You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/api-management/mcp-server-overview.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -68,7 +68,7 @@ API Management supports two ways to expose MCP servers:
68
68
69
69
## Govern MCP servers
70
70
71
-
Configure one or more API Management [policies](../articles/api-management/api-management-howto-policies.md) to help manage the MCP server. The policies are applied to all API operations exposed as tools in the MCP server and can be used to control access, authentication, and other aspects of the tools.
71
+
Configure one or more API Management [policies](api-management-howto-policies.md) to help manage the MCP server. The policies are applied to all API operations exposed as tools in the MCP server and can be used to control access, authentication, and other aspects of the tools.
72
72
73
73
Configure policies such as the following::
74
74
@@ -84,7 +84,7 @@ You can secure both inbound access to the MCP server (from an MCP client to API
84
84
85
85
### Secure inbound access
86
86
87
-
One option to secure inbound access is to configure a policy to validate a JSON web token (JWT) in the incoming requests. This ensures that only authorized clients can access the MCP server. Use the [validate-jwt](../articles/api-management/validate-jwt-policy.md) or [validate-azure-ad-token](../articles/api-management/validate-azure-ad-token-policy.md) policy to validate the JWT token in the incoming requests. For example:
87
+
One option to secure inbound access is to configure a policy to validate a JSON web token (JWT) in the incoming requests. This ensures that only authorized clients can access the MCP server. Use the [validate-jwt](validate-jwt-policy.md) or [validate-azure-ad-token](validate-azure-ad-token-policy.md) policy to validate the JWT token in the incoming requests. For example:
88
88
89
89
<!-- update to validate-azure-ad-token-policy.md if preferred -->
90
90
```xml
@@ -106,14 +106,14 @@ One option to secure inbound access is to configure a policy to validate a JSON
106
106
107
107
### Secure outbound access
108
108
109
-
You can use API Management's [credential manager](../articles/api-management/credentials-overview.md) to securely inject secrets or tokens for calls to a backend API. At a high level, the process is as follows:
109
+
You can use API Management's [credential manager](credentials-overview.md) to securely inject secrets or tokens for calls to a backend API. At a high level, the process is as follows:
110
110
111
111
1. Register an application in a supported identity provider.
112
112
1. Create a credential provider resource in API Management to manage the credentials from the identity provider.
113
113
1. Configure a connection to the provider in API Management.
114
114
1. Configure `get-authorization-context` and `set-header` policies to fetch the token credentials and present them in an **Authorization** header of the API requests.
115
115
116
-
For a step-by-step guide to call an example backend API using credentials generated in credential manager, see [Configure credential manager - GitHub](../articles/api-management/credentials-how-to-github.md).
116
+
For a step-by-step guide to call an example backend API using credentials generated in credential manager, see [Configure credential manager - GitHub](credentials-how-to-github.md).
117
117
118
118
119
119
## Monitoring
@@ -155,10 +155,10 @@ MCP servers in API Management are available in the following service tiers:
0 commit comments