KQL Search

Query Details

AI Agent MCP Server Usage Inventory

Query

AgentsInfo
| where TimeGenerated > ago(30d)
| summarize arg_max(TimeGenerated, *) by AgentId
| mv-expand McpServer = McpServers
| extend McpServer = parse_json(tostring(McpServer))
| extend McpServerName = tostring(McpServer.name),
         McpServerType = tostring(McpServer.type),
         McpServerEndpoint = tostring(McpServer.endpoint)
| where isnotempty(McpServerName) or isnotempty(McpServerEndpoint)
| distinct McpServerName, McpServerType, McpServerEndpoint, AgentId
| summarize AgentCount = count()
    by McpServerName, McpServerType, McpServerEndpoint
| order by AgentCount desc

About this query

Explanation

This query is designed to create an inventory of Model Context Protocol (MCP) servers used by AI agents over the past 30 days. Here's a simplified breakdown of what the query does:

  1. Data Source: It starts by accessing the AgentsInfo table, which contains information about AI agents and their associated MCP servers.

  2. Time Filter: It filters the data to include only records from the last 30 days.

  3. Latest Record Selection: For each agent, it selects the most recent record using the arg_max function based on the TimeGenerated timestamp.

  4. Expand MCP Servers: The query then expands the McpServers array so that each server configuration appears as a separate row.

  5. Extract Server Details: It parses the JSON object for each server to extract the server's name, type, and endpoint.

  6. Filter Out Empty Records: Rows that do not have a server name or endpoint are removed because they don't provide useful information.

  7. Remove Duplicates: It reduces the data to unique combinations of server name, type, endpoint, and agent ID to avoid counting the same server multiple times for the same agent.

  8. Summarize and Order: Finally, it summarizes the data to count how many distinct agents are associated with each MCP server, grouping by server name, type, and endpoint. The results are ordered by the number of agents in descending order.

The purpose of this query is to provide an overview of which MCP servers are being used by AI agents, helping to identify unexpected or unauthorized server endpoints and prioritize security reviews. The 30-day period can be adjusted as needed, and it's important to keep the schema up to date in case of changes.