Add Azure Resiliency Agent tools by psaswata · Pull Request #3845 · microsoft/mcp

Saswata Pandit (psaswata) · 2026-10-05T16:43:50Z

What does this PR do?

Adds the Azure Resiliency Agent namespace with seven tools for general
guidance, architecture assessment, IaC generation, Bicep/ARM/Terraform review
and consent-based local file attachment.

The tools delegate resiliency decisions to the existing Azure Resiliency Agent
through its asynchronous A2A API. The implementation includes delegated
authentication, Azure data-boundary propagation, polling, clarification turns,
bounded attachment handling and native MCP file artifacts.

This PR also:

registers the namespace in Azure MCP and consolidated-tool surfaces;
adds an opt-in McpContent path to every tool-loading mode so commands can
return native content using official MCP tool-result content
blocks
and MCP resources;
promotes detailed recommendation reports ahead of generated templates,
includes explicit artifact-presentation guidance, and emits one
content-carrying embedded resource per file without duplicate local-path
resource links;
requires detailed recommendation reports to be preserved as normal workspace
files under azure-resiliency/, reusing identical content and avoiding
overwrites through collision-safe naming;
instructs clients to surface verified workspace reports as clickable Markdown
links using canonical absolute file:/// URIs while excluding session,
tool-call, cache and temporary paths;
adds command, service and shared-loader coverage;
updates command metadata, routing prompts, README, changelog and CODEOWNERS.

The file-upload design was reviewed with the Azure MCP security team, including
the LocalRequired designation, file validation and sanitization checks, and
UNC/network-path rejection.

Tool surface

resiliencyagent_guidance_get
resiliencyagent_file_attach
resiliencyagent_architecture_assess
resiliencyagent_iac_generate
resiliencyagent_bicep_review
resiliencyagent_arm_review
resiliencyagent_terraform_review

Testing

89 Resiliency Agent tests passed.
52 single-proxy loader tests passed.
50 Azure MCP server tests passed.
Build-Local.ps1 passed.
Build-Local.ps1 -VerifyNpx passed.
Serial Vally routing validation passed 9/9, covering conceptual guidance,
architecture assessment, IaC generation and Bicep, ARM JSON and Terraform
review.
Manual VS Code and Copilot CLI validation covered consent-based file
attachment, clarification, native artifact rendering, repository edits and
user-approved PR orchestration.
Direct A2A attachment validation confirmed exact file transport, private
Blob persistence and pointer-only task storage.

Product evidence

GitHub issue number?

Closes #3844

Pre-merge Checklist

Exposes the Azure Resiliency Agent through a single conversation-level tool, resiliencyagent_conversation_ask. A developer describes an application in their own words and receives a zonal resilience assessment, or asks for zone-resilient Bicep, ARM or Terraform templates for new resources. The area holds no agent logic. It is a thin client over the agent's existing A2A surface, so the backend keeps ownership of what a turn does, including which scenario handles it and when to stop and ask the user something. That is why one conversation-level tool covers both assessment and template generation rather than one tool per Azure operation. The agent is multi-turn: it asks its own clarifying questions before it can act. A single tool call therefore carries an entire conversation. The command polls the agent, raises an elicitation when the agent needs input, feeds the answer back, and returns once. The host model issues one call and never sees the polling, so clarifying questions reach the user exactly as the agent wrote them rather than depending on a model to follow instructions about how to poll. While a turn is running the agent publishes short reasoning steps. Those are forwarded as progress notifications, which also resets client inactivity timers on a call that can run for minutes. Templates and reports are written to the caller's working directory and returned as paths, following the pattern the Azure Migrate platform landing zone tool uses. A generated template is more useful as a file that can be opened and deployed than as text in a chat reply, and a long report does not have to travel through the model's context. Artifact names arrive from a remote service and are treated as untrusted input when used as file names. The tool is marked LocalRequired because it asks the user questions over the client connection, which is not available in HTTP mode. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

…ncy-agent-tool # Conflicts: # servers/Azure.Mcp.Server/README.md

Add five architecture and IaC scenario tools, local file attachment with explicit consent and bounded in-memory caching, A2A FilePart forwarding, public data-boundary routing, MCP artifact content blocks, evaluations, documentation, and tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Remove stale POC prompts and use customer-facing service-area language. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Remove the checked-in Vally specification and rely on the repository evaluator to generate unattended routing evaluations from the E2E prompt inventory. Normalize interactive scenarios to the supported context-required classification. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Add generated Vally coverage for inline ARM, Bicep, and Terraform reviews. Clarify that review commands accept source directly in the request while local files use attachment IDs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Guide complete and multi-file templates through the attachment flow while retaining direct support for templates pasted inline. Reserve existing IaC resiliency review for the format-specific Resiliency Agent commands instead of generic guidance tools. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Include the nested FileContent kind discriminator required by the A2A polymorphic contract so uploaded bytes, filename, and MIME type survive backend deserialization and blob offload. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Add a conceptual guidance command and routing prompts, and make the public A2A endpoint plus delegated scope fixed production constants with no runtime environment overrides or auth bypass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

azure-pipelines · 2026-10-05T16:44:14Z

Azure Pipelines: Successfully started running 1 pipeline(s). There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Copilot review overview

🟡 Changes recommended

Native artifacts are lost in single-tool mode, existing files can be overwritten, and several required security, metadata, and integration gaps remain.

Review effort: Balanced
Findings: 3 · 5 · 5

Open (13)

Mark artifact-writing tools as non-read-only · New
Return errors for failed, canceled, and rejected completions · New
Prevent artifact writes from overwriting existing files · New
Propagate native artifacts in single-tool loader · New
Mark file attachment caching as non-read-only · New
Add extensions for ARM and Terraform artifacts · New
Support advertised tfvars and bicepparam extensions · New
Implement or correct documented UNC path support · New
Test elicitation consent before file snapshotting · New
Add ToolDescriptionEvaluator evidence for new tools · New
Move each model type into its own file · New
Flatten options and use an attachment interface · New
Add live tests for Azure and A2A integrations · New

What changed in this PR

Adds an Azure Resiliency Agent toolset that delegates guidance, assessment, generation, and IaC review to the hosted A2A service.

Changes:

Adds seven commands with delegated authentication, polling, elicitation, attachments, and artifacts.
Adds native MCP content support to command responses and loaders.
Registers and documents the toolset with unit-test coverage.

File	Description
`.github/CODEOWNERS`	Adds toolset owners.
`Microsoft.Mcp.slnx`	Adds projects to the root solution.
`core/Microsoft.Mcp.Core/src/Areas/Server/Commands/ToolLoading/CommandFactoryToolLoader.cs`	Appends native MCP content.
`core/Microsoft.Mcp.Core/src/Areas/Server/Commands/ToolLoading/NamespaceToolLoader.cs`	Appends native MCP content.
`core/Microsoft.Mcp.Core/src/Models/Command/CommandResponse.cs`	Adds the native content contract.
`servers/Azure.Mcp.Server/Azure.Mcp.Server.slnx`	Adds toolset projects.
`servers/Azure.Mcp.Server/README.md`	Documents the service area.
`servers/Azure.Mcp.Server/changelog-entries/saspandit-resiliency-agent-tool.yaml`	Adds the feature changelog entry.
`servers/Azure.Mcp.Server/docs/azmcp-commands.md`	Documents all commands.
`servers/Azure.Mcp.Server/docs/e2eTestPrompts.md`	Adds routing prompts.
`servers/Azure.Mcp.Server/src/Program.cs`	Registers the toolset.
`servers/Azure.Mcp.Server/src/Resources/consolidated-tools.json`	Adds consolidated tool mappings.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/AssemblyInfo.cs`	Exposes internals to tests.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Azure.Mcp.Tools.ResiliencyAgent.csproj`	Defines the tool project.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Commands/Architecture/ArchitectureAssessCommand.cs`	Adds architecture assessment.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Commands/Arm/ArmReviewCommand.cs`	Adds ARM review.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Commands/Bicep/BicepReviewCommand.cs`	Adds Bicep review.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Commands/File/FileAttachCommand.cs`	Adds consent-based attachment preparation.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Commands/Guidance/GuidanceGetCommand.cs`	Adds resiliency guidance.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Commands/Iac/IacGenerateCommand.cs`	Adds IaC generation.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Commands/ResiliencyAgentCommand.cs`	Implements shared scenario execution.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Commands/ResiliencyAgentJsonContext.cs`	Registers serializable models.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Commands/Terraform/TerraformReviewCommand.cs`	Adds Terraform review.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Models/ResiliencyAgentModels.cs`	Defines agent and artifact models.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Options/FileAttachOptions.cs`	Defines file attachment input.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Options/ResiliencyAgentOptionDescriptions.cs`	Defines shared option descriptions.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Options/ResiliencyAgentRequestOptions.cs`	Defines scenario inputs.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/ResiliencyAgentSetup.cs`	Registers services and commands.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/ArtifactWriter.cs`	Materializes generated artifacts.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/AttachmentCache.cs`	Caches approved snapshots.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/AttachmentPolicy.cs`	Defines attachment limits and types.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/DataBoundaryResolver.cs`	Resolves tenant data boundaries.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/IArtifactWriter.cs`	Defines artifact writing.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/IAttachmentCache.cs`	Defines attachment caching.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/IDataBoundaryResolver.cs`	Defines boundary resolution.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/ILocalFileSnapshotter.cs`	Defines file snapshotting.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/IResiliencyAgentService.cs`	Defines the A2A client contract.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/LocalFileSnapshotter.cs`	Validates and snapshots files.
`tools/Azure.Mcp.Tools.ResiliencyAgent/src/Services/ResiliencyAgentService.cs`	Implements A2A communication.
`tools/Azure.Mcp.Tools.ResiliencyAgent/tests/Azure.Mcp.Tools.ResiliencyAgent.Tests/AttachmentServicesTests.cs`	Tests snapshots and caching.
`tools/Azure.Mcp.Tools.ResiliencyAgent/tests/Azure.Mcp.Tools.ResiliencyAgent.Tests/Guidance/GuidanceGetCommandTests.cs`	Tests guidance execution.
`tools/Azure.Mcp.Tools.ResiliencyAgent/tests/Azure.Mcp.Tools.ResiliencyAgent.Tests/Iac/IacGenerateCommandTests.cs`	Tests generation and native artifacts.
`tools/Azure.Mcp.Tools.ResiliencyAgent/tests/Azure.Mcp.Tools.ResiliencyAgent.Tests/ResiliencyAgentSetupTests.cs`	Tests registration.
`tools/Azure.Mcp.Tools.ResiliencyAgent/tests/Azure.Mcp.Tools.ResiliencyAgent.Tests/ScenarioCommandExecutionTests.cs`	Tests shared scenario behavior.
`tools/Azure.Mcp.Tools.ResiliencyAgent/tests/Azure.Mcp.Tools.ResiliencyAgent.Tests/Services/ArtifactWriterTests.cs`	Tests artifact writing.
`tools/Azure.Mcp.Tools.ResiliencyAgent/tests/Azure.Mcp.Tools.ResiliencyAgent.Tests/Services/DataBoundaryResolverTests.cs`	Tests boundary mapping and retries.
`tools/Azure.Mcp.Tools.ResiliencyAgent/tests/Azure.Mcp.Tools.ResiliencyAgent.Tests/Services/ResiliencyAgentServiceTests.cs`	Tests A2A payloads and artifacts.
`tools/Azure.Mcp.Tools.ResiliencyAgent/tests/Azure.Mcp.Tools.ResiliencyAgent.Tests/Azure.Mcp.Tools.ResiliencyAgent.Tests.csproj`	Defines the unit-test project.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Resolve the cspell dictionary conflict and update affected tests for the latest command registration and loader APIs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Keep the upstream explicit server command registration while resolving the PR conflict. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Saswata Pandit (psaswata) and others added 10 commits September 11, 2026 11:34

Merge remote-tracking branch 'origin/main' into saspandit/add-resilie…

9ccb1e6

…ncy-agent-tool # Conflicts: # servers/Azure.Mcp.Server/README.md

Clean up Resiliency Agent README entry

95e7956

Remove stale POC prompts and use customer-facing service-area language. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Add Resiliency Agent service owner

b25783a

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Copilot AI balanced review requested due to automatic review settings October 5, 2026 16:43

Saswata Pandit (psaswata) requested review from a team as code owners October 5, 2026 16:43

Saswata Pandit (psaswata) requested review from KarishmaGhiya, Vinay Gera (g2vinay), Jair Myree (jairmyree), Sai Koumudi Kaluvakolanu (saikoumudi), Sandeep Sen (sandeep-sen), Tom Meschter (tmeschter) and Jeff Fisher (xirzec) October 5, 2026 16:43

Copilot started reviewing on behalf of Saswata Pandit (psaswata) October 5, 2026 16:54

View session

github-actions Bot added the server-Azure.Mcp Azure.Mcp.Server label Oct 5, 2026

Copilot AI reviewed Oct 5, 2026

View reviewed changes

Saswata Pandit (psaswata) added 5 commits October 5, 2026 23:30

Fix Resiliency Agent PR checks

12fe898

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Handle canonical macOS temp paths in artifact tests

6aec4a3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Address Resiliency Agent review feedback

f71590c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Improve Resiliency Agent tool routing

b963667

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Improve Resiliency Agent artifact presentation

f8b0d5b

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Saswata Pandit (psaswata) mentioned this pull request Oct 7, 2026

Preserve MCP embedded text resources and resource_link blocks in tool results github/copilot-sdk#2816

Open

Saswata Pandit (psaswata) added 3 commits October 7, 2026 20:21

Materialize resiliency reports in workspaces

89320fc

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Add clickable links for resiliency artifacts

eec3518

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Retrigger PR checks

f3a835c

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Microsoft (microsoft) deleted a comment from azure-pipelines Bot Oct 7, 2026

Saswata Pandit (psaswata) mentioned this pull request Oct 8, 2026

Support lossless MCP embedded resources and resource links in AHP tool results microsoft/agent-host-protocol#504

Closed

Vinay Gera (g2vinay) reviewed Oct 15, 2026

View reviewed changes

Saswata Pandit (psaswata) added 3 commits October 15, 2026 23:10

Harden Resiliency Agent conversation handling

2d5a171

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Merge latest main command factory fix

4d09a23

Keep the upstream explicit server command registration while resolving the PR conflict. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 974958dc-ded9-4351-bed3-07227e1bce92

Navigation Menu

Repository navigation

Add Azure Resiliency Agent tools - #3845

Add Azure Resiliency Agent tools#3845
Saswata Pandit (psaswata) wants to merge 21 commits into
mainfrom
saspandit/add-resiliency-agent-tool

Saswata Pandit (psaswata) commented Oct 5, 2026 •

edited

Loading

Uh oh!

azure-pipelines Bot commented Oct 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Saswata Pandit (psaswata) commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Tool surface

Testing

Product evidence

GitHub issue number?

Pre-merge Checklist

Uh oh!

azure-pipelines Bot commented Oct 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Saswata Pandit (psaswata) commented Oct 5, 2026 •

edited

Loading