Resource Graph is how you ask "what do we actually have running" across subscriptions, and this exposes it directly rather than wrapping a dozen narrow resource APIs. Because it leans on DefaultAzureCredential, the agent inherits your permissions exactly — no separate service principal to create unless you want one.
An MCP server that runs Azure Resource Graph queries against your subscriptions and returns the results to the model. It authenticates through DefaultAzureCredential, so it reuses whatever Azure identity your machine already has.
- `query-resources` — run a Resource Graph query and get resources back; the default query returns resource ID, name, type and location
- Custom queries are passed through, so anything Resource Graph accepts works
- A subscription can be pinned in configuration or overridden per call
Node.js and an Azure subscription. Clone the repo, `npm install`, `npm run build`, then point Cursor or VS Code at the built `build/index.js` with `SUBSCRIPTION_ID` in the env block. Sign in with `az login` for local use; DefaultAzureCredential also accepts managed identity, VS Code credentials, or `AZURE_SUBSCRIPTION_ID`, `AZURE_TENANT_ID`, `AZURE_CLIENT_ID` and `AZURE_CLIENT_SECRET` as environment variables. Package version 1.0.0.
