MCP Adapters

Value: Each adapter saves 2–4 weeks of integration engineering. Across 7 enterprise systems (including MCP hosting templates), that is 3–6 months of work eliminated from your first engagement — with OAuth, retry logic, and Redis-backed token caching already production-hardened.

Overview

The Enterprise Kit includes 7 production-ready MCP (Model Context Protocol) adapters that connect AI agents to enterprise systems, plus MCP server hosting templates for deploying custom MCP servers. Each adapter exposes a set of tools via the MCP protocol, implements OAuth 2.0 / managed identity authentication, and includes Redis-backed token caching for high availability.

Adapter Catalog

Adapter	System	Tools	Auth
ServiceNow	ITSM	create_incident, get_incident, update_incident, resolve_incident, create_change_request, search_knowledge	OAuth 2.0 + Redis cache
SAP S/4HANA	ERP	get_purchase_order, create_purchase_order, get_material, post_goods_receipt	OAuth 2.0 client credentials
Salesforce	CRM	query_records, create_record, update_record, get_opportunity, search_contacts	OAuth 2.0 JWT bearer
Microsoft Graph	M365	send_email, search_users, get_calendar, list_files, create_teams_message	Entra ID managed identity
Workday	HCM	get_worker, search_workers, get_worker_organizations, request_time_off, get_compensation, get_time_off_balance	OAuth 2.0 + Redis cache
Internal API Gateway	Custom	Dynamic — generated from YAML catalog	Managed identity / API key / mTLS
MCP Server Hosting	Platform	Azure Functions + Container Apps hosting templates for custom MCP servers	Managed identity / Entra Agent Identity

Architecture

Adapters are registered in the Azure AI Foundry Toolbox — a centralized, MCP-compatible tool registry with Entra ID authentication and versioned deployments. Each adapter follows a consistent architecture:

FastAPI application — Exposes /mcp/tools, /mcp/call, and /health endpoints
Foundry Toolbox registration — Tools are registered in the Foundry Toolbox with MCP Auth (Managed Identity, OAuth Passthrough, or Key-based)
Handler Registry — Maps tool names to async handler functions
Auth Layer — OAuth 2.0 token management with Azure Cache for Redis, secrets from Azure Key Vault
Rate Limiting — Per-adapter configurable rate limits

MCP Auth Patterns (Azure-Native)

Auth Pattern	Use Case	Azure Service
Managed Identity	Azure-to-Azure (Graph, internal APIs)	Entra ID Managed Identity
OAuth Passthrough	Delegated user access (ServiceNow, Salesforce)	Entra ID + external IdP
Key-based	Third-party APIs with API keys	Azure Key Vault secret reference
Entra Agent Identity	Agent-to-agent (A2A protocol)	Entra ID Agent Identity (Preview)

Internal API Gateway

The Internal API Gateway is a unique adapter that dynamically generates MCP tools from YAML API registrations. This allows teams to expose any internal REST API as agent tools without writing code:

# api-catalog/example-hr-api.yaml
name: example-hr-api
display_name: Corporate HR API
base_url: https://hr-api.internal.corp.com/v2
auth_type: managed_identity
rate_limit_rps: 10
endpoints:
  - name: get_employee
    method: GET
    path: /employees/{employee_id}
    description: Retrieve employee profile by ID
    parameters:
      - name: employee_id
        type: string
        required: true
  - name: search_employees
    method: GET
    path: /employees/search
    description: Search employees by criteria
    parameters:
      - name: department
        type: string
      - name: location
        type: string

Deployment on Azure

Adapters are deployed as Azure Container Apps or Azure Functions and registered in the Foundry Toolbox. Secrets are stored in Azure Key Vault, tokens cached in Azure Cache for Redis, and telemetry flows to Azure Application Insights. Each adapter requires environment variables for authentication:

# ServiceNow
SERVICENOW_INSTANCE_URL=https://yourinstance.service-now.com
SERVICENOW_CLIENT_ID=<client-id>
SERVICENOW_CLIENT_SECRET=<from-key-vault>

# Redis (shared)
REDIS_URL=redis://your-redis.redis.cache.windows.net:6380

# Internal API Gateway
API_CATALOG_DIR=/app/api-catalog
KEY_VAULT_URL=https://your-vault.vault.azure.net

Toolbox Configuration

Each agent's tool access is controlled by a toolbox allowlist in toolbox-configs/. Only tools listed in the allowlist are available to the agent at runtime:

# toolbox-configs/operations-agent-toolbox.yaml
tools:
  - adapter: servicenow
    allowed:
      - create_incident
      - get_incident
      - resolve_incident
  - adapter: msgraph
    allowed:
      - send_email
      - search_users