# Blue Bridge

> Sample prompts and recipes for using Model Context Protocol (MCP) server to query and manage Azure resources — scenarios include Azure Managed Grafana, Azure Data Explorer (Kusto), Azure Resource Graph, Azure Resource Manager and more.

- **Type:** MCP server
- **Install:** `agentstack add mcp-azure-blue-bridge`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Azure](https://agentstack.voostack.com/s/azure)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Azure](https://github.com/Azure)
- **Source:** https://github.com/Azure/blue-bridge

## Install

```sh
agentstack add mcp-azure-blue-bridge
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Blue Bridge

Sample prompts and recipes for using Model Context Protocol (MCP) server to query and manage Azure resources with zero‑secret authentication.  
Scenarios include:

- **Azure Managed Grafana**
- **Azure Data Explorer (Kusto)**
- **Azure Resource Graph**
- **Azure Resource Manager**

Authentication is handled by the signed‑in Azure CLI account or a Managed Identity—no passwords or keys are stored.

---

# ✨ Demo

1. Given 'manual-for-ai.md', show me 5 VMs that I can turn off machines to save money.

   

2. Given 'manual-for-ai.md', help me find 2 VMs that I can turned off to save money. Please also turn them off. Please ask for permission for each VM before you do this.

   

3. Given 'manual-for-ai.md', get me the CPU quota for subscription '3a7edf7d-1488-4017-a908-e50d0a1642a6'

   

---

# 🚀 Quick start

## 0 · Clone the repository

Clone the repository to get the necessary files, including recipes and usage examples found in `manual-for-ai.md`.

```bash
git clone https://github.com/Azure/blue-bridge.git
cd blue-bridge
```

## 1 · Run the container

Blue Bridge supports **Azure Resource Graph** and **Azure Resource Manager** out-of-the-box without any additional configuration.

To connect to **Azure Managed Grafana** or **Azure Data Explorer (Kusto)**, set the corresponding environment variables when running the container.

Set the optional environment variables you need and start the image:

```bash
docker run --name bluebridge -p 6688:6688 \
  -e AzureManagedGrafanaEndpoint=https://.wcus.grafana.azure.com \
  -e KustoUri=https://.westus2.kusto.windows.net \
  bluebridge.azurecr.io/bluebridge:latest
```

If you only need Kusto:

```bash
docker run --name bluebridge -p 6688:6688 \
  -e KustoUri=https://.westus2.kusto.windows.net \
  bluebridge.azurecr.io/bluebridge:latest
```

Or with no external services:

```bash
docker run --name bluebridge -p 6688:6688 \
  bluebridge.azurecr.io/bluebridge:latest
```

## 2 · Authenticate once

On first start the container prints a device‑code prompt such as:

```
To sign in, use a web browser to open the page https://microsoft.com/devicelogin
and enter the code ABCD‑EFGH to authenticate.
```

Open the link, enter the code, and grant consent.  
After that the server is ready at **http://localhost:6688**.

## 3 · Add to your MCP host

```jsonc
{
  "mcpServers": {
    "blue-bridge": {
      "url": "http://localhost:6688/sse",
      "transportType": "sse",
      "timeout": 60,
      "disabled": false,
      "autoApprove": []
    }
  }
}
```

## 4 · Run a quick test

Ask your MCP host:

```
Given 'manual-for-ai.md', show me 5 VMs that I can turn off machines to save money.
```

---

## 🔧 Environment variables

| Variable                                           | Purpose                                         | Required |
| -------------------------------------------------- | ----------------------------------------------- | -------- |
| `AzureManagedGrafanaEndpoint`   | Azure Managed Grafana endpoint URL              | No       |
| `KustoUri`                      | Azure Data Explorer (Kusto) cluster URI         | No       |
| `UseManagedIdentity`            | Set to `true` to use managed identity.          | No       |
| `ManagedIdentityClientId`       | Client ID of the managed identity to use.       | No       |

When `UseManagedIdentity` is set to `true`, Blue Bridge will attempt to authenticate using the managed identity available on the compute resource. This works automatically if there is only one managed identity (either system-assigned or user-assigned).

If the compute resource has multiple managed identities, you must specify which one to use by setting the `ManagedIdentityClientId` environment variable to the client ID of the desired managed identity. Note that setting `ManagedIdentityClientId` implies the use of managed identity, so setting `UseManagedIdentity` to `true` is not necessary in this case.

---

## 📚 Links

- Docs & samples: https://aka.ms/blue-bridge

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Azure](https://github.com/Azure)
- **Source:** [Azure/blue-bridge](https://github.com/Azure/blue-bridge)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/mcp-azure-blue-bridge
- Seller: https://agentstack.voostack.com/s/azure
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.