Labsco
MCP SERVER

FreshMCP

by eosho ↗

Cosmos DB containers and items, and AI Search indexes, over SSE — with an APIM gateway in front for auth, rate limiting and routing.

Relational SQL Databases
Summary
The gateway is the design, not an afterthought.

Most database MCP servers hand the client a connection string and hope. Here the agents sit behind API Management, so a shared deployment gets per-subscription keys, per-subscription rate limits and central monitoring without either agent implementing any of it — which is what makes this a team deployment rather than a laptop one. The cost is the same shape as the benefit: an Azure subscription, azd, Docker and RBAC assignments before the first call.

What it is

A Python service exposing two Azure surfaces as MCP agents: one for Cosmos DB and one for AI Search. They run as separate servers over SSE, and the deployment shape puts Azure API Management in front of both — so authentication, rate limiting and routing are the gateway's job rather than each agent's.

What you get
  • Cosmos DB container management — create, list and delete — and item operations covering create, read, update, delete and query
  • AI Search index management: create an index, list indexes, delete an index
  • Two independent servers so you can wire up one without the other: Cosmos on `http://localhost:8001/cosmos/sse` and Search on `http://localhost:8002/search/sse`
  • Subscription-key authentication, configurable per-subscription rate limits, request routing and response caching handled at the APIM layer
  • A one-command Azure deployment through `azd up`, which packages the services, provisions the resources, builds and pushes images to the container registry and deploys them to Container Apps
Requirements

An Azure subscription with permissions to create the resources, plus the Azure CLI, the Azure Developer CLI and Docker. Python 3.11 or higher; install with `uv sync` in a `uv venv`. Authentication in production runs on system-assigned managed identities, which are attached to the Container Apps by default — you grant the Cosmos DB SQL role and the Search Service Contributor role to them. Service principal credentials (`AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_SECRET`) are the alternative path; `APPLICATIONINSIGHTS_CONNECTION_STRING` is optional. Both agents speak SSE, so your client needs that transport.