Azure Security MCP Agent MCP Server

Azure Security MCP Agent

An AI-powered agent that uses Model Context Protocol (MCP) tools and a Groq LLM to analyze the security of your Azure infrastructure.

The design is inspired by the YouTube example yt-mcp-agent `github.com/ShawhinT/yt-mcp-agent` but adapted for cloud security and Azure.

Overview

This project shows how to build a security-focused AI agent that can:

• Discover resources across an Azure subscription
• Analyze Network Security Groups (NSGs) for dangerous rules
• Audit storage accounts for insecure configuration
• List public IPs and identify exposed assets
• Check basic VM security posture
• Explain risks and relate them to CIS Azure best practices (you can reference the included CIS PDF)

There are three main entry points:

• main.py – OpenAI Agents SDK + MCP tools (Groq model) – recommended path
• agent.py – LangChain/LangGraph ReAct-style agent using the same MCP tools
• demo.py – Offline Groq-only demo using mock Azure data (no Azure access required)

Architecture

┌──────────────────────────────┐
│        Groq LLM API          │   (llama-3.3-70b-versatile via OpenAI-compatible API)
└───────────────┬──────────────┘
                │
                ▼
┌─────────────────────────────────────────────┐
│  Agent Clients                              │
│  - main.py  (OpenAI Agents SDK + MCP tools) │
│  - agent.py (LangChain / LangGraph)         │
└───────────────┬─────────────────────────────┘
                │  (MCP JSON-RPC over stdio)
                ▼
┌─────────────────────────────────────────────┐
│  MCP Server (FastMCP)                       │
│  - server.py                                │
│  - exposes azure_* tools                    │
└───────────────┬─────────────────────────────┘
                │
                ▼
┌─────────────────────────────────────────────┐
│  Azure SDK for Python                       │
│  - azure-identity / mgmt-resource/network   │
│  - mgmt-storage / mgmt-compute              │
└─────────────────────────────────────────────┘

Key Components

• server.py
  FastMCP-based MCP server (FastMCP("azure-security-analyzer")) exposing tools like:

  • azure_list_resource_groups
  • azure_list_nsgs
  • azure_list_storage_accounts
  • azure_list_resources
  • azure_check_nsg_rules
  • azure_check_storage_security
  • azure_list_public_ips
  • azure_check_vm_security
    It also exposes a system_prompt via @mcp.prompt() that reads from prompts/system_instructions.md.

• main.py
  Uses the OpenAI Agents SDK (agents.Agent, MCPServerStdio) to:

  • Start the MCP server (server.py) as a subprocess over stdio
  • Attach all MCP tools to the agent automatically
  • Use Groq as the model via the OpenAI-compatible API
  • Provide a simple terminal loop where you type natural-language security questions

• agent.py
  An alternative LangChain/LangGraph implementation that:

  • Connects to the same MCP server
  • Wraps MCP tools into LangChain tools
  • Uses a ReAct-style graph to decide which Azure tools to call

• demo.py
  Offline demo that feeds mock Azure findings (e.g. open NSG rules, insecure storage settings) into Groq and asks it to produce a security report. Useful when you don’t have real Azure access.

• prompts/system_instructions.md
  System instructions for the agent (how to interpret tool results, severity levels, report format, etc.). You can customize this to align more strictly with the CIS Microsoft Azure Compute Services Benchmark (the PDF included in this repo).

Prerequisites

• Python 3.10+
• Azure subscription with at least some test resources
• Azure CLI (az) for local authentication
• Groq account + API key (https://console.groq.com)
• (Optional) Basic familiarity with CIS Azure benchmarks

Setup

1. Create and activate a virtual environment

Windows (PowerShell):

cd C:\Users\MSI\mcp_project
python -m venv venv
.\venv\Scripts\Activate.ps1
pip install -r requirements.txt

Linux / macOS:

cd /path/to/mcp_project
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Re-activate the venv in each new terminal before running the project.

2. Authenticate to Azure

az login

# (optional) select a specific subscription
az account set --subscription "YOUR-SUBSCRIPTION-ID"

# show your current subscription id
az account show --query id -o tsv

3. Configure environment variables

Create a .env file in the project root:

GROQ_API_KEY=gsk_xxxxxxxxxxxxxxxxxxxxx
AZURE_SUBSCRIPTION_ID=your-subscription-id

These are read by both main.py and agent.py.

Running the Agent (OpenAI Agents SDK + MCP tools)

This path is closest to the yt-mcp-agent example and is the recommended way to use the