Foundry - Unapproved MCP server executed

Foundry Mcp Unapproved Server Execution

Query

let approved =
    _GetWatchlist('FoundryMcpApprovedServers')
    | where tolower(tostring(column_ifexists('Approved', 'false'))) in ('true', '1', 'yes')
    | extend ApprovedServer = tolower(trim(' ', tostring(column_ifexists('ServerIdentifier', ''))))
    | where isnotempty(ApprovedServer)
    | distinct ApprovedServer;
let ApprovedCount = toscalar(approved | count);
AppDependencies
| where isnotempty(tostring(Properties["gen_ai.tool.name"]))
| extend
    Agent = tostring(Properties["gen_ai.agent.name"]),
    Model = tostring(Properties["gen_ai.request.model"]),
    ConvId = tostring(Properties["gen_ai.conversation.id"]),
    ToolName = tostring(Properties["gen_ai.tool.name"]),
    ToolType = tostring(Properties["gen_ai.tool.type"]),
    ToolDescription = tostring(Properties["gen_ai.tool.description"]),
    ServerLabel = coalesce(tostring(Properties["gen_ai.tool.server_label"]), tostring(Properties["mcp.server.label"]), tostring(Properties["server_label"])),
    ServerUrl = coalesce(tostring(Properties["gen_ai.tool.server_url"]), tostring(Properties["mcp.server.url"]), tostring(Properties["server_url"])),
    Operation = tostring(Properties["gen_ai.operation.name"])
| extend McpServer = coalesce(ServerUrl, ServerLabel, tostring(Target))
| where ToolType has "mcp" or Operation has "mcp" or ToolName has "mcp" or ToolDescription has "mcp" or McpServer has "mcp"
| where ApprovedCount > 0 and isnotempty(McpServer)
| extend NormalizedServer = tolower(trim(' ', McpServer))
| join kind=leftanti approved on $left.NormalizedServer == $right.ApprovedServer
| summarize
    Calls = count(),
    Failures = countif(Success == false),
    Tools = make_set(ToolName, 20),
    Conversations = dcountif(ConvId, isnotempty(ConvId)),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    Model = take_any(Model)
    by Agent, McpServer
| extend
    AccountName = iff(isempty(Agent), "unknown-agent", Agent),
    McpServerUrl = iff(McpServer startswith "http://" or McpServer startswith "https://", McpServer, "")
| project LastSeen, AccountName, Agent, Model, McpServer, McpServerUrl,
    Calls, Failures, Conversations, Tools, FirstSeen
| order by Calls desc

Explanation

This query is designed to detect unauthorized use of Microsoft Foundry agents executing MCP (Managed Control Plane) tools that connect to servers not listed in an approved watchlist. Here's a simplified breakdown:

Purpose: The query identifies instances where a Foundry agent uses an MCP tool to connect to a server that isn't approved, which could indicate unauthorized server usage, a compromised connection, or use of an incorrect server environment.
Watchlist Check: It checks against a watchlist named FoundryMcpApprovedServers to see if the server being used is approved. The watchlist must have entries marked as approved for the rule to be active.
Data Source: The query uses data from ApplicationInsights, specifically the AppDependencies data type, to gather information about tool usage.
Data Filtering: It filters out entries that don't contain server metadata and focuses on those related to MCP tools or operations.
Comparison: The query compares the server being used by the tool against the approved servers in the watchlist. If the server is not approved, it is flagged.
Output: The results include details such as the number of calls made, failures, tools used, conversations involved, and the first and last time the server was seen being used.
Alerting: If unauthorized server usage is detected, an alert is generated. The alert includes details like the agent name, model, server URL, and usage statistics.
Incident Management: The query is set to create incidents for unauthorized usage, grouping them by account for better management.
Status: The rule is initially disabled until the watchlist is populated with approved servers.

Overall, this query helps in monitoring and securing the use of MCP tools by ensuring they only connect to approved servers, thus preventing potential security breaches.