fabric-rti-mcp: Skill for Claude Code

.github/skills/kql/SKILL.md

kql is a skill for Claude Code, Codex from microsoft/fabric-rti-mcp. It costs 159 tokens per session (6,444 once invoked), scanned A, original, MIT.

A guide to Kusto Query Language (KQL), a language for querying and managing data in Microsoft's Kusto and Fabric systems. It covers query syntax, joins, dates, regular expressions, data types, graphs, and the available database tools.

In plain words
What is it for?
Use it to write and run KQL queries, inspect databases and tables, sample or import data, run management commands, and query graph data.
Why use it?
It helps avoid query errors and inefficient requests when exploring tables, checking schemas, transforming data, or working with large results.

Skill for Claude CodeCodex ✓ vendor

Written for no agent in particular: nothing here depends on one.

This is microsoft/fabric-rti-mcp's own configuration. It tells Claude Code and Codex how to work on fabric-rti-mcp itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything fabric-rti-mcp configures →

About the project

Fabric RTI MCP Server is a Model Context Protocol server that gives AI agents tools for querying and managing Microsoft Fabric Real-Time Intelligence services, including Eventhouse, Azure Data Explorer, Eventstreams, and Activator. It is for agents and users who need natural-language access to real-time analytics and streaming workflows through KQL and service-management operations. The catalogue add-ons provide instructions and skills for using the server.

microsoft/fabric-rti-mcp · 130 stars · on GitHub

Reuse

Borrowing it

Nothing to install: this file belongs to microsoft/fabric-rti-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/microsoft/fabric-rti-mcp/main/.github/skills/kql/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/microsoft/fabric-rti-mcp

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for kql

README.md
[![agentmods](https://agentmods.dev/badge/skills/microsoft/fabric-rti-mcp/kql.svg)](https://agentmods.dev/skills/microsoft/fabric-rti-mcp/kql)
Your own site
<a href="https://agentmods.dev/skills/microsoft/fabric-rti-mcp/kql"><img src="https://agentmods.dev/badge/skills/microsoft/fabric-rti-mcp/kql.svg" alt="Measured on agentmods" height="20"></a>
Per session 159 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 6,444 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00159 $0.06444
Opus 5 $0.00079 $0.03222
Sonnet 5 $0.00032 $0.01289
Haiku 4.5 $0.00016 $0.00644

Measured 8d ago against content hash bc34dd6cdf52, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

kql scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.github/skills/kql/SKILL.md · 580 lines

How it starts

The opening of the file, as written. The whole thing — 580 lines — stays where its author put it; the contents beside it link to each section on GitHub.

KQL Mastery

Try it yourself: All examples in this skill can be run against the public help cluster: https://help.kusto.windows.net, database Samples (contains StormEvents, SimpleGraph_Nodes/Edges, nyc_taxi, and more).

1. Running KQL with Fabric RTI MCP

Fabric RTI MCP exposes Kusto functionality as MCP tools. Authentication is handled transparently using Azure Identity.

Available tools

Tool Purpose
kusto_query Execute a KQL query on a database
kusto_command Execute a management command (.show, .create, etc.)
kusto_list_entities List databases, tables, external tables, materialized views, functions, graphs
kusto_describe_database Get schema for all entities in a database
kusto_describe_database_entity Get schema for a specific entity (table, function, etc.)
kusto_sample_entity Get sample data from a table or other entity
kusto_graph_query Execute a graph query using snapshots or transient graphs
kusto_ingest_inline_into_table Ingest inline CSV data into a table
kusto_known_services List configured Kusto services
kusto_get_shots Retrieve semantically similar shots from a shots table
kusto_deeplink_from_query Build a deeplink URL to open a query in the web explorer
kusto_show_queryplan Get the execution plan for a query without running it
kusto_diagnostics Get a best-effort cluster health and capacity summary

Query vs management commands

KQL has two execution planes, each with its own MCP tool:

Plane Tool Starts with Examples
Query kusto_query Table name, let, print, datatable StormEvents | where State == "TEXAS"
Management kusto_command .show, .create, .set, .drop, .alter .show tables, .show table T schema

Basic usage

# Query plane — use kusto_query
kusto_query(
    cluster_uri="https://help.kusto.windows.net",
    database="Samples",
    query="StormEvents | summarize count() by EventType | top 5 by count_ desc"
)

# Management plane — use kusto_command
kusto_command(
    cluster_uri="https://help.kusto.windows.net",
    database="Samples",
    command=".show tables"
)

# Schema exploration — use kusto_describe_database or kusto_describe_database_entity
kusto_describe_database(
    cluster_uri="https://help.kusto.windows.net",
    database="Samples"
)

# Sample data — use kusto_sample_entity
kusto_sample_entity(
    cluster_uri="https://help.kusto.windows.net",
    database="Samples",
    entity_name="StormEvents",
    entity_type="table",
    sample_size=5
)

# Graph queries — use kusto_graph_query
kusto_graph_query(
    cluster_uri="https://mycluster.kusto.windows.net",
    database="MyDB",
    graph_name="MyGraph",
    query="| graph-match (node) project labels=labels(node)"
)

# Deeplinks — use kusto_deeplink_from_query
kusto_deeplink_from_query(
    cluster_uri="https://help.kusto.windows.net",
    database="Samples",
    query="StormEvents | count"
)

Read the full file on GitHub · 580 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 580 lines · 159 tokens per session scan A bc34dd6cdf52

Subscribe to this mod's changes

kql is a skill published in the GitHub repository microsoft/fabric-rti-mcp (130 stars, last pushed 6d ago), licensed MIT. It adds 159 tokens to every session and 6,444 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

next-partial-prefetching-adoption

Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…

vercel/next.js · 103 tokens

chronicle

Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…

microsoft/vscode · 72 tokens

babysit-pr

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…

openai/codex · 114 tokens