LABSCO SUMMARY

Plain-English questions against ADX, with the answer sized to fit.

The result handling is what you notice: execute-query stops at 20 rows unless told otherwise, and the whole response is then squeezed into a character budget by dropping rows instead of truncating them, so what arrives is still valid, parseable data with a note that more exists. Decide two settings before auto-approving the query tool — write and management commands are allowed by default, and telemetry is always on unless you point it at your own OTLP collector.

What it is

A KQL client for Azure Data Explorer. Point it at a cluster URL and database and it lists tables and functions, shows their schemas, and runs queries — sizing every response so a wide result set does not swamp the conversation.

What you get

A connection to any ADX cluster URL and database, authenticated as the identity already logged in through the Azure CLI
Tables and functions in the current database listed, with column schemas, and a function's own code and parameters
KQL queries run with results capped at 20 rows by default and a limit parameter when you need more, plus a flag on the response when the results are partial
Results as JSON or as markdown tables, with KUSTO_MARKDOWN_MAX_CELL_LENGTH keeping one long text column from blowing the table wide
A character budget for the whole response — KUSTO_MAX_RESPONSE_LENGTH, default 12000 — met by returning fewer whole rows rather than cutting data mid-value, never dropping below KUSTO_MIN_RESPONSE_ROWS
A read-only mode: with KUSTO_ALLOW_WRITE_OPERATIONS=false only plain KQL and .show commands run, and .ingest, .drop, .create, .alter and the rest are rejected
A pre-filled GitHub issue link from report-issue, which needs no GitHub token and no live Kusto connection — so it still works when the connection is what broke

Requirements

The Azure CLI on the machine and a live az login session — queries run as that identity, so cluster access follows your own Azure permissions. It starts over stdio as npx -y kusto-mcp@latest. KUSTO_AUTH_METHOD selects azure-cli or azure-identity; KUSTO_QUERY_TIMEOUT (default 60000 ms) and KUSTO_CONNECTION_TIMEOUT (default 20000 ms) bound the calls; KUSTO_RESPONSE_FORMAT switches between json and markdown. Write and management commands are permitted unless KUSTO_ALLOW_WRITE_OPERATIONS=false. Anonymous usage telemetry is always on and carries no cluster, database, table or function names, no query text and no results; OTEL_EXPORTER_OTLP_ENDPOINT and OTEL_EXPORTER_OTLP_HEADERS route it to your own OTLP pipeline. MIT.

Setup effort

One command — npx -y kusto-mcp@latest

See installation options

USE CASES

01

Investigating an incident in telemetry data

Open a connection to the cluster, find the table holding the logs, and ask the question in English; the query comes back capped so a noisy hour does not fill the window.

initialize-connectionshow-tablesexecute-query

02

Working out what a cluster actually holds

List the tables and functions in the database, then read a table's columns before writing anything that queries it.

show-tablesshow-tableshow-functions

03

Reading the logic inside a saved KQL function

Pull a stored function's code and parameters instead of guessing what it computes from the name.

show-functionsshow-function

04

Giving an agent query access without write risk

Set KUSTO_ALLOW_WRITE_OPERATIONS=false and the query tool takes plain KQL and .show only; ingest, drop, create and alter commands are refused rather than run.

execute-query

05

Reporting a connection that will not come up

Get a pre-filled GitHub issue link with a short environment footer attached. No connection is needed for it to work, and includeDiagnostics: false leaves the footer off.

report-issue

7 tools

Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.

`execute-query`

Runs KQL queries and returns results. By default, limits results to 20 rows to prevent context overflow. Use the "limit" parameter to specify a different maximum. If results are marked as partial, consider revising your query to use aggregations, filters, or summarizations.

BEFORE YOU INSTALL

What to know first

Tools you get

7 tools when we connected. KUSTO_ALLOW_WRITE_OPERATIONS=false limits execute-query to plain KQL and .show commands; it does not remove a tool. show-function and show-functions are undocumented.

Requires

Node.js 16.x or higher
The Azure CLI, signed in with az login
Access to an Azure Data Explorer cluster

Where it runs

All 5 documented clients run the server on your machine.

CONTEXT COST

Light Standing cost

Rated by the size of the 7 tool definitions that ride along on every turn, not by how many there are

INSTALLATION

Connect your client

Server setup

TERMINAL

npx -y kusto-mcp@latest

MCP Clients

Claude Code

CLAUDE CODE · TERMINAL

claude mcp add kusto-mcp -- npx -y kusto-mcp@latest

Cline

CLINE · JSON

{
  "mcpServers": {
    "github.com/johnib/kusto-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "kusto-mcp@latest"
      ],
      "env": {},
      "disabled": false,
      "autoApprove": [
        "initialize-connection",
        "show-tables",
        "show-table",
        "execute-query",
        "report-issue"
      ]
    }
  }
}

Cursor

CURSOR · JSON

{
  "mcpServers": {
    "github.com/johnib/kusto-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "kusto-mcp"
      ]
    }
  }
}

VS Code

VS CODE · JSON

{
  "servers": {
    "github.com/johnib/kusto-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "kusto-mcp"
      ]
    }
  }
}

Claude Desktop

CLAUDE DESKTOP · JSON

{
  "mcpServers": {
    "kusto-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "kusto-mcp"
      ]
    }
  }
}

Kusto MCP Server by johnib

Plain-English questions against ADX, with the answer sized to fit.

What it is

What you get

Requirements

Setup effort

Investigating an incident in telemetry data

Working out what a cluster actually holds

Reading the logic inside a saved KQL function

Giving an agent query access without write risk

Reporting a connection that will not come up

7 tools

`execute-query`

`initialize-connection`

`report-issue`

`show-function`

`show-functions`

`show-table`

`show-tables`

What to know first

Tools you get

Requires

Where it runs

Light Standing cost

Connect your client

Server setup

MCP Clients

Claude Code

Cline

Cursor

VS Code

Claude Desktop

Kusto MCP Server by johnib

Plain-English questions against ADX, with the answer sized to fit.

What it is

What you get

Requirements

Setup effort

Investigating an incident in telemetry data

Working out what a cluster actually holds

Reading the logic inside a saved KQL function

Giving an agent query access without write risk

Reporting a connection that will not come up

7 tools

execute-query

initialize-connection

report-issue

show-function

show-functions

show-table

show-tables

What to know first

Tools you get

Requires

Where it runs

Light Standing cost

Connect your client

Server setup

MCP Clients

Claude Code

Cline

Cursor

VS Code

Claude Desktop

Same category

Azure Data Explorer

OceanBase MCP Server

JDBC Explorer

Redshift MCP Server

`execute-query`

`initialize-connection`

`report-issue`

`show-function`

`show-functions`

`show-table`

`show-tables`