The schema memory is what makes the generation worth trusting: tables are discovered once, cached with ranked context, and used to validate the query, so a wrong column is repaired only when an actual table schema proves the replacement instead of being guessed. Authentication rides on the Azure CLI login you already have, which is why there is nothing to set up — and also why every tool call runs with your identity, so a shared HTTP deployment stays on loopback unless you open it deliberately.
Two tools over Azure Data Explorer. One discovers, caches and explores cluster schemas; the other writes KQL from a natural-language question or runs the KQL you already have, validated against that cached schema before it executes.
- KQL generated from a plain-English question, grounded in the discovered schema rather than guessed at
- Raw KQL executed as written when you already know the query you want
- Schema validation before execution, with an invalid column repaired only when a real table schema proves the replacement
- Cluster schemas discovered once and cached, with tables listed and ranked context returned per table
- Results as JSON, CSV or a table, with visualisations generated on request
- Cache management — refresh or clear — and statistics on what has been cached so far
Python 3.10 or higher, the Azure CLI installed, and access to an Azure Data Explorer cluster. Nothing to configure: the server checks your Azure CLI token at startup, runs an interactive az login only if it has to, and creates its own memory directory under %APPDATA%\KQL_MCP or ~/.local/share/KQL_MCP. pip install mcp-kql-server, then launch it as python -m mcp_kql_server over stdio. To share one process across several clients, run it with --transport http --host 127.0.0.1 --port 8000 --http-path /mcp --stateless-http; the bind stays on loopback because every tool call executes as your Azure CLI identity, and a non-loopback bind needs MCP_KQL_ALLOW_UNAUTHENTICATED_REMOTE_HTTP set to true on purpose. MCP_KQL_AUTH_MODE switches to managed-identity where that suits better, and responses are bounded by MCP_KQL_MAX_RESULT_ROWS, which defaults to 10000.
One command — pip install mcp-kql-server