Azure Cloud Master MCP

An MCP server that acts as your Azure cloud engineer. Plans, provisions, analyzes, and optimizes Azure resources using az CLI with security, DevSecOps, and FinOps best practices.

[!WARNING]
DISCLAIMER: Use with awareness. This MCP has the ability to make destructive changes to your Azure environment. We do not recommend using this directly against production environments without extreme caution.

Every destructive action requires your explicit permission and approval. Always review the generated az commands before allowing the MCP to execute them.

Prerequisites

• Node.js >= 18
• Azure CLI installed (Install guide)
• Azure login: az login --use-device-code

Quick Start

Option 1: npx (after publishing to npm)

{
  "mcpServers": {
    "azure-cloud-master": {
      "command": "npx",
      "args": ["-y", "azure-cloud-master-mcp"]
    }
  }
}

Option 2: Local build

git clone <repo-url>
cd azure-cloud-master-mcp
npm install
npm run build

Then add to your IDE's MCP config:

{
  "mcpServers": {
    "azure-cloud-master": {
      "command": "node",
      "args": ["/absolute/path/to/azure-cloud-master-mcp/dist/index.js"]
    }
  }
}

IDE Configuration

Claude Code

Add to ~/.claude/claude_desktop_config.json:

{
  "mcpServers": {
    "azure-cloud-master": {
      "command": "node",
      "args": ["C:/path/to/azure-cloud-master-mcp/dist/index.js"]
    }
  }
}

VS Code

Add to .vscode/settings.json or VS Code MCP settings:

{
  "mcp": {
    "servers": {
      "azure-cloud-master": {
        "command": "node",
        "args": ["C:/path/to/azure-cloud-master-mcp/dist/index.js"]
      }
    }
  }
}

Antigravity

Add via MCP server configuration with the same node + path pattern.

Available Tools

| Tool | Purpose | Makes Changes? | |------|---------|:-:| | azure_check_auth | Verify az login status | No | | azure_execute_commands | Run az commands (with approval) | Yes | | azure_generate_plan | Create deployment plan for architectures | No | | azure_list_resource_groups | List all resource groups | No | | azure_list_resources | List resources in a Resource Group | No | | azure_cost_analysis | Cost optimization audit | No | | azure_apply_best_practice | Generate copy-paste remediation commands | No |

🛡️ Security Analyzers (Generates Markdown Reports)

All analysis tools identify risks and output a detailed Markdown report internally while returning summaries directly to the chat!

| Tool | Purpose | Makes Changes? | |------|---------|:-:| | azure_analyze_security | General Security & best practice audit | No | | azure_analyze_vm | Check VMs for unencrypted disks, public IPs | No | | azure_analyze_sqldb | Check SQL DBs for TDE, weak TLS, Auth | No | | azure_analyze_aks | Check AKS for RBAC, API Server restrictions | No | | azure_analyze_appgw | Analyze App Gateway for WAF, HTTPS | No | | azure_analyze_vnet | Check VNets for missing NSGs, peering security| No | | azure_analyze_entraid | Analyze Azure AD permissions, Roles, CA | No | | azure_analyze_appservice_traffic | Analyze AppService network access | No | | azure_analyze_storage | Analyze Storage Accounts for public access | No | | azure_analyze_nsg | Analyze NSGs for exposed RDP/SSH/HTTP ports | No | | azure_analyze_acr | Check Container Registry anonymity & access | No | | azure_analyze_keyvault | Check KeyVault soft-delete & RBAC | No |

Example Prompts

• "Check if I'm logged in to Azure"
• "Show me all my resource groups"
• "I need a Hub and Spoke network for dev environment"
• "Analyze my-rg for security issues"
• "Audit my VMs and SQL Databases for security vulnerabilities"
• "Check if my resources are cost-optimized"
• "Fix the NSG issue NSG-001 on my-nsg"

📝 Automated Reporting

Whenever you run a security analysis tool (e.g., azure_analyze_vm), the MCP automatically creates a timestamped markdown report inside the reports/ directory locally.

Architecture

Your IDE <--MCP/stdio--> Azure Cloud Master <--subprocess--> az CLI <--> Azure

The MCP server never stores credentials. It relies entirely on the user's existing az login session.

Security Model

1. Auth is validated on every request
2. Only az CLI commands are allowed (no arbitrary shell commands)
3. Dangerous operations (az logout, az ad app delete, etc.) are blocked
4. DISCLAIMER: The MCP can make destructive changes. Operations via azure_execute_commands require explicit user permission and approval before execution.
5. Execution stops on first failure - no silent errors

Testing

npm run build
npx @modelcontextprotocol/inspector dist/index.js

License

MIT