SAP RCA MCP Server

Python MCP server that enables AI agents to perform Root Cause Analysis on SAP systems by querying Azure Log Analytics data.

Architecture

AI Agent (Azure AI Foundry / Claude / Copilot Studio)
    │  MCP Tool Calls
    ▼
FastMCP Server (server.py)
    ├── get_schema        → schema_registry.py  (table/column metadata)
    ├── execute_query     → la_client.py         (validated KQL execution)
    ├── analyze_results   → domain_knowledge.py  (SAP error classification)
    └── run_full_rca      → rca_orchestrator.py  (8-step automated workflow)
    │
    ▼
Azure Log Analytics (read-only KQL queries via Managed Identity)

The 4 Tools

Tool	Purpose
get_schema	Returns exact column names, types, time column, SID column, and KQL hints for registered tables. Call this first.
execute_query	Validates an agent-generated KQL query (read-only guard) then executes it.
analyze_results	Applies SAP domain knowledge to classify raw rows: error categories, severity, recommendations.
run_full_rca	Executes all 8 RCA steps automatically and returns a consolidated JSON report.

Prerequisites

• Python 3.11+
• Azure CLI (az) installed
• Access to the Azure Log Analytics workspace (Workspace ID needed)
• Role Log Analytics Reader assigned to your account (or Managed Identity)

Setup

# 1. Clone / navigate to this folder
cd C:\Users\padmajat\Documents\AMS-Agentic-RCA\MCP

# 2. Create virtual environment
python -m venv .venv
.venv\Scripts\activate          # Windows
# source .venv/bin/activate     # Linux/macOS

# 3. Install dependencies
pip install -r requirements.txt

# 4. Configure
copy .env.example .env
# Edit .env and fill in AZURE_LOG_ANALYTICS_WORKSPACE_ID and AZURE_TENANT_ID

# 5. Authenticate (local development)
az login

Configuration (.env)

AZURE_LOG_ANALYTICS_WORKSPACE_ID=<your-workspace-guid>
AZURE_TENANT_ID=<your-tenant-id>

On Azure with Managed Identity, only the workspace ID is needed — leave all AZURE_CLIENT_* fields blank.

Running

stdio mode (Claude Desktop, MCP Inspector, Azure AI Foundry local)

python server.py
# or:
mcp dev server.py

SSE/HTTP mode (Azure App Service deployment)

pip install uvicorn
uvicorn server:mcp --host 0.0.0.0 --port 8000

The SSE endpoint will be: http://localhost:8000/sse

Connect to Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "sap-rca": {
      "command": "python",
      "args": ["C:/Users/padmajat/Documents/AMS-Agentic-RCA/MCP/server.py"],
      "env": {
        "AZURE_LOG_ANALYTICS_WORKSPACE_ID": "<your-workspace-id>",
        "AZURE_TENANT_ID": "<your-tenant-id>"
      }
    }
  }
}

Connect to Azure AI Foundry

In Azure AI Foundry, add an MCP connection pointing to: https://<your-app-service>.azurewebsites.net/sse

Example Agent Conversation

Focused query workflow:

Agent → get_schema(["SapNetweaver_ShortDumps_CL"])
Agent → execute_query("SapNetweaver_ShortDumps_CL | where serverTimestamp_t > ago(4h) | where SID_s == 'CHA' | take 100")
Agent → analyze_results(results, "short_dumps", context="SID=CHA, last 4h")

Full automated RCA:

Agent → run_full_rca(sid="CHA", time_range_hours=4, issue_description="Multiple batch job failures")
← Returns complete 8-step RCA report

Registered Tables

Currently registered (1 of 7):

Table	SAP Source	Status
SapNetweaver_ShortDumps_CL	ST22 ABAP Short Dumps	✅ Registered
SapNetweaver_SysLogs_CL	SM21 System Log	⏳ Awaiting schema CSV
SapNetweaver_BatchJobs_CL	SM37 Batch Jobs	⏳ Awaiting schema CSV
SapNetweaver_GetSystemInstanceList_CL	Instance Availability	⏳ Awaiting schema CSV
SapNetweaver_GetProcessList_CL	Process Availability	⏳ Awaiting schema CSV
Prometheus_OSExporter_CL	OS Metrics	⏳ Awaiting schema CSV
Prometheus_HaClusterExporter_CL	HA Cluster	⏳ Awaiting schema CSV

Adding a New Table Schema

1. Provide the schema CSV (columns + description) — same format as SchemaforMCP-Details.csv.
2. Add a new entry to schema_registry.py following the existing SapNetweaver_ShortDumps_CL entry as a template.
3. If the table needs domain-specific analysis logic, add a _analyze_<type>() function to tools/analyze_results.py.
4. Add a KQL template to _KQL_TEMPLATES in tools/rca_orchestrator.py.
5. Restart the server — no other changes needed.

Security Notes

• execute_query blocks all KQL management commands (.ingest, .drop, .set, etc.)
• run_full_rca uses parameterised KQL templates — SID values are validated before substitution
• All credentials are loaded from environment variables — no secrets in code
• On Azure, use Managed Identity; do not store AZURE_CLIENT_SECRET in App Service config

---

⚠ Outstanding Questions (Action Required)

Before the server can connect to your workspace, you need to provide:

#	What	Where to find it	File to update
1	Log Analytics Workspace ID	Azure Portal → Log Analytics workspace → Overview → Workspace ID	.env
2	Azure Tenant ID	Azure Portal → Microsoft Entra ID → Overview → Tenant ID	.env
3	Time column for SapNetweaver_ShortDumps_CL	The CSV you provided shows serverTimestamp_t. Agent docs show timestamp_t. Please confirm which column name is correct in your workspace (check Log Analytics → Tables → ShortDumps).	schema_registry.py line with "time_column"
4	SID_s column presence	Is SID_s present in your ShortDumps table? (Some workspaces use sapsid_s instead.)	schema_registry.py "sid_column" field
5	Remaining 6 table schemas	Provide schema CSVs (same format as SchemaforMCP-Details.csv) for the remaining tables to enable the full 8-step RCA	schema_registry.py entries