loading…
Spring AI MCP Server
Provides auto-configuration for setting up an MCP server in Spring Boot applications.
автор: Community
0.00
Search for a command to run...
loading…
An AI-powered security agent that utilizes MCP tools and Groq LLMs to analyze Azure infrastructure, audit security groups, and identify storage misconfiguration
An AI-powered security agent that utilizes MCP tools and Groq LLMs to analyze Azure infrastructure, audit security groups, and identify storage misconfigurations. It enables users to perform natural language security assessments and ensure compliance with CIS Azure best practices.
An AI-powered agent that uses Model Context Protocol (MCP) tools and a Groq LLM to analyze the security of your Azure infrastructure.
The design is inspired by the YouTube example yt-mcp-agent github.com/ShawhinT/yt-mcp-agent but adapted for cloud security and Azure.
This project shows how to build a security-focused AI agent that can:
There are three main entry points:
main.py – OpenAI Agents SDK + MCP tools (Groq model) – recommended pathagent.py – LangChain/LangGraph ReAct-style agent using the same MCP toolsdemo.py – Offline Groq-only demo using mock Azure data (no Azure access required)┌──────────────────────────────┐
│ Groq LLM API │ (llama-3.3-70b-versatile via OpenAI-compatible API)
└───────────────┬──────────────┘
│
▼
┌─────────────────────────────────────────────┐
│ Agent Clients │
│ - main.py (OpenAI Agents SDK + MCP tools) │
│ - agent.py (LangChain / LangGraph) │
└───────────────┬─────────────────────────────┘
│ (MCP JSON-RPC over stdio)
▼
┌─────────────────────────────────────────────┐
│ MCP Server (FastMCP) │
│ - server.py │
│ - exposes azure_* tools │
└───────────────┬─────────────────────────────┘
│
▼
┌─────────────────────────────────────────────┐
│ Azure SDK for Python │
│ - azure-identity / mgmt-resource/network │
│ - mgmt-storage / mgmt-compute │
└─────────────────────────────────────────────┘
server.py
FastMCP-based MCP server (FastMCP("azure-security-analyzer")) exposing tools like:
azure_list_resource_groupsazure_list_nsgsazure_list_storage_accountsazure_list_resourcesazure_check_nsg_rulesazure_check_storage_securityazure_list_public_ipsazure_check_vm_securitysystem_prompt via @mcp.prompt() that reads from prompts/system_instructions.md.main.py
Uses the OpenAI Agents SDK (agents.Agent, MCPServerStdio) to:
server.py) as a subprocess over stdioagent.py
An alternative LangChain/LangGraph implementation that:
demo.py
Offline demo that feeds mock Azure findings (e.g. open NSG rules, insecure storage settings) into Groq and asks it to produce a security report. Useful when you don’t have real Azure access.
prompts/system_instructions.md
System instructions for the agent (how to interpret tool results, severity levels, report format, etc.). You can customize this to align more strictly with the CIS Microsoft Azure Compute Services Benchmark (the PDF included in this repo).
az) for local authenticationhttps://console.groq.com)Windows (PowerShell):
cd C:\Users\MSI\mcp_project
python -m venv venv
.\venv\Scripts\Activate.ps1
pip install -r requirements.txt
Linux / macOS:
cd /path/to/mcp_project
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
Re-activate the venv in each new terminal before running the project.
az login
# (optional) select a specific subscription
az account set --subscription "YOUR-SUBSCRIPTION-ID"
# show your current subscription id
az account show --query id -o tsv
Create a .env file in the project root:
GROQ_API_KEY=gsk_xxxxxxxxxxxxxxxxxxxxx
AZURE_SUBSCRIPTION_ID=your-subscription-id
These are read by both main.py and agent.py.
This path is closest to the yt-mcp-agent example and is the recommended way to use the project.
cd C:\Users\MSI\mcp_project
.\venv\Scripts\Activate.ps1
python main.py
You’ll see a prompt like:
=== Azure Security Agent (MCP tools + Groq) ===
Type your security query, or 'exit' to quit.
You:
Example questions you can ask:
rg-security-demo.”Behind the scenes the agent will:
azure_list_resource_groups, azure_list_nsgs, azure_check_nsg_rules)agent.py)If you want to see how the same MCP tools plug into LangChain/LangGraph, run:
cd C:\Users\MSI\mcp_project
.\venv\Scripts\Activate.ps1
python agent.py
This script:
Use this when you want to experiment with chain/graph-based orchestration rather than the OpenAI Agents SDK.
demo.py)If you don’t have Azure access or just want to see the security reasoning piece:
cd C:\Users\MSI\mcp_project
.\venv\Scripts\Activate.ps1
python demo.py
demo.py feeds mock NSG, storage, public IP, and VM findings into Groq and asks the model to:
No Azure calls or MCP server are needed for this demo, just your GROQ_API_KEY.
The MCP server (server.py) exposes the following tools to whichever agent you use.
Discovery tools (use these when you don’t know exact resource names):
azure_list_resource_groups(subscription_id) – List all resource groups in the subscription.azure_list_nsgs(subscription_id, resource_group=None) – List NSGs across the subscription or within a specific resource group.azure_list_storage_accounts(subscription_id, resource_group=None) – List storage accounts.azure_list_resources(subscription_id, resource_group=None) – Generic resource inventory (name, type, location, resource group).Analysis tools:
azure_check_nsg_rules(subscription_id, resource_group, nsg_name)
*, Internet)destination_port_range="*")azure_check_storage_security(subscription_id, resource_group, storage_account_name)
azure_list_public_ips(subscription_id, resource_group=None)
azure_check_vm_security(subscription_id, resource_group, vm_name)
The agent doesn’t hard-code Azure logic; it just calls these tools and reasons over their JSON outputs.
Network Security
*, Internet, 0.0.0.0/0)Storage Security
VM Security
Exposure & Posture
You can refine or formalize these checks against the provided CIS Azure PDF.
.env – it contains secrets.Ideas for next steps:
server.py tools.main.py flows.MIT – feel free to use and adapt this project for your own experiments and learning.
An AI-powered agent for analyzing Azure infrastructure security using Model Context Protocol (MCP) and Groq's free LLM API.
This project demonstrates a simple but powerful AI agent that can:
┌─────────────────┐
│ Groq LLM │ (AI Brain - Free API)
│ (llama-3.3) │
└────────┬────────┘
│
↓
┌─────────────────┐
│ Agent Client │ (Orchestrates analysis)
│ (agent.py) │
└────────┬────────┘
│
↓ (MCP Protocol)
┌─────────────────┐
│ MCP Server │ (Tools for Azure)
│ (server.py) │
└────────┬────────┘
│
↓
┌─────────────────┐
│ Azure SDK │ (Azure API calls)
│ │
└─────────────────┘
Oui, utilisez un virtual env pour éviter les conflits de paquets.
Windows (PowerShell ou CMD) :
# Aller dans le dossier du projet
cd c:\Users\MSI\mcp_project
# Créer l'environnement virtuel
python -m venv venv
# Activer le venv (PowerShell)
.\venv\Scripts\Activate.ps1
# Ou en CMD
.\venv\Scripts\activate.bat
# Installer les dépendances
pip install -r requirements.txt
Linux / macOS :
cd /chemin/vers/mcp_project
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt
Ensuite, à chaque nouvelle session, réactivez le venv avant de lancer le projet :
.\venv\Scripts\Activate.ps1source venv/bin/activateSimplest way to prove the agent works: Create one resource group, one NSG with one insecure rule, and one storage account with one bad setting. Then run the agent and choose option 6 (Full discovery and security scan) — the agent will discover everything and report the issues.
Create a Resource Group:
rg-security-demoEast USCreate a Storage Account:
rg-security-demosecdemostorage<random> (must be globally unique)East USStandardLRSCreate a Network Security Group:
rg-security-demonsg-demoEast USAny (*)22 (SSH)Allowallow-ssh-anyCreate a Virtual Machine (Optional):
rg-security-demovm-demoEast USUbuntu Server 20.04 LTSB1s (cheapest)# Login to Azure
az login
# Create resource group
az group create --name rg-security-demo --location eastus
# Create storage account (intentionally insecure for demo)
az storage account create \
--name secdemostorage$RANDOM \
--resource-group rg-security-demo \
--location eastus \
--sku Standard_LRS \
--allow-blob-public-access true \
--https-only false
# Create NSG with insecure rule
az network nsg create \
--resource-group rg-security-demo \
--name nsg-demo
az network nsg rule create \
--resource-group rg-security-demo \
--nsg-name nsg-demo \
--name allow-ssh-any \
--priority 100 \
--source-address-prefixes '*' \
--destination-port-ranges 22 \
--access Allow \
--protocol Tcp
# Create public IP
az network public-ip create \
--resource-group rg-security-demo \
--name pip-demo
# Login to Azure
az login
# Set your subscription
az account set --subscription "your-subscription-id"
# Verify
az account show
# Copy example env file
cp .env.example .env
# Edit .env and add your keys
nano .env
Add:
GROQ_API_KEY=gsk_xxxxxxxxxxxxxxxxxxxxx
AZURE_SUBSCRIPTION_ID=your-subscription-id
Get your subscription ID:
az account show --query id -o tsv
Résumé des étapes :
Créer et activer le virtual env (une seule fois) :
cd c:\Users\MSI\mcp_project
python -m venv venv
.\venv\Scripts\Activate.ps1
pip install -r requirements.txt
Fichier .env à la racine du projet avec :
GROQ_API_KEY=gsk_xxxx
AZURE_SUBSCRIPTION_ID=votre-subscription-id
(Clé Groq : https://console.groq.com — Subscription ID : az account show --query id -o tsv)
Se connecter à Azure (dans le même terminal où vous lancez l’agent) :
az login
Lancer l’agent (avec le venv activé) :
python agent.py
Dans le menu, taper 6 pour un scan complet (découverte + analyse) sans saisir de noms de ressources.
To show the agent working end-to-end: Choose 6 (Full discovery and security scan). The agent will list resource groups, discover NSGs and storage accounts, run security checks, and return a report — no need to type resource names.
rg-security-demo), one NSG with an “allow SSH from Any” rule, and one storage account with “Allow public blob access” enabled.python agent.py, then choose 6 (Full discovery and security scan).Enter command (1-5 or 'exit'): 2
Enter resource group name: rg-security-demo
Enter NSG name: nsg-demo
The agent will:
azure_check_nsg_rules toolEnter command (1-5 or 'exit'): 3
Enter resource group name: rg-security-demo
Enter storage account name: secdemostorage12345
The agent will check:
Enter command (1-5 or 'exit'): 5
Enter your security query: Find all resources with public access and tell me the risks
The MCP server provides these tools:
Discovery (use these first when you don’t know resource names):
Analysis: 5. azure_check_nsg_rules - Analyze NSG for security issues (open ports, wildcard rules) 6. azure_check_storage_security - Audit storage account configuration 7. azure_list_public_ips - Find all public IP addresses 8. azure_check_vm_security - Check VM security settings
🤖 Agent analyzing: Analyze the NSG 'nsg-demo' in resource group 'rg-security-demo'
🔧 Executing: azure_check_nsg_rules
Arguments: {
"subscription_id": "xxxx",
"resource_group": "rg-security-demo",
"nsg_name": "nsg-demo"
}
✓ Result: {
"nsg_name": "nsg-demo",
"issues_found": 2,
"security_issues": [
{
"severity": "HIGH",
"rule_name": "allow-ssh-any",
"issue": "Inbound rule allows traffic from any source (*)",
"destination_port": "22",
"recommendation": "Restrict source IP addresses to specific ranges"
},
{
"severity": "HIGH",
"rule_name": "allow-ssh-any",
"issue": "Potentially dangerous port 22 is exposed",
"recommendation": "Consider restricting access to port 22 or using VPN/bastion"
}
]
}
============================================================
FINAL ANALYSIS
============================================================
⚠️ SECURITY ANALYSIS: NSG 'nsg-demo'
I found 2 HIGH severity security issues:
1. **Wildcard Source Address** (HIGH)
- Rule: allow-ssh-any
- Problem: Allows inbound traffic from ANY source (*)
- Risk: Exposes SSH to the entire internet
- Recommendation: Restrict to your office/home IP or use Azure Bastion
2. **Exposed SSH Port** (HIGH)
- Port 22 is publicly accessible
- Risk: Brute force attacks, unauthorized access attempts
- Recommendation: Use Azure Bastion, VPN, or at minimum restrict source IPs
📋 Action Items:
- Immediately restrict the source IP range for SSH access
- Consider implementing Azure Bastion for secure VM access
- Review all NSG rules for least privilege principle
.env file - It contains secretsEdit server.py and add new tool functions:
@app.list_tools()
async def list_tools() -> list[Tool]:
return [
# ... existing tools ...
Tool(
name="azure_check_sql_security",
description="Check Azure SQL database security",
inputSchema={...}
)
]
async def check_sql_security(args: dict) -> list[TextContent]:
# Implement SQL security checks
pass
Install additional Azure SDK packages:
pip install azure-mgmt-sql azure-mgmt-keyvault azure-mgmt-web
Then add clients in server.py:
from azure.mgmt.sql import SqlManagementClient
python agent.pyAzure Security Agent — starting... then Starting MCP server... then Connecting to MCP server.... If you see nothing at all, run from the project folder: cd c:\Users\MSI\mcp_project and ensure your venv is activated.server.py runs alone: python server.py (it will wait for stdin — that’s normal; press Ctrl+C to exit).AZURE_SUBSCRIPTION_ID to .env).az login to authenticate.env file from .env.exampleAdd more security checks:
Implement CIS benchmarks:
Add visualization:
Multi-cloud support:
MIT License - Feel free to use and modify for your project!
This is a demo project for learning. Feel free to extend it for your needs!
Note: This is a simple demonstration. For production use, add:
Добавь это в claude_desktop_config.json и перезапусти Claude Desktop.
{
"mcpServers": {
"azure-security-mcp-agent": {
"command": "npx",
"args": []
}
}
}