisites

• Node.js ≥ 20
• A Fabric-enabled tenant and an identity with a Fabric/Power BI license (or a service principal enabled for Fabric APIs and added to the workspaces)
• One of: Azure CLI (az login), a service principal, or (hosted) an Entra app for OBO

2. Install & configure

cd "E:\MCP Servers\fabric-mcp-server"
npm install
cp .env.example .env   # PowerShell: Copy-Item .env.example .env

Minimum for local use with the Azure CLI:

AUTH_MODE=azcli
FABRIC_DEFAULT_WORKSPACE=        # optional default workspace ID

Auth modes

| AUTH_MODE | Needs | Notes | |---|---|---| | azcli | az login | Easiest for dev. Token minted for the Fabric scope. | | sp | AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET | Deployment path. The SP must be enabled in Fabric tenant settings and added to the workspaces. | | obo | same three | HTTP transport only. Validates the caller's Entra JWT, then exchanges it per resource (preserves user identity). |

3. Build & run

npm run build && npm start        # stdio (default)
node dist/index.js --transport http   # Streamable HTTP on PORT (default 3100)

4. Connect a client (npx)

{
  "mcpServers": {
    "fabric": {
      "command": "npx",
      "args": ["-y", "fabric-mcp-server"],
      "env": { "AUTH_MODE": "azcli", "FABRIC_DEFAULT_WORKSPACE": "<workspace-id>" }
    }
  }
}

For deployment use AUTH_MODE=sp with the three AZURE_* env vars.

5. Scripts

| Script | Purpose | |---|---| | npm run build | Compile TypeScript → dist/ | | npm start / start:http | Run compiled server (stdio / HTTP) | | npm run dev / dev:http | Watch-mode dev (tsx) | | npm run typecheck · lint · test · ci | Quality gates |

6. Architecture

transport (stdio | http)
  → server (McpServer + registry)
    → dispatch (RBAC · destructive guard · audit · error envelope)
      → domain tools (Zod schemas)
        → domain services
          → FabricClient (REST + retry + circuit breaker + LRO polling)
            → credential (AzCli | ServicePrincipal | OBO) → per-resource token

Each Fabric area is a self-contained module under src/domains/<area>/ exporting a DomainModule. To add an area, create the module and append it to domains in src/server.ts.

Key Fabric specifics: every write is an LRO (handled in src/client/fabricClient.ts); item definitions (notebooks, pipelines) are base64 file parts (helpers in src/domains/_shared.ts); tokens are acquired per resource (Fabric / Power BI / OneLake).

Full walkthrough: see docs/END_TO_END_FLOW.md for how a request travels through every layer (startup, a tool call step by step, the LRO + item-definition mechanisms, auth/scope flows, resources/prompts, and a worked medallion-ETL example).