Azure Topology Graph MCP Server

How to use

Connect your Cursor MCP client to the Azure Topology Graph MCP Server to begin building and exploring your Azure topology. You can search for resources across subscriptions, inspect detailed resource configurations, explore how resources connect, and export the full topology for reporting or offline analysis. Use the available actions to refresh data, find paths between resources, and export a compact summary of your environment.

Key workflows you can perform include: searching for resources by name or type, discovering neighboring resources, locating connectivity paths between two Azure resources, and exporting the topology graph in JSON or a concise summary.

How to install

Prerequisites are Node.js 16 or later and access to an Azure service principal with read permissions to your subscriptions.

Step-by-step setup commands (run in your terminal):

git clone <your-repo-url>
cd azure_mcp_graph
npm install
npm run build

# After building, configure Cursor to connect to this MCP server (example shown in config.json below)

Configuration for Cursor MCP

Configure Cursor to load the Azure topology graph MCP server. Add the following to your Cursor MCP configuration file (usually at ~/.cursor/config.json):

{
  "mcpServers": {
    "azure_graph": {
      "command": "node",
      "args": ["/path/to/azure_mcp_graph/dist/server.js"],
      "env": {
        "AZURE_TENANT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "AZURE_CLIENT_ID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
        "AZURE_CLIENT_SECRET": "your-service-principal-secret",
        "SUBSCRIPTION_IDS": "sub-id-1,sub-id-2,sub-id-3",
        "DEFAULT_RG": "MyWorkloadRG",
        "DEFAULT_REGION": "eastus",
        "NETWORK_WATCHER_NAME": "NetworkWatcher_eastus"
      }
    }
  }
}

Additional configuration details

The MCP server uses Azure Resource Graph for inventory, ARM APIs for detailed resource configuration, and Network Watcher for network topology. You can tailor the defaults to your environment by setting the default resource group, region, and the Network Watcher name in the env variables.

Security and credentials

Treat the Azure service principal credentials as sensitive. Do not hard-code secrets in config files. Use secure secret management practices and rotate credentials as needed.

Troubleshooting

Authentication issues usually stem from insufficient permissions or invalid credentials. Verify the service principal has Reader access to the target subscriptions and resource groups, and confirm that the tenant, client, and secret values are correct.

If you experience performance issues, the server caches topology data to improve responsiveness. You can force a cache refresh to get up-to-date topology data.

Network connectivity problems can arise if your environment blocks access to Azure APIs. Ensure outbound access and review any firewall or proxy restrictions.

Architecture

The server combines Azure Clients for Resource Graph, ARM, and Network Watcher, a Graph Builder to assemble the topology, a Relationship Analyzer to identify connections, MCP Tools exposure for client interactions, and intelligent caching to optimize performance.

search_resources

Search Azure resources by name, type, or other properties

get_resource

Get detailed information about a specific Azure resource

get_neighbors

Get resources connected to a specific resource

find_path

Find connection paths between two Azure resources

export_topology

Export the complete topology graph (JSON or summary)

refresh_topology

Refresh the topology cache by re-querying Azure