You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/api-management/export-rest-mcp-server.md
+8-7Lines changed: 8 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Learn how to expose a REST API in Azure API Management as an MCP se
4
4
author: dlepow
5
5
ms.service: azure-api-management
6
6
ms.topic: how-to
7
-
ms.date: 07/22/2025
7
+
ms.date: 07/23/2025
8
8
ms.author: danlep
9
9
ms.collection: ce-skilling-ai-copilot
10
10
ms.custom:
@@ -35,7 +35,7 @@ Learn more about:
35
35
36
36
+ Make sure that your instance manages an HTTP-compatible API (any API imported as a REST API, including APIs imported from Azure resources) that you'd like to expose as an MCP server. To import a sample API, see [Import and publish your first API](import-and-publish.md).
37
37
> [!NOTE]
38
-
> Only HTTP APIs managed in API Management can be exposed as MCP servers.
38
+
> Other API types in API Management that aren't HTTP-compatible can't be exposed as MCP servers.
39
39
40
40
+ To test the MCP server, you can use Visual Studio Code with access to [GitHub Copilot](https://code.visualstudio.com/docs/copilot/setup).
41
41
@@ -47,21 +47,22 @@ Follow these steps to expose a managed REST API in API Management as an MCP serv
47
47
1. In the [Azure portal](https://portal.azure.com), navigate to your API Management instance.
1. In the left menu, under **APIs**, select **MCP servers** > **+ Create new MCP server**.
50
+
1. In the left menu, under **APIs**, select **MCP Servers** > **+ Create MCP server**.
51
51
1. Select **Expose an API as an MCP server**.
52
-
1. In **Backend API**:
52
+
1. In **Backend MCP server**:
53
53
1. Select a managed **API** to expose as an MCP server.
54
54
1. Select one or more **API operations** to expose as tools. You can select all operations or only specific operations.
55
55
> [!NOTE]
56
56
> You can update the operations exposed as tools later in the **Tools** blade of your MCP server.
57
57
1. In **New MCP server**:
58
-
1. Enter a **Name**and optional **Description**for the MCP server in API Management.
59
-
1.In **Base URL**, configure the final URL where the MCP server will be accessible in API Management.
58
+
1. Enter a **Name** for the MCP server in API Management.
59
+
1.Optionally, enter a **Description** for the MCP server.
60
60
1. Select **Create**.
61
61
62
62
:::image type="content" source="media/export-rest-mcp-server/create-mcp-server.png" alt-text="Screenshot of creating an MCP server in the portal." :::
63
63
64
-
The MCP server is created and the API operations are exposed as tools. The MCP server is listed in the **MCP servers** pane. The **URL** column shows the endpoint of the MCP server that you can call for testing or within a client application.
64
+
* The MCP server is created and the API operations are exposed as tools.
65
+
* The MCP server is listed in the **MCP Servers** blade. The **Server URL** column shows the endpoint of the MCP server that you can call for testing or within a client application.
65
66
66
67
67
68
:::image type="content" source="media/export-rest-mcp-server/mcp-server-list.png" alt-text="Screenshot of the MCP server list in the portal.":::
This article shows how to use API Management to expose and govern an existing MCP-compatible server - a tool server hosted outside of API Management. Expose the server's tools through API Management using its built-in [AI gateway](genai-gateway-capabilities.md) capabilities so that MCP clients can call them using the MCP protocol.
17
+
This article shows how to use API Management to expose and govern an existing MCP-compatible server - a tool server hosted outside of API Management. Expose and govern the server's tools through API Management so that MCP clients can call them using the MCP protocol.
1. In the left-hand menu, under **APIs**, select **MCP servers** > **+ Create MCP server**.
56
-
1. Select **Connect existing MCP server**.
57
-
1. In **Backend API**:
56
+
1. Select **Expose an existing MCP server**.
57
+
1. In **Backend MCP server**:
58
58
1. Enter the existing **MCP server base URL**.
59
-
1. Select a **Transport type**:
60
-
-**Streamable HTTP** (default) - Server delivers data continuously over HTTP as it becomes available
61
-
-**Server-sent events (SSE)** - Server pushes real-time updates to clients. When selected, optionally enter the following paths:
62
-
-`/sse` - path for streaming responses
63
-
-`/messages` - path for receiving tool requests from agents
59
+
1. In**Transport type**, **Streamable HTTP** is selected by default.
64
60
1. In **New MCP server**:
65
-
1. Enter a **Name**and optional **Description** for the MCP server in API Management.
66
-
1. In **Base path**, enter a route prefix for tools.
67
-
1.In **Base URL**, configure the final URL where the MCP server will be accessible in API Management.
61
+
1. Enter a **Name** the MCP server in API Management.
62
+
1. In **Base path**, enter a route prefix for tools. Example: `mytools`
63
+
1.Optionally, enter a **Description** for the MCP server.
68
64
1. Select **Create**.
69
65
70
66
:::image type="content" source="media/expose-existing-mcp-server/create-mcp-server.png" alt-text="Screenshot of creating an MCP server in the portal." :::
71
67
72
-
The MCP server is connected and is listed in the **MCP servers** pane. The **URL** column shows the MCP server URL that you can call for testing or within a client application.
68
+
* The MCP server is created and the remote server's operations are exposed as tools.
69
+
* The MCP server is listed in the **MCP Servers** pane. The **Server URL** column shows the MCP server URL that you can call for testing or within a client application.
73
70
74
-
> [!NOTE]
71
+
:::image type="content" source="media/expose-existing-mcp-server/mcp-server-list.png" alt-text="Screenshot of the MCP server list in the portal.":::
72
+
73
+
> [!IMPORTANT]
75
74
> API Management doesn't display tools from the existing MCP server. All tool registration and configuration must be done on the existing remote MCP server.
This article introduces features in Azure API Management that you can use to manage Model Context Protocol (MCP) servers. MCP servers allow AI agents to access external data sources, such as databases or APIs, through a standardized protocol.
15
18
16
19
Use API Management to securely expose and govern API operations as tools for large language models (LLMs) and AI agents like GitHub Copilot, ChatGPT, Claude, and more. API Management provides centralized control over MCP server authentication, authorization, and monitoring. It simplifies the management of MCP servers while helping to mitigate common security risks and ensuring scalability.
@@ -43,11 +46,6 @@ The MCP architecture is built on [JSON-RPC 2.0 for messaging](https://modelconte
43
46
44
47
***Local MCP servers** MCP clients use standard input/output as a local transport method to connect to MCP servers on the same machine,.
45
48
46
-
Azure API Management supports the remote MCP server mode, using native features of API Management and [capabilities of the AI gateway](./genai-gateway-capabilities.md) to manage MCP server endpoints.
47
-
48
-
> [!NOTE]
49
-
> MCP server support in API Management is in preview. In preview, API Management supports MCP server tools, but doesn't currently support MCP resources or prompts.
50
-
51
49
## MCP server endpoints
52
50
53
51
@@ -60,13 +58,17 @@ MCP provides the following transport types and typical endpoints for remote serv
60
58
61
59
## Expose MCP servers in API Management
62
60
63
-
API Management supports > [!NOTE]
64
-
> Information the user should notice even if skimmingtwo built-in ways to expose MCP servers:
61
+
Azure API Management supports the remote MCP server mode, using native features of API Management and [capabilities of the AI gateway](./genai-gateway-capabilities.md) to manage MCP server endpoints.
62
+
63
+
> [!NOTE]
64
+
> MCP server support in API Management is in preview. In preview, API Management supports MCP server tools, but doesn't currently support MCP resources or prompts.
65
+
66
+
API Management provides two built-in ways to expose MCP servers:
| REST API as MCP server | Expose any REST API managed in API Management as an MCP server, including REST APIs imported from Azure resources. API operations become MCP tools. [Learn more](export-rest-mcp-server.md).|
69
-
| Existing MCP server | Expose an MCP-compatible server (for example, LangChain, LangServe, Logic Apps, Azure Functions) via API Management. [Learn more](expose-existing-mcp-server.md).|
70
+
| REST API as MCP server | Expose any REST API managed in API Management as an MCP server, including REST APIs imported from Azure resources. API operations become MCP tools. [Learn more](export-rest-mcp-server.md)|
71
+
| Existing MCP server | Expose an MCP-compatible server (for example, LangChain, LangServe, Azure logic app, Azure function app) via API Management. [Learn more](expose-existing-mcp-server.md)|
70
72
71
73
72
74
## Govern MCP servers
@@ -83,21 +85,23 @@ Configure policies such as the following::
83
85
84
86
## Secure access to the MCP server
85
87
86
-
You can secure both inbound access to the MCP server (from an MCP client to API Management) and outbound access (from API Management to the MCP server backend).
88
+
You can secure either or both inbound access to the MCP server (from an MCP client to API Management) and outbound access (from API Management to the MCP server backend).
87
89
88
90
### Secure inbound access
89
91
90
-
One option to secure inbound access is to configure a policy to validate a JSON web token (JWT) generated using an identity provider in the incoming requests. This ensures that only authorized clients can access the MCP server. Use the generic [validate-jwt](validate-jwt-policy.md) policy, or the [validate-azure-ad-token](validate-azure-ad-token-policy.md) policy when using Microsoft Entra ID, to validate the JWT token in the incoming requests. The following is a basic example of validating a Microsoft Entra ID token:
92
+
One option to secure inbound access is to configure a policy to validate a JSON web token (JWT) generated using an identity provider in the incoming requests. This ensures that only authorized clients can access the MCP server. Use the generic [validate-jwt](validate-jwt-policy.md) policy, or the [validate-azure-ad-token](validate-azure-ad-token-policy.md) policy when using Microsoft Entra ID, to validate the JWT token in the incoming requests.
93
+
94
+
The following is a basic example of validating a Microsoft Entra ID token presented in an `Authorization` header in the incoming request:
91
95
92
96
```xml
93
-
<validate-azure-ad-tokenheader-name="Authorization"failed-validation-httpcode="401"failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
97
+
<validate-azure-ad-tokenheader-name="Authorization"failed-validation-httpcode="401"failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
94
98
<client-application-ids>
95
99
<application-id>your-client-id</application-id>
96
100
</client-application-ids>
97
101
</validate-azure-ad-token>
98
102
```
99
103
100
-
For more inbound authorization options and samples, see:
104
+
For more inbound authorization options and samples, including using OAuth authorization, see:
101
105
102
106
*[MCP server authorization with Protected Resource Metadata (PRM) sample](https://github.com/blackchoey/remote-mcp-apim-oauth-prm)
Copy file name to clipboardExpand all lines: includes/api-management-configure-test-mcp-server.md
+15-8Lines changed: 15 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,15 +9,20 @@ ms.author: danlep
9
9
10
10
Configure one or more API Management [policies](../articles/api-management/api-management-howto-policies.md) to help manage the MCP server. The policies are applied to all API operations exposed as tools in the MCP server and can be used to control access, authentication, and other aspects of the tools.
11
11
12
-
For a tutorial on how to configure policies, see [Transform and protect your API](../articles/api-management/transform-api.md).
12
+
Learn more about configuring policies:
13
+
14
+
*[Policies in API Management](../articles/api-management/api-management-howto-policies.md)
15
+
*[Transform and protect your API](../articles/api-management/transform-api.md)
16
+
*[Set and edit policies](../articles/api-management/set-edit-policies.md)
13
17
14
18
To configure policies for the MCP server:
19
+
15
20
1. In the [Azure portal](https://portal.azure.com), navigate to your API Management instance.
1. In the left-hand menu, under **APIs**, select **MCP servers**.
19
-
1. Select the MCP server that you created.
20
-
1. In the left menu, under **Details**, select **Policies**.
23
+
1. In the left-hand menu, under **APIs**, select **MCP Servers**.
24
+
1. Select an MCP server from the list.
25
+
1. In the left menu, under **MCP**, select **Policies**.
21
26
1. In the policy editor, add or edit the policies you want to apply to the MCP server's tools. The policies are defined in XML format. For example, you can add a policy to limit calls to the MCP server's tools (in this example, 5 calls per 30 seconds per client IP address).
22
27
23
28
```xml
@@ -41,8 +46,8 @@ To add the MCP server in Visual Studio Code:
41
46
42
47
1. Use the **MCP: Add Server** command from the Command Palette.
43
48
1. When prompted, select the server type: **HTTP (HTTP or Server Sent Events)**.
44
-
1. Enter the **URL of the MCP server** in API Management. Example: `https://<apim-service-name>.azure-api.net/<api-name>-mcp/sse` (for SSE endpoint) or `https://<apim-service-name>.azure-api.net/<api-name>-mcp/mcp` (for MCP endpoint)
45
-
1. Enter a **server ID** of your choice.
49
+
1. Enter the **Server URL** of the MCP server in API Management. Example: `https://<apim-service-name>.azure-api.net/<api-name>-mcp/mcp` (for MCP endpoint)
50
+
1. Enter a **Server ID** of your choice.
46
51
1. Select whether to save the configuration to your **workspace settings** or **user settings**.
47
52
* **Workspace settings** - The server configuration is saved to a `.vscode/mcp.json` file only available in the current workspace.
48
53
@@ -56,7 +61,7 @@ Add fields to the JSON configuration for settings such as authentication header.
56
61
57
62
### Use tools in agent mode
58
63
59
-
After adding an MCP server, you can use tools in agent mode.
64
+
After adding an MCP server in Visual Studio Code, you can use tools in agent mode.
60
65
61
66
1. In GitHub Copilot chat, select **Agent** mode and select the **Tools** button to see available tools.
62
67
@@ -89,7 +94,9 @@ After adding an MCP server, you can use tools in agent mode.
89
94
90
95
## Related content
91
96
92
-
* [Python sample: Secure remote MCP servers using Azure API Management (experimental)](https://github.com/Azure-Samples/remote-mcp-apim-functions-python)
97
+
* [Sample: MCP Servers authorization with Protected Resource Metadata (PRM)](https://github.com/blackchoey/remote-mcp-apim-oauth-prm/)
98
+
99
+
* [Sample: Secure remote MCP servers using Azure API Management (experimental)](https://github.com/Azure-Samples/remote-mcp-apim-functions-python)
0 commit comments