Skip to content

functions-bindings-mcp.md

Latest commit

 

History

History
157 lines (127 loc) · 9.44 KB

functions-bindings-mcp.md

File metadata and controls

157 lines (127 loc) · 9.44 KB
title Model context protocol bindings for Azure Functions
description Learn how you can expose your functions as model context protocol (MCP) tools using bindings in Azure Functions.
ms.topic reference
ms.date 04/01/2026
ms.update-cycle 180-days
ms.custom
build-2025
ai-usage ai-assisted
ms.collection
ce-skilling-ai-copilot
zone_pivot_groups programming-languages-set-functions

Model Context Protocol bindings for Azure Functions overview

The Model Context Protocol (MCP) is a client-server protocol designed to help language models and agents more efficiently discover and use external data sources and tools.

The Azure Functions MCP extension enables you to use Azure Functions to create remote MCP servers. These servers can host MCP tool trigger functions that MCP clients, such as language models and agents, can query and access to perform specific tasks. The extension also supports MCP Apps, which lets your tools return interactive user interfaces instead of plain text by combining tool triggers with resource triggers.

Action Type
Run a function from an MCP tool call request Tool trigger
Expose a function as an MCP resource Resource trigger

[!INCLUDE functions-mcp-extension-powershell-note]

Prerequisites

  • When you use the SSE transport, the MCP extension relies on Azure Queue storage provided by the default host storage account (AzureWebJobsStorage). When using identity-based connections, make sure that your function app has at least the equivalent of these role-based permissions in the host storage account: Storage Queue Data Contributor and Storage Queue Data Message Processor.
  • When running locally, the MCP extension requires version 4.0.7030 of the Azure Functions Core Tools, or a later version. ::: zone pivot="programming-language-csharp"
  • Requires version 2.1.0 or later of the Microsoft.Azure.Functions.Worker package.
  • Requires version 2.0.2 or later of the Microsoft.Azure.Functions.Worker.Sdk package.

Install extension

Note

For C#, the Azure Functions MCP extension supports only the isolated worker model.

Add the extension to your project by installing this NuGet package in your preferred way:

Microsoft.Azure.Functions.Worker.Extensions.Mcp
::: zone-end ::: zone pivot="programming-language-java"

[!INCLUDE functions-install-extension-bundle]

::: zone-end

host.json settings

[!INCLUDE functions-host-json-section-intro]

Use the extensions.mcp section in host.json to define MCP server information.

{
  "version": "2.0",
  "extensions": {
    "mcp": {
      "instructions": "Some test instructions on how to use the server",
      "serverName": "TestServer",
      "serverVersion": "2.0.0",
      "encryptClientState": true,
      "messageOptions": {
        "useAbsoluteUriForEndpoint": false
      },
      "system": {
        "webhookAuthorizationLevel": "System"
      }
    }    
  }
}
Property Description
instructions Describes to clients how to access the remote MCP server.
serverName A friendly name for the remote MCP server.
serverVersion Current version of the remote MCP server.
encryptClientState Determines if client state is encrypted. Defaults to true. Setting to false can be useful for debugging and test scenarios but isn't recommended for production.
messageOptions Options object for the message endpoint in the SSE transport.
messageOptions.UseAbsoluteUriForEndpoint Defaults to false. Only applicable to the server-sent events (SSE) transport; this setting doesn't affect the Streamable HTTP transport. If set to false, the message endpoint is a relative URI during initial connections over the SSE transport. If set to true, the message endpoint is an absolute URI. Using a relative URI isn't recommended unless you have a specific reason to do so.
system Options object for system-level configuration.
system.webhookAuthorizationLevel Defines the authorization level required for the webhook endpoint. Defaults to "System". Allowed values are "System" and "Anonymous". When you set the value to "Anonymous", an access key is no longer required for requests. Regardless of if a key is required or not, you can use built-in MCP server authorization as an identity-based access control layer.

Connect to your MCP server

To connect to the MCP server that your function app exposes, provide an MCP client with the appropriate endpoint and transport information. The following table shows the transports supported by the Azure Functions MCP extension, along with their corresponding connection endpoint.

Transport Endpoint
Streamable HTTP /runtime/webhooks/mcp
Server-Sent Events (SSE)1 /runtime/webhooks/mcp/sse

1 Newer protocol versions deprecate the Server-Sent Events transport. Unless your client specifically requires it, use the Streamable HTTP transport instead.

When you host your function app in Azure, the extension requires the system key named mcp_extension for the exposed endpoints. If you don't provide this key in the x-functions-key HTTP header or in the code query string parameter, your client receives a 401 Unauthorized response. You can remove this requirement by setting the system.webhookAuthorizationLevel property in host.json to Anonymous. For more information, see the host.json settings section.

You can retrieve the key by using any of the methods described in Get your function access keys. The following example shows how to get the key by using the Azure CLI:

az functionapp keys list --resource-group <RESOURCE_GROUP> --name <APP_NAME> --query systemKeys.mcp_extension --output tsv

MCP clients accept this configuration in various ways. Consult the documentation for your chosen client. The following example shows an mcp.json file like you might use to configure MCP servers for GitHub Copilot in Visual Studio Code. The example sets up two servers, both using the Streamable HTTP transport. The first server is for local testing with the Azure Functions Core Tools. The second server is for a function app hosted in Azure. The configuration takes input parameters for which Visual Studio Code prompts you when you first run the remote server. By using inputs, you ensure that secrets like the system key aren't saved to the file and checked into source control.

{
    "inputs": [
        {
            "type": "promptString",
            "id": "functions-mcp-extension-system-key",
            "description": "Azure Functions MCP Extension System Key",
            "password": true
        },
        {
            "type": "promptString",
            "id": "functionapp-host",
            "description": "The host domain of the function app."
        }
    ],
    "servers": {
        "local-mcp-function": {
            "type": "http",
            "url": "http://localhost:7071/runtime/webhooks/mcp"
        },
        "remote-mcp-function": {
            "type": "http",
            "url": "https://${input:functionapp-host}/runtime/webhooks/mcp",
            "headers": {
                "x-functions-key": "${input:functions-mcp-extension-system-key}"
            }
        }
    }
}

Related articles