一个模型背景协议服务器的完整样本实施,该服务器通过保护资源元数据(PRM)和Microsoft Graph API集成证明安全授权.

□ 概览

这个样本用保护资源元数据(PRM)执行MCP授权规格的最新草案,它大大简化了授权的执行。 该服务器由ASP.NET Core所建并被部署到Azure,其基础设施完全自动化.

□ 关键特性

• 最新《多边采购协议》授权**:以保护资源元数据执行《多边采购协议》授权
• 零部署**: 用单一命令完成基础设施设置
• 设计安全**:使用管理身份作为联邦身份证书(没有客户秘密)
• Microsoft Graph Access**:通过用户授权访问受保护资源的演示

□ 先决条件

• Azure 开发者 CLI (azd) v1. 17 或以上
• Azure订阅
• VS代码(用于测试)

□ 快开始

1. 部署到阿苏尔

以单一命令部署Azure的完整解决方案:

这将规定:

• Azure API 管理服务
• 使用 MCP 服务器的 App 服务

MCP Servers authorization with Protected Resource Metadata (PRM) sample

A complete sample implementation of a Model Context Protocol (MCP) server that demonstrates secure authorization using Protected Resource Metadata (PRM) and Microsoft Graph API integration.

Overview

This sample implements the latest draft version of MCP Authorization specification with Protected Resource Metadata (PRM), which simplifies the authorization implementation a lot. The server is built with ASP.NET Core and deployed to Azure with full infrastructure automation.

Key Features

• 🔐 Latest MCP Authorization: Implements MCP Authorization with Protected Resource Metadata (PRM)
• 🚀 Zero-Config Deployment: Complete infrastructure setup with a single command
• 🔑 Secure by Design: Uses Managed Identity as Federated Identity Credential (no client secrets)
• 📊 Microsoft Graph Access: Demonstrates accessing protected resources with user-delegated permissions

Prerequisites

• Azure Developer CLI (azd) v1.17 or above
• Azure subscription
• VS Code (for testing)

Quick Start

1. Deploy to Azure

Deploy the complete solution to Azure with a single command:

azd up

This will provision:

• Azure API Management service
• App Service with the MCP server
• Microsoft Entra App
• Managed Identity as federated credential
• Application Insights for monitoring
• All necessary configuration

2. Test with VS Code

1. Install latest VS Code

2. Add MCP Server:

   • Open Command Palette (Ctrl+Shift+P)
   • Run MCP: Add Server
   • Select HTTP as the server type
   • Enter the endpoint URL from the azd up output:

3. Authorize and Test:

   • After a while, VS Code will prompt you to sign in to Microsoft
   • After authentication, open GitHub Copilot
   • Ask: “Who am I?” - Copilot will use the MCP server to retrieve your profile
   • If consent is required, you’ll receive a message with a login URL to visit
   • After visiting the URL and consenting, try the request again in GitHub Copilot

MCP Tools

The sample includes one MCP tool:

• ShowUserProfile: Retrieves the current user’s profile information from Microsoft Graph, including display name, email, job title, and department.