scadam/ess-mcp

🏢 ESS-MCP

Enterprise Self-Service, end-to-end on the Model Context Protocol
7 production-grade MCP servers · 1 Microsoft 365 Copilot declarative agent · 5 Copilot Cowork plugins · 1 autonomous Agent 365 teammate

---

📖 What is ESS-MCP?

ESS-MCP is a complete reference implementation of enterprise self-service powered by the Model Context Protocol — and a worked example of every shape an AI agent can take inside the Microsoft cloud:

1. 🔧 Core MCP servers — modular, actionable Workday, ServiceNow, Salesforce, Jira, SAP SuccessFactors, SAP Ariba, and Coupa servers with 204 tools and 76 interactive HTML+Skybridge widgets.
2. 🟦 Microsoft 365 Copilot Declarative Agent — Employee Self Service declarative agent that wires all 7 MCP servers into Copilot as RemoteMCP plugins, alongside SharePoint, OneDrive, and Graph Connector knowledge.
3. 🟪 Copilot Cowork plugins — 5 packaged Cowork plugins, each pairing a fleet of Agent Skills (dashboards, decks, Adaptive Cards, executive briefs) with the matching ESS-MCP server as a remote MCP connector.
4. 🤖 Autonomous Demo Agent — a hosted, autonomous AI teammate with its own Microsoft Entra Agent Identity, fully integrated with Agent 365 (Entra, Purview, Defender, M365 Admin Center → Agents, Foundry), running ESS-MCP tools through the APIM AI Gateway with end-to-end OpenTelemetry observability.

One repo, one consistent enterprise toolset, surfaced four different ways across Copilot, Cowork, and autonomous agents — all governed through Agent 365.

---

🧭 The four pillars

---

🖼️ See it in action

The MCP widget surface — 76 widgets that AI agents render and act on

Every widget renders inline in Microsoft 365 Copilot, ChatGPT, Claude, or any MCP-aware client. Forms submit straight to MCP tool callbacks — the agent never has to compose JSON.

→ Browse all 76 widgets in the widget gallery

The autonomous demo agent — Agent 365 control plane

A custom pane of glass for the demo agent: agent identities, hosted instances, tool catalogues, deny-list, run telemetry, and one-click deep links into Entra, Purview, Defender, and the M365 Admin Center Agents blade.

→ See the demo agent page for full Agent 365 integration details

---

🚀 Quick start

git clone https://github.com/scadam/ess-mcp.git
cd ess-mcp/mcp_servers
pip install -e ".[dev]"

# Run all servers locally
python -m mcp_servers.cli all --transport both --port 8080

# Health check
curl http://localhost:8080/healthz

Then choose your path:

---

🏗️ End-to-end architecture

                  ┌────────────────────────────────────────────────────────────┐
                  │           Microsoft 365 + Foundry  ("Agent 365")           │
                  │  Entra Agent ID · Purview DSPM-for-AI · Defender XDR ·     │
                  │  M365 Admin Center → Agents · Azure AI Foundry             │
                  └─────────────┬──────────────────────────────┬───────────────┘
                                │                              │
            ┌───────────────────┴──────┐         ┌─────────────┴──────────────┐
            ▼                          ▼         ▼                            ▼
  ┌────────────────────┐   ┌────────────────────┐   ┌──────────────────────────┐
  │ M365 Copilot       │   │ Copilot Cowork     │   │ Autonomous Demo Agent    │
  │ Declarative Agent  │   │ Plugins + Skills   │   │ (Agent Identity, HITL)   │
  │ (RemoteMCP × 7)    │   │ (5 plugins)        │   │                          │
  └─────────┬──────────┘   └─────────┬──────────┘   └──────────────┬───────────┘
            │                        │                             │
            │ MCP (SSE / Streamable HTTP)        ┌─────────────────┴───────────┐
            ▼                        ▼           ▼     APIM AI Gateway          │
  ┌─────────────────────────────────────────────────────────────────────────────┴───┐
  │                         ESS-MCP Gateway  (port 8080)                            │
  │  /workday  /servicenow  /salesforce  /jira  /sap_sf  /ariba  /coupa  /healthz   │
  └──┬─────────────┬──────────────┬───────────┬─────────┬──────────┬───────────────┘
     ▼             ▼              ▼           ▼         ▼          ▼
  Workday    ServiceNow     Salesforce      Jira     SAP SF   Ariba  Coupa (mock)

Bearer-token passthrough by default; the Demo Agent additionally fronts the gateway with APIM AI Gateway for policy, identity-asserted token exchange, and full observability.

---

🧩 Project structure

ess-mcp/
├── README.md                       ← you are here
├── docs/                           ← documentation site
│   ├── mcp-servers.md              ← MCP server deep dive
│   ├── widgets.md                  ← Full 76-widget gallery
│   ├── deployment.md               ← Azure deploy + per-SaaS OAuth setup
│   ├── declarative-agent.md        ← M365 Copilot declarative agent
│   ├── cowork-plugins.md           ← 5 Copilot Cowork plugins
│   ├── demo-agent.md               ← Autonomous Agent 365 teammate
│   ├── prompts.md                  ← Agent system prompt + skill prompts
│   └── images/                     ← Widget screenshots
├── deploy.sh                       ← One-command Azure deploy
├── deploy/                         ← Bicep + deploy scripts
├── mcp_servers/                    ← 7 MCP servers
│   └── src/mcp_servers/
│       ├── cli.py, settings.py, logging.py
│       ├── auth/  http/  ui/widget/
│       ├── workday/ servicenow/ salesforce/ jira/
│       └── sap_sf/ ariba/ coupa/
├── declarative_agent/              ← M365 Copilot declarative agent
│   ├── appPackage/                 ← declarativeAgent.json + 7 *-mcp-plugin.json
│   └── m365agents.yml
├── cowork/plugins/                 ← 5 Copilot Cowork plugins (each .zip-packaged)
│   ├── workday-people-leader/
│   ├── servicenow-it-operations/
│   ├── salesforce-sales-intelligence/
│   ├── jira-delivery-intelligence/
│   └── coupa-procurement-intelligence/
├── demo_agent/                     ← Autonomous Agent 365 demo
│   ├── agent.py · web.py · identity.py · oauth.py
│   ├── governance.py · hitl.py · observability.py · purview.py
│   ├── gateway/apim-mcp-policy.xml ← APIM AI Gateway policy
│   ├── skills/                     ← 9 cross-system skills
│   ├── static/control-plane.html   ← Custom Agent 365 control plane
│   └── AGENT365_SETUP.md
└── widget-preview/                 ← Local widget gallery server

---

📄 License

This project is licensed under the MIT License.