1---
2name: azure-network-ops
3description: "Azure cloud networking -- VNets, NSGs, ExpressRoute, VPN Gateways, Azure Firewalls, Load Balancers, Application Gateways, Route Tables, Network Watcher, Private Endpoints, DNS zones. Use when auditing Azure VNets, troubleshooting hybrid connectivity (ExpressRoute/VPN), checking NSG rules, inspecting firewall policies, or analyzing load balancer health."
4version: 1.0.0
5license: Apache-2.0
6tags: [azure, vnet, nsg, expressroute, vpn, firewall, load-balancer, dns, private-link]
7---
8
9# Azure Network Operations
10
11## MCP Server
12
13- **Command**: `python mcp-servers/azure-network-mcp/azure_network_mcp_server.py` (stdio transport)
14- **Requires**: `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`, `AZURE_SUBSCRIPTION_ID`
15- **Read-only**: All operations are List/Get -- no create/modify/delete
16- **Auth**: DefaultAzureCredential (service principal or Azure CLI fallback)
17
18## Available Tools (19)
19
20### Subscription (1)
21
22| Tool | What It Does |
23|------|-------------|
24| `azure_list_subscriptions` | List all accessible Azure subscriptions |
25
26### VNet Topology (3)
27
28| Tool | What It Does |
29|------|-------------|
30| `azure_list_vnets` | List all VNets with address space, subnet/peering count |
31| `azure_get_vnet_details` | Full VNet details: subnets (NSG, route table, delegations), peerings, DNS |
32| `azure_get_vnet_peerings` | VNet peering status with traffic forwarding settings |
33
34### NSG Security (3)
35
36| Tool | What It Does |
37|------|-------------|
38| `azure_list_nsgs` | List all NSGs with association info and orphan detection |
39| `azure_get_nsg_rules` | All rules (custom + default) sorted by priority |
40| `azure_get_effective_security_rules` | Effective aggregated rules for a NIC |
41
42### Compliance (1)
43
44| Tool | What It Does |
45|------|-------------|
46| `azure_audit_nsg_compliance` | CIS Azure Foundations Benchmark audit (rules 6.1-6.4) |
47
48### ExpressRoute (2)
49
50| Tool | What It Does |
51|------|-------------|
52| `azure_get_expressroute_status` | Circuit status, peering config, provisioning state |
53| `azure_get_expressroute_routes` | Learned route table for a peering |
54
55### VPN Gateway (1)
56
57| Tool | What It Does |
58|------|-------------|
59| `azure_get_vpn_gateway_status` | Gateway config, connections, BGP settings |
60
61### Firewall (2)
62
63| Tool | What It Does |
64|------|-------------|
65| `azure_list_firewalls` | List Azure Firewalls with SKU and policy association |
66| `azure_get_firewall_policy` | Policy details: rule collections, threat intel, IDPS |
67
68### Load Balancer (2)
69
70| Tool | What It Does |
71|------|-------------|
72| `azure_list_load_balancers` | List LBs with frontend/backend/probe summary |
73| `azure_get_lb_backend_health` | Backend pool health per member |
74
75### Application Gateway / Front Door (1)
76
77| Tool | What It Does |
78|------|-------------|
79| `azure_get_app_gateway_health` | App GW config, WAF, backend health; Front Door routing |
80
81### Supporting Services (3)
82
83| Tool | What It Does |
84|------|-------------|
85| `azure_get_route_tables` | Route tables, UDRs, effective routes for a NIC |
86| `azure_get_network_watcher_status` | Network Watcher availability, connection monitors, flow logs |
87| `azure_get_private_endpoints` | Private Endpoints with DNS zone associations |
88| `azure_get_dns_zones` | DNS zones (public/private) and record sets |
89
90## Workflow: VNet Topology Audit
91
92When asked "show me our Azure network" or "audit Azure VNets":
93
941. `azure_list_subscriptions` -- discover available subscriptions
952. `azure_list_vnets` -- get all VNets in the target subscription
963. For each VNet: `azure_get_vnet_details` -- subnets, peerings, DNS, NSGs
974. `azure_get_vnet_peerings` -- check peering state (Connected/Disconnected)
985. Report: VNet count, subnet utilization, peering health, orphaned NSGs
99
100## Workflow: Hybrid Connectivity Check
101
102When asked "check ExpressRoute status" or "is the VPN tunnel up":
103
1041. `azure_get_expressroute_status` -- circuit provisioning, peering state
1052. `azure_get_expressroute_routes` -- verify learned routes from on-prem
1063. `azure_get_vpn_gateway_status` -- VPN connection status, BGP peers
1074. Report: circuit health, learned route count, tunnel status, bytes transferred
108
109## Workflow: Security Posture Assessment
110
111When asked "audit NSG rules" or "check security posture":
112
1131. `azure_audit_nsg_compliance` -- run CIS benchmark against all NSGs
1142. `azure_list_nsgs` -- identify orphaned NSGs
1153. For flagged NSGs: `azure_get_nsg_rules` -- review offending rules
1164. `azure_get_effective_security_rules` -- verify effective rules on critical NICs
1175. Report: findings by severity, remediation steps, orphan count
118
119## Important Rules
120
121- **Read-only**: Never attempt to create, modify, or delete Azure resources
122- **Subscription-scoped**: Always specify or use default subscription_id
123- **GAIT logging**: All tool calls are audit-logged with timestamp, operation, and result
124- **Multi-subscription**: Pass subscription_id to query across subscriptions
125- **Rate limits**: Azure ARM allows ~1200 reads/5min per tenant; server auto-retries on 429
126
127## Environment Variables
128
129| Variable | Required | Description |
130|----------|----------|-------------|
131| `AZURE_TENANT_ID` | Yes | Azure AD tenant ID |
132| `AZURE_CLIENT_ID` | Yes | Service principal client ID |
133| `AZURE_CLIENT_SECRET` | Yes | Service principal secret |
134| `AZURE_SUBSCRIPTION_ID` | Yes | Default subscription |
gabrielmoreira