Niagara MCP Server — APIM Dynamic Discovery

An MCP (Model Context Protocol) server deployed on Azure that dynamically reads all APIs from Azure API Management and exposes them as AI tools to Copilot Studio. No hardcoding. No static files. APIM is the single source of truth.

Branch: Active development on development. main is protected.

---

How It Works

Copilot Studio (user types plain English)
        |
        |  MCP protocol — Streamable HTTP
        v
registry-mcp-server  (Azure App Service — Docker container)
  ├── http_app_apim.py   → exposes /mcp endpoint, accepts Copilot Studio connections
  ├── server_apim.py     → MCP protocol: handles tools/list and tools/call
  ├── apim_dynamic.py    → reads all APIs live from APIM Management API, filters, routes
  ├── registry.py        → fallback only (returns empty if tools_registry.json missing)
  ├── dispatcher.py      → fallback HTTP dispatcher for registry-based tools
  └── apim_poc/policy.xml → APIM native gateway policy (POC reference, not active)
        |
        |  Real HTTP calls with subscription key
        v
Azure API Management (apim-dev-intg)
  ├── Function Apps  (fn-dev-bark, fn-dev-dimitri-getshipmentfromwms, fn-dev-purchase-orders ...)
  ├── Logic Apps     (dimitri-otmtodimitriupdate, ebs-to-dimitri, service-cloud-integration ...)
  └── REST APIs      (livetracking-getShipments, uomconversiontoerp, otmgenericapi ...)

---

Code Files

File	What it does
app/mcp_server/apim_dynamic.py	Core. Authenticates via Managed Identity, calls management.azure.com, reads all 56 APIs, filters out EDI/B2B prefixes, converts each operation to MCP tool format, routes tool calls to correct APIM endpoint
app/mcp_server/server_apim.py	MCP protocol layer. Handles tools/list (calls apim_dynamic) and tools/call (routes to apim_dynamic or fallback)
app/mcp_server/http_app_apim.py	Web server. Exposes /mcp Streamable HTTP endpoint for Copilot Studio and /sse legacy endpoint
app/mcp_server/registry.py	Fallback only. Loads tools from tools_registry.json if it exists. File is deleted — returns empty dict
app/mcp_server/dispatcher.py	Fallback HTTP dispatcher. Used only if APIM discovery fails
apim_poc/policy.xml	APIM native gateway approach (Plan A / POC). Documents rate limiting, JWT auth, and CORS policies

---

API Discovery Logic (apim_dynamic.py)

1. Authenticates using App Service Managed Identity — no passwords, no hardcoded credentials
2. Calls management.azure.com → reads all 56 APIs from apim-dev-intg
3. Checks for mcp-enabled tag — if any API is tagged, shows only tagged ones. If none tagged, shows all
4. Filters out EDI/B2B system callbacks by prefix: o2c_, p2p_, b2b_, echo_api, fourkites_, fap_dev_, 3pl_ofc_, fn_dev_edi_
5. Converts remaining 53 business tools to MCP format with name, description, and input schema from APIM metadata
6. Returns to Copilot Studio — happens live on every session, no caching

Any new Logic App or Function App published to APIM automatically appears in Copilot Studio on the next session. Zero code change, zero redeploy.

---

Security Controls

Control	Status
Managed Identity — no credentials in code	Active
All secrets in App Service env vars — never in code or git	Active
APIM audit logging via Azure Monitor	Active automatically
EDI/B2B filter — AI cannot see system integration endpoints	Active
mcp-enabled tag — whitelist specific APIs for AI access	Ready — APIM admin adds tags
Rate limiting — 100 calls/min per subscription	Ready — one line in policy.xml
JWT Azure AD authentication on /mcp endpoint	Ready — one line in policy.xml

---

Tech Stack

Technology	Version	Purpose
Python	3.11	Server language
MCP SDK	1.28.1	MCP protocol
Starlette	0.41.3	Web framework
Uvicorn	0.32.1	ASGI server
HTTPX	0.28.1	Async HTTP calls to APIM
Azure Identity SDK	≥1.15.0	Managed Identity authentication
Docker	—	Containerization
Azure App Service	—	Hosting
Azure Container Registry	acrregistrymcp	Docker image storage
APIM Management API	2022-08-01	Dynamic API discovery

---

Azure Resources

Resource group: rg-dev-IntegrationTeamAI — Subscription: Niagara Development

Resource	Type	Purpose
registry-mcp-server	App Service	MCP server — live at azurewebsites.net
acrregistrymcp	Container Registry	Docker image storage
apim-dev-intg	API Management	Source of all 56 APIs

---

Environment Variables (App Service)

Variable	Purpose
AZURE_SUBSCRIPTION_ID	Azure subscription hosting APIM
APIM_RESOURCE_GROUP	Resource group of APIM instance
APIM_SERVICE_NAME	APIM name — currently apim-dev-intg
APIM_BASE_URL	APIM gateway URL
APIM_SUBSCRIPTION_KEY	Subscription key for All APIs product — sent on every tool call
APIM_MCP_TAG	Tag filter — default mcp-enabled

---

Live URLs

URL	Purpose
https://registry-mcp-server.azurewebsites.net/mcp	MCP endpoint — Copilot Studio connects here
https://registry-mcp-server.azurewebsites.net/sse	Legacy SSE endpoint
https://apim-dev-intg.azure-api.net	APIM gateway