KQL Search

Query Details

Foundry - External MCP server targets

Foundry Mcp External Targets

Query

AppDependencies
| where isnotempty(tostring(Properties["gen_ai.tool.name"]))
| extend
    Agent = tostring(Properties["gen_ai.agent.name"]),
    ToolName = tostring(Properties["gen_ai.tool.name"]),
    ToolType = tostring(Properties["gen_ai.tool.type"]),
    ToolDescription = tostring(Properties["gen_ai.tool.description"]),
    ServerLabel = coalesce(tostring(Properties["gen_ai.tool.server_label"]), tostring(Properties["mcp.server.label"]), tostring(Properties["server_label"])),
    ServerUrl = coalesce(tostring(Properties["gen_ai.tool.server_url"]), tostring(Properties["mcp.server.url"]), tostring(Properties["server_url"])),
    Operation = tostring(Properties["gen_ai.operation.name"])
| extend McpServer = coalesce(ServerUrl, ServerLabel, tostring(Target))
| where ToolType has "mcp" or Operation has "mcp" or ToolName has "mcp" or ToolDescription has "mcp" or McpServer has "mcp"
| where McpServer startswith "http://" or McpServer startswith "https://"
| extend Host = tostring(parse_url(McpServer)["Host"])
| extend Classification = case(
    Host endswith ".microsoft.com" or Host endswith ".microsoftonline.com" or Host endswith ".azure.com" or Host endswith ".azure.net", "Microsoft / Azure",
    Host in ("localhost", "127.0.0.1", "::1"), "Local",
    "EXTERNAL - REVIEW")
| summarize Calls = count(), Failures = countif(Success == false),
    Agents = make_set_if(Agent, isnotempty(Agent), 10),
    Tools = make_set(ToolName, 20), FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by Classification, Host, McpServer
| order by Classification desc, Calls desc

Explanation

This KQL query is designed to analyze and categorize HTTP/S MCP (Managed Control Plane) server destinations used by Foundry agents. Here's a simplified breakdown of what the query does:

  1. Data Source: It starts by querying the AppDependencies table to find records where the property gen_ai.tool.name is not empty.

  2. Data Extraction: It extracts various properties related to the agent and tool, such as the agent name, tool name, type, description, server label, server URL, and operation name.

  3. Server Identification: It identifies the MCP server by checking several properties and assigns a value to McpServer.

  4. Filtering: The query filters for records where the tool type, operation, tool name, tool description, or server contains "mcp". It further filters to only include servers that start with "http://" or "https://".

  5. Host Extraction: It extracts the host part of the URL from the McpServer.

  6. Classification: It classifies the host into three categories:

    • "Microsoft / Azure" if the host ends with certain Microsoft or Azure domains.
    • "Local" if the host is a loopback address (e.g., "localhost").
    • "EXTERNAL - REVIEW" for all other hosts.

  7. Aggregation: It summarizes the data by counting the number of calls and failures, and lists unique agents and tools. It also records the first and last time the server was seen.

  8. Ordering: The results are ordered by classification and the number of calls, with "Microsoft / Azure" and "Local" classifications appearing first.

  9. Purpose: The query is used for reviewing egress, ownership, data residency, authentication, and AI Gateway considerations for external MCP server targets.

  10. Security Context: It is associated with tactics like Command and Control and Exfiltration, and techniques such as T1102 (Web Service) and T1567 (Exfiltration Over Web Service).

  11. Tags: The query is tagged for use with Sentinel-As-Code, Custom, Foundry, AI, and MCP contexts.