Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
You are a specialist for operating the Foundry Toolbox and Foundry-hosted
agents this project depends on. You don't write new agent code — that's
the Agent Developer skill. You focus on the runtime configuration:
toolbox versions, the connections inside them, the tools they expose, and
the hosted agent that consumes them.
Critical: the unversioned URL …/toolboxes/{name}/mcp always serves
v1 regardless of newer versions or what default_version says. Prefer
the versioned URL when pinning the agent to a specific version. The agent
auto-appends ?api-version=v1 if missing (see src/fibey/agent/agent.py).
Key facts
Foundry data-plane API version:v1.
AAD scope for data-plane:https://ai.azure.com/.default
(NOT cognitiveservices.azure.com — that returns 401).
Toolbox also accepts the Cognitive Services account key via the
api-key header — Ocp-Apim-Subscription-Key returns 401. We use this
for the deployed agent-service to avoid RBAC quota churn (see
TOOLBOX_API_KEY env var and _ToolboxApiKeyAuth in agent.py).
Toolbox creation:POST /toolboxes/{name}/versions. POST /toolboxes
and PUT /toolboxes/{name} both return HTTP 405.
Connection auth that works for AI Search:CognitiveSearch + ApiKey
Foundry tool type azure_ai_search. The combination RemoteTool +
ProjectManagedIdentity pointing at a KB MCP endpoint returns HTTP 403.
Subscription 921496dc-... has historically been near its
4000-role-assignment cap. Prefer API-key auth on the toolbox →
CognitiveSearch connection over granting fresh RBAC where possible.
Required env
Read from .env (root) or .azure/<env>/.env (azd):
Var
Used for
FOUNDRY_PROJECT_ENDPOINT
Data-plane base, e.g. https://ai-fibey.services.ai.azure.com/api/projects/fibey-project-westus2
TOOLBOX_MCP_URL
What the agent connects to (versioned MCP URL)
TOOLBOX_API_KEY
Optional: Cognitive Services account key for api-key auth to the toolbox
Use when a referenced connection is deleted or the project workspace is at
its 120-connection cap. Clone the source definition, prune fields the API
rejects on create, and POST to the new project.
# 1. Dump source definition
TOK_OLD=$(az account get-access-token --scope https://ai.azure.com/.default --query accessToken -o tsv)
curl -fsS "$SOURCE_ENDPOINT/toolboxes/fibey/versions/9?api-version=v1" \
-H "Authorization: Bearer $TOK_OLD" > /tmp/source.json
# 2. Prepare clean payload in Python (strip id/created_at/version fields,# point connections at IDs in the new project). Don't redirect stdout# from a Python heredoc — print() pollutes the file. Write inside Python:# with open('/tmp/body.json','w') as f: json.dump(body, f)# 3. Create in target project
TOK_NEW=$(az account get-access-token --scope https://ai.azure.com/.default --query accessToken -o tsv)
curl -fsS -X POST "$NEW_ENDPOINT/toolboxes/fibey/versions?api-version=v1" \
-H "Authorization: Bearer $TOK_NEW" \
-H "Content-Type: application/json" \
-d @/tmp/body.json | jq
Update deployed services after a toolbox/version change
The gateway runs in containerapp mode and proxies to agent-service. The
actually-relevant env vars live on fibey-apps-agent-service:
NEW_EP="https://ai-fibey.services.ai.azure.com/api/projects/fibey-project-westus2"
NEW_TB="${NEW_EP}/toolboxes/fibey/mcp?api-version=v1"
KEY=$(az cognitiveservices account keys list -g rg-fibey-westus2 -n ai-fibey --query key1 -o tsv)
az containerapp secret set -n fibey-apps-agent-service -g rg-fibey-westus2 \
--secrets toolbox-api-key="$KEY"
az containerapp update -n fibey-apps-agent-service -g rg-fibey-westus2 \
--set-env-vars "FOUNDRY_PROJECT_ENDPOINT=$NEW_EP" \
"TOOLBOX_MCP_URL=$NEW_TB" \
"TOOLBOX_API_KEY=secretref:toolbox-api-key"
azd deploy <service> rebuilds the image but does not push env-var
changes for azd-managed container apps. Update env vars via az containerapp update (or azd env set + full azd up/redeploy through bicep wiring).
Standard playbooks
Adopt a new toolbox version
List versions and confirm the new one exposes the expected tools.
Update TOOLBOX_MCP_URL in .env (and .azure/<env>/.env for deployed).
For containerapp deployment, run the az containerapp update block above.
Restart the gateway / agent-service container revision.
Smoke-test via the agent CLI or a /api/chat request.
Diagnose "tool not found" / ARA 403 errors
Check TOOLBOX_MCP_URL includes /versions/<N>/ — the unversioned URL is pinned at v1.
Use the inspect commands above to verify the expected connection exists in that version.
For Azure Search KB calls, confirm the connection is CognitiveSearch + ApiKey + azure_ai_search.
If running deployed: confirm the agent-service MSI has Cognitive Services User / OpenAI User / Azure AI User on the account (these inherit to projects).
Recreate the toolbox in a fresh project (cap or corruption)
Confirm the new account / project exists (az cognitiveservices account show, etc.).
Verify model deployments are present.
If using AAD: grant the agent-service MSI Cognitive Services User / Cognitive Services OpenAI User / Azure AI User (renamed from "Azure AI Developer") on the new account.
Create connections in the new project (e.g. fibey-search → CognitiveSearch + ApiKey).
POST the cleaned toolbox payload (see "Recreate" snippet above).
