MCP Server

StratoLens includes an MCP (Model Context Protocol) server, so your AI assistant can answer questions about your Azure environment from the data StratoLens already holds. Connect GitHub Copilot in VS Code, Claude, ChatGPT or any MCP client, and ask in plain language.

What You'll Learn

How an administrator turns MCP on, trusts client apps and sets a rate limit
How to connect VS Code (GitHub Copilot), Claude, ChatGPT or another MCP client, signing in with your Entra ID work account
What you can ask, such as "what changed since the last scan, and who did it?" or "where can we save money?", and why the answers match the StratoLens pages
How to fix sign-in failures and tool errors

Read-only, signed-in users only

No tool changes anything, in Azure or in StratoLens. Write and manage permissions you hold apply only in the StratoLens web app.
Only delegated user sign-in is accepted. Service principals, managed identities and other app-only sign-ins are rejected, so an agent running without a signed-in user cannot connect.
MCP is built on External API access: it is a second switch on top of the External API setting and uses the same trusted-client list and per-user grant.
Answers come from StratoLens scans, including change events and the activity log. Anything that happened after the latest scan is not visible until the next scan runs.

Key Capabilities

Connect your AI assistant

VS Code (GitHub Copilot), Claude (claude.ai, Claude Desktop, Claude Code), ChatGPT or any MCP client, set up from a guided wizard.

Admin-controlled access

Off by default. An administrator turns it on, picks which client apps are trusted and sets a per-minute call limit.

Your permissions, your scope

Every tool call runs as you, with your StratoLens roles and data scope. Nothing is written, in Azure or in StratoLens.

Answers that match the app

Tools apply the same filters and defaults as the StratoLens pages, so counts match, and every result links back into StratoLens.

20 read-only tools

Inventory, changes, access, security, policy, cost, savings, retirements and commitments.

Clear errors

Every refusal names its cause: a switched-off setting, an untrusted client, a missing permission or the rate limit.

Feature Integration

External API: MCP shares its master switch, trusted-client list, Add Trusted Client wizard and per-user grant. The scripting API itself is documented there.
User & Group Access: when access is restricted to granted users, the External API access flag on a grant governs MCP too.
Audit Log System: records changes to the MCP settings and to trusted clients. Individual tool calls are not audited.