IBM's Azure Foundry Enterprise Kit

MCP Fleet Governance

Why fleet governance matters: Enterprise deployments run dozens of MCP servers across multiple agent classes. Without lifecycle management, version control, and per-tool authorization, MCP becomes an unaudited attack surface. The Enterprise Kit treats MCP infrastructure as a governed fleet — with the same rigor applied to the agents themselves.

Overview

The MCP Fleet Governance plane (WS-9) provides end-to-end lifecycle management for MCP toolboxes and servers across your Azure AI Foundry environment. It encompasses six components that work together to ensure every tool call is authenticated, authorized, version-controlled, and observable.

Architecture

#ComponentPurpose
1Toolbox Lifecycle ManagerVersion create → test → promote → deprecate → cleanup with approval gates
2Private Tool CatalogAzure API Center-backed registry for MCP server discovery and governance
3MCP Auth ProviderUnified auth abstraction for 5 Foundry MCP methods with token caching
4MCP Server HostingAzure Functions + Container Apps templates with Bicep IaC
5Toolbox Endpoint ResolverConsumer vs. developer endpoint resolution with version pinning
6MCP Fleet DashboardKQL-based observability: health, usage, rate limiting, error classification, latency

Toolbox Lifecycle Management

The ToolboxLifecycleManager in trust-extensions/toolbox_lifecycle_manager.py manages the full lifecycle of Foundry Toolbox versions with CI/CD-friendly idempotent operations:

Version Stages

StageDescriptionTransition
createdNew version parsed from toolbox YAML→ testing
testingHealth checks running, tool validation in progress→ promoted
promotedSet as default version (atomic swap)→ deprecated
deprecatedMarked for removal, traffic draining→ deleted
deletedCleaned up, retention enforced—

Lifecycle Operations

  • create_version_from_yaml() — Idempotent version creation from toolbox config
  • health_check() — Validates tool endpoints and auth before promotion
  • promote_to_default() — Atomic swap to make version the consumer default
  • enforce_retention(max_versions=5) — Cleans old versions, respects retention policy

Supported Tool Types

The lifecycle manager handles 12 Foundry Toolbox tool types:

  • MCP
  • OpenAPI
  • A2A
  • Web Search
  • AI Search
  • Code Interpreter
  • File Search
  • Azure Functions
  • SharePoint
  • Fabric
  • Image Generation
  • Browser Automation

Per-Agent Toolbox Configuration

Each agent class has a dedicated toolbox configuration in toolbox-configs/ with role-appropriate tool access and approval policies:

Agent ClassApproval PolicyTool TypesKey MCP Servers
KnowledgeautoWeb Search, AI Search, MCPSharePoint, Confluence
OperationsconditionalMCPServiceNow, Graph
WorkflowrequireMCPSAP, Workday, ServiceNow, Salesforce, Graph
AnalystautoAI Search, Code Interpreter—
PolicyrequireAI Search, Policy tools—

Tool-Level Approval Tiers

TierScopeApprovalExample
Tier 1Read operationsAuto-approvedget_purchase_order, search_contacts
Tier 2Write operationsTeam lead approval (300s timeout via Teams webhook)create_purchase_order, create_incident
Tier 3Financial / destructiveAlways require approvalpost_financial_document

Zero Trust Controls

Three Zero Trust controls govern the MCP fleet:

ControlScopeKey Enforcement
ZT-07MCP GatewayAgent-to-tool authorization, identity propagation, egress control, schema validation
ZT-12Foundry ToolboxTool registry governance, version management, AI Gateway integration, per-tool auth
ZT-15MCP Security5 auth methods, transport security (TLS + VNet), per-agent-class allowlists, APIM rate limits

Per-Agent Session Limits (ZT-15)

Agent ClassMax Tool Calls / SessionTool Type Restrictions
Knowledge50Read-only tools
Analyst100Search + compute
Workflow25All types (with approval gates)
Policy20Policy evaluation tools only

Toolbox Policy Enforcement

The toolbox-allowlist-policy.yaml in policy-packs/toolbox/ enforces per-tool authorization at runtime before every tool call:

Tool ClassApprovalEnforcement
readAuto-approveDeny in prod/staging
Audit in dev
writeRequire approval
externalAlways approve
computeRequire approval
internalAuto-approve

Violations set risk.policy_violated=true and log to the Decision Ledger.

Fleet Observability (KQL)

Two KQL query packs provide fleet-wide monitoring:

MCP Fleet Dashboard

observability/kql/mcp-fleet-dashboard.kql — 5 queries:

  • Fleet Health Overview — status of all MCP servers
  • Tool Usage Analytics — invocation counts and patterns
  • Gateway Rate Limiting — throttled requests by agent and tool
  • Error Classification — categorized failure analysis
  • Latency Heatmap — P50/P95/P99 by tool and time window

MCP Gateway Analytics

observability/kql/mcp-gateway-analytics.kql — 6 queries:

  • Gateway Traffic Overview — requests through APIM AI Gateway
  • Per-Tool Rate Limiting — rate limit enforcement analytics
  • Per-Agent Monopoly Prevention — tool usage concentration
  • IP Filtering — blocked vs. allowed traffic
  • Header Sanitization — stripped/modified headers
  • Geo-Routing Distribution — multi-region traffic patterns

Data sources: AppRequests, AppTraces, ContainerAppConsoleLogs, AppServiceHTTPLogs, AzureDiagnostics (APIM).

Bicep Governance Module

The infra/bicep/modules/toolbox.bicep module configures Foundry Toolbox governance with APIM AI Gateway integration:

ParameterDefaultPurpose
enableVersionPinningtruePin toolbox versions for stability
enablePrivateCatalogtrueRegister tools in API Center catalog
maxVersionsRetained10Retention limit for old versions
deprecationNoticeDays30Days before deprecated versions are deleted
defaultRateLimitRpm60Default rate limit per tool (requests/min)
enableAiGatewayRoutingtrueRoute tool calls through APIM AI Gateway

Next Steps