| name | azure-network-ops |
| description | Azure cloud networking -- VNets, NSGs, ExpressRoute, VPN Gateways, Azure Firewalls, Load Balancers, Application Gateways, Route Tables, Network Watcher, Private Endpoints, DNS zones. Use when auditing Azure VNets, troubleshooting hybrid connectivity (ExpressRoute/VPN), checking NSG rules, inspecting firewall policies, or analyzing load balancer health. |
| version | 1.0.0 |
| license | Apache-2.0 |
| tags | ["azure","vnet","nsg","expressroute","vpn","firewall","load-balancer","dns","private-link"] |
Azure Network Operations
MCP Server
- Command:
python mcp-servers/azure-network-mcp/azure_network_mcp_server.py (stdio transport)
- Requires:
AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID
- Read-only: All operations are List/Get -- no create/modify/delete
- Auth: DefaultAzureCredential (service principal or Azure CLI fallback)
Available Tools (19)
Subscription (1)
| Tool | What It Does |
|---|
azure_list_subscriptions | List all accessible Azure subscriptions |
VNet Topology (3)
| Tool | What It Does |
|---|
azure_list_vnets | List all VNets with address space, subnet/peering count |
azure_get_vnet_details | Full VNet details: subnets (NSG, route table, delegations), peerings, DNS |
azure_get_vnet_peerings | VNet peering status with traffic forwarding settings |
NSG Security (3)
| Tool | What It Does |
|---|
azure_list_nsgs | List all NSGs with association info and orphan detection |
azure_get_nsg_rules | All rules (custom + default) sorted by priority |
azure_get_effective_security_rules | Effective aggregated rules for a NIC |
Compliance (1)
| Tool | What It Does |
|---|
azure_audit_nsg_compliance | CIS Azure Foundations Benchmark audit (rules 6.1-6.4) |
ExpressRoute (2)
| Tool | What It Does |
|---|
azure_get_expressroute_status | Circuit status, peering config, provisioning state |
azure_get_expressroute_routes | Learned route table for a peering |
VPN Gateway (1)
| Tool | What It Does |
|---|
azure_get_vpn_gateway_status | Gateway config, connections, BGP settings |
Firewall (2)
| Tool | What It Does |
|---|
azure_list_firewalls | List Azure Firewalls with SKU and policy association |
azure_get_firewall_policy | Policy details: rule collections, threat intel, IDPS |
Load Balancer (2)
| Tool | What It Does |
|---|
azure_list_load_balancers | List LBs with frontend/backend/probe summary |
azure_get_lb_backend_health | Backend pool health per member |
Application Gateway / Front Door (1)
| Tool | What It Does |
|---|
azure_get_app_gateway_health | App GW config, WAF, backend health; Front Door routing |
Supporting Services (3)
| Tool | What It Does |
|---|
azure_get_route_tables | Route tables, UDRs, effective routes for a NIC |
azure_get_network_watcher_status | Network Watcher availability, connection monitors, flow logs |
azure_get_private_endpoints | Private Endpoints with DNS zone associations |
azure_get_dns_zones | DNS zones (public/private) and record sets |
Workflow: VNet Topology Audit
When asked "show me our Azure network" or "audit Azure VNets":
azure_list_subscriptions -- discover available subscriptionsazure_list_vnets -- get all VNets in the target subscription- For each VNet:
azure_get_vnet_details -- subnets, peerings, DNS, NSGs
azure_get_vnet_peerings -- check peering state (Connected/Disconnected)- Report: VNet count, subnet utilization, peering health, orphaned NSGs
Workflow: Hybrid Connectivity Check
When asked "check ExpressRoute status" or "is the VPN tunnel up":
azure_get_expressroute_status -- circuit provisioning, peering stateazure_get_expressroute_routes -- verify learned routes from on-premazure_get_vpn_gateway_status -- VPN connection status, BGP peers- Report: circuit health, learned route count, tunnel status, bytes transferred
Workflow: Security Posture Assessment
When asked "audit NSG rules" or "check security posture":
azure_audit_nsg_compliance -- run CIS benchmark against all NSGsazure_list_nsgs -- identify orphaned NSGs- For flagged NSGs:
azure_get_nsg_rules -- review offending rules
azure_get_effective_security_rules -- verify effective rules on critical NICs- Report: findings by severity, remediation steps, orphan count
Important Rules
- Read-only: Never attempt to create, modify, or delete Azure resources
- Subscription-scoped: Always specify or use default subscription_id
- GAIT logging: All tool calls are audit-logged with timestamp, operation, and result
- Multi-subscription: Pass subscription_id to query across subscriptions
- Rate limits: Azure ARM allows ~1200 reads/5min per tenant; server auto-retries on 429
Environment Variables
| Variable | Required | Description |
|---|
AZURE_TENANT_ID | Yes | Azure AD tenant ID |
AZURE_CLIENT_ID | Yes | Service principal client ID |
AZURE_CLIENT_SECRET | Yes | Service principal secret |
AZURE_SUBSCRIPTION_ID | Yes | Default subscription |
