mcp-azure: Skill for Claude Code

Maintaining the MCP server suite

These six TypeScript MCP servers share one architecture and one security philosophy: safe by default, least privilege, never leak secrets. This skill captures the invariants and the routine tasks so changes stay consistent and safe.

Shared architecture (every repo)

src/
  index.ts        # stdio entrypoint: load config → build server → connect
  server.ts       # registers ONLY tools whose capability ≤ access mode
  config.ts       # env → typed config (connection + security)
  security.ts     # PURE policy engine (SecurityPolicy). No I/O. Unit-tested.
  <domain>/client.ts  # thin wrapper over the real SDK/REST API
  tools/{read,write,admin}.ts  # tool defs tagged with a capability
test/             # vitest — always includes security.test.ts

• Capabilities: every tool declares capability: "read" | "write" | "admin".
• Access modes: read-only (0) → read-write (1) → admin (2). A tool is only registered when CAPABILITY_RANK[tool] <= MODE_RANK[mode]. Over-privileged tools are never advertised — this is the primary guarantee.
• Guard at call time too: every handler calls policy.guard({ tool, capability, <resource>, destructive? }) before doing work. Defence in depth on top of registration.

Non-negotiable invariants (do NOT regress these)

1. Read-only means read-only. A tool tagged read must never mutate. If it can mutate, it is write or admin.
2. Destructive ops need a second opt-in. Deletes/drops require the mode and an explicit flag (*_ALLOW_DELETE, OCI_ALLOW_APPLY, K8S_ALLOW_EXEC, etc.). The most dangerous (k8s exec_in_pod) is not even registered without its flag.
3. Protected resources are read-only forever. System realms/namespaces/databases/internal topics can be read but never mutated, regardless of mode.
4. Secrets never reach the model. Redact before returning (see redact.ts in mcp-oci / mcp-debezium; reset_password never echoes; list_clients strips secrets; ClickHouse caps rows). Any new field that could carry a credential must be redacted.
5. Audit + dry-run apply to every write. guard() emits the audit line and returns { dryRun }; write handlers must honor dryRun by returning intent without calling the backend.
6. stdout belongs to MCP. All logs/audit/warnings go to stderr only. Never console.log to stdout.