fabric-analytics-mcp

A lightweight MCP (Model Context Protocol) server that connects AI agents to Microsoft Fabric and Power BI. Single authentication, two endpoints.

What it does

Claude Code (and other MCP clients) cannot directly authenticate with Microsoft's remote MCP servers because Entra ID doesn't support MCP's dynamic client registration. This proxy handles MSAL device-code authentication locally and forwards requests to both Microsoft endpoints:

• Power BI (api.fabric.microsoft.com/v1/mcp/powerbi) — DAX queries, semantic model schemas, report metadata, query generation
• Fabric Core (api.fabric.microsoft.com/v1/mcp/core) — workspace management, item CRUD, catalog search, permissions, folders

Tool calls are automatically routed to the correct endpoint based on which upstream advertised the tool.

Prerequisites

• Node.js >= 20.11
• A Microsoft account with access to Power BI / Fabric workspaces
• Your Power BI admin must enable: "Users can use the Power BI MCP server endpoint (preview)"

No Azure app registration is required. The proxy uses a built-in public Power BI client ID.

Setup

git clone https://github.com/<your-username>/fabric-analytics-mcp.git
cd fabric-analytics-mcp
npm install
npm run build

Claude Code

claude mcp add --transport stdio --scope local fabric-analytics-mcp \
  -- node /path/to/fabric-analytics-mcp/dist/src/index.js

Restart Claude Code, then call fabric_auth_start — it will return a Microsoft device code and URL. Sign in once; tokens cache locally and auto-refresh.

Other MCP clients

Add as a stdio server pointing to node /path/to/fabric-analytics-mcp/dist/src/index.js.

Local tools

These tools are handled by the proxy itself (no remote call needed):

| Tool | Description | |---|---| | fabric_auth_start | Start Microsoft device-code sign-in | | fabric_auth_status | Check authentication status | | fabric_auth_logout | Clear local token cache | | fabric_set_context | Set active workspace/semantic model for the session | | fabric_get_context | Show current context | | fabric_clear_context | Reset session context |

Remote tools

After authentication, all tools from both upstream endpoints are discovered and merged automatically. These include:

From Power BI:

• ExecuteQuery — Run DAX queries
• GetSemanticModelSchema — Model metadata (tables, columns, measures, relationships)
• GenerateQuery — Natural language to DAX (requires Copilot license)
• GetReportMetadata — Report pages, visuals, filters

From Fabric Core (read-only):

• list_workspaces, get_workspace — Discover workspaces
• list_items, get_item, get_item_definition — Browse items
• search_catalog — Search OneLake catalog
• list_workspace_roles, get_workspace_role — View permissions
• list_folders, get_folder — Browse folder structure
• list_capacities — View capacity info

Safety: Destructive operations (create_*, update_*, delete_*, move_*, bulk_*, role mutations) are blocked at the proxy level. This MCP is designed for read-only analytics, not resource management.

Environment variables

All optional. Defaults work out of the box.

| Variable | Default | |---|---| | FABRIC_MCP_POWERBI_URL | https://api.fabric.microsoft.com/v1/mcp/powerbi | | FABRIC_MCP_CORE_URL | https://api.fabric.microsoft.com/v1/mcp/core | | FABRIC_MCP_CLIENT_ID | Built-in public Power BI client ID | | FABRIC_MCP_TENANT_ID | organizations (multi-tenant) | | FABRIC_MCP_SCOPES | https://api.fabric.microsoft.com/.default | | FABRIC_MCP_CACHE_DIR | ~/.fabric-analytics-mcp | | FABRIC_MCP_TIMEOUT_SECONDS | 60 |

CLI helpers

npm run login    # Authenticate from terminal
npm run logout   # Clear token cache
npm run status   # Show cached accounts

Security

• One runtime dependency: @azure/msal-node (Microsoft's official auth library)
• Tokens are only sent to api.fabric.microsoft.com — no third-party services
• Token cache is stored locally with restricted file permissions (0o600)
• No telemetry, no analytics, no data exfiltration

License

MIT