Azure Incident Investigation

A two-part portfolio project: a read-only MCP server exposing Azure observability tools, and an autonomous agent that drives those tools to investigate incidents and produce a synthesised root-cause report. A free, self-built, minimal take on the idea behind Microsoft's Azure SRE Agent — and, like that tool's "Reader mode", strictly read-only throughout.

 you ──"symptom"──▶  incident-agent  ──MCP (stdio/HTTP)──▶  observability-mcp  ──▶  Azure
                     (Claude Agent SDK)                     (9 read-only tools)     (App Insights,
                          │                                                          App Service,
                          └── streams its reasoning + tool calls live,               Activity Log)
                              then emits a Markdown root-cause report

The two components

Each directory is a self-contained npm project with its own README covering setup, configuration, and how to run it. Start with observability-mcp/ (the tools), then incident-agent/ (the agent that drives them).

Design principles

• Read-only, always. Every tool calls only list* / get* / query APIs; the agent routes every tool call through a single deny-by-default gate. Nothing in this project can modify, restart, scale, or delete anything.
• No secrets in code or config. Azure access is DefaultAzureCredential (your az login locally; a managed identity when deployed). See each component's README for the auth and security model.
• Runs locally or hosted. The MCP server speaks stdio for local use and Streamable HTTP for hosting (e.g. Azure Container Apps); the agent connects to either.

This is a lab / portfolio project — safe to run and read, but deliberately not production-hardened. See each component's "Security model" notes before deploying anywhere reachable.

License

MIT.