Skip to content
actionlake
Start free

Connectors · MSP & PSA

Azure Resource Graph MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Azure Resource Graph and the rest of your systems. It gives your agent 10 Azure Resource Graph actions (7 reads, 2 writes and 1 that wait for a confirmation) and holds the Azure Resource Graph credential itself, so the agent never does. It paces Azure Resource Graph's limits and records every call.

Connect Azure Resource Graph freeSee pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp
the first call
do {  action: "azure_resource_graph.subscriptions.list",  intent: "check which Azure Resource Graph account is connected"}# List the subscriptions the credential can see · read · 1 upstream call
  • 10actionsin one signed file
  • 7readlook, never change
  • 2writecreate and update
  • 1wait for a yesdestructive, confirmed first

Set up

Connect Azure Resource Graph in three steps.

  1. 01

    Add actionlake to Claude.

    Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.

    https://connect.actionlake.com/mcp
  2. 02

    Connect Azure Resource Graph.

    OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in. actionlake stores what you paste write-only, sealed under your tenant's key.

    • client_idEntra application (client) id of a service principal with Reader on the subscriptions or management groups to query
    • client_secretEntra client secret
    • tenant_idYour Azure Resource Graph tenant id
    account { op: "connections.requirements", service: "azure_resource_graph" }
# free: exactly what to paste, and what is found for you
  3. 03

    Make the first call. Check before a write.

    Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

    do    { action: "azure_resource_graph.subscriptions.list" }# list the subscriptions the credential can see · read · 1 upstream callcheck { action: "azure_resource_graph.graph_queries.update", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Azure Resource Graph at a glance

Sign-in
OAuth 2.0, client credentials. Paste the app's client id and secret; actionlake fetches and renews the token, and nobody has to sign in.
You provide
client_idclient_secret
Setup fields
tenant_id
Limits we pace to
15 calls per 5 seconds, per connection
API covered
Azure Resource Graph (KQL inventory across subscriptions, saved graph queries, resource history) API Azure Resource Manager Microsoft.ResourceGraph: resourcegraph.json (2024-04-01), graphquery.json (2024-04-01), resourceshistory.json (2021-06-01-preview)management.azure.com
Built from
Azure Resource Graph's documentation, read 23 October 2026OpenAPI spec (GitHub)learn.microsoft.com
Service file
Version 1.0.0, signed (Ed25519)
Cached reads
7 of 7 reads, for up to 5 minutes; a write clears what it affects
Shared entities
2, so ask can line Azure Resource Graph up with your other systems
Data
Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Azure Resource Graph.

10 actions in 5 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

  • 7readlook, never change
  • 2writecreate and update
  • 1destructivewait for a confirmation

  1. Graph queries

    6

    3 read · 2 write · 1 destructive

    List saved graph queries in a subscription · Get a saved graph query · Update a saved graph query · Delete a saved graph query

  2. Operations

    1

    1 read · 0 write · 0 destructive

    List the Resource Graph REST operations

  3. Resources

    1

    1 read · 0 write · 0 destructive

    Run a Resource Graph (KQL) query across subscriptions

  4. Resources history

    1

    1 read · 0 write · 0 destructive

    List snapshots of resources over a time interval (preview)

  5. Subscriptions

    1

    1 read · 0 write · 0 destructive

    List the subscriptions the credential can see

Top actions

The Azure Resource Graph API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 5 of Azure Resource Graph's 5 action names are shared with at least one other connector, so an agent learns them once.

ActionWhat it doesEffectSame name in
azure_resource_graph.graph_queries.list_by_subscriptionList saved graph queries in a subscriptionList saved graph queries in a subscription.readanalytics.saved_query.list10 connectors
azure_resource_graph.graph_queries.getGet a saved graph queryGet a saved graph query.readanalytics.saved_query.get9 connectors
azure_resource_graph.graph_queries.updateUpdate a saved graph queryUpdate a saved graph query.writeanalytics.saved_query.update9 connectors
azure_resource_graph.subscriptions.listList the subscriptions the credential can seeList the subscriptions the credential can see.readthis connector
azure_resource_graph.graph_queries.deleteDelete a saved graph queryDelete a saved graph query.destructiveanalytics.saved_query.delete10 connectors
azure_resource_graph.operations.listList the Resource Graph REST operationsList the Resource Graph REST operations.readthis connector
azure_resource_graph.graph_queries.create_or_updateCreate or replace a saved graph queryCreate or replace a saved graph query.writeanalytics.saved_query.upsert2 connectors

Try it

Prompts to paste into Claude.

Each one names the Azure Resource Graph actions it will call, so you know what it reads and what it changes before you send it.

  1. Readread

    List the subscriptions the credential can see in Azure Resource Graph and tell me what stands out.

    callsazure_resource_graph.subscriptions.list

  2. Writewrite

    Update a saved graph query in Azure Resource Graph. Show me exactly what you will send before you save it.

    callsazure_resource_graph.graph_queries.update

Governance for Azure Resource Graph

Destructive actions wait for a yes.

1 Azure Resource Graph action is destructive. This is it:

  • Delete a saved graph queryazure_resource_graph.graph_queries.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

doazure_resource_graph.graph_queries.deleteconfirm_policy: human

Delete a saved graph query?

intent: the user asked me to delete a saved graph query

run suspended · waiting for a named person · key azure-resource-graph-agent cannot confirm itself
In the console, or from an emailed signed link.
a key for this connector
account {  op: "keys.create", name: "azure-resource-graph-agent",  allowed_actions: ["azure_resource_graph.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "azure_resource_graph.graph_queries.delete", approver: "[email protected]" }  ]}
Illustrative. Scoped to Azure Resource Graph only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Azure Resource Graph costs on actionlake.

Every Azure Resource Graph action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Azure Resource Graph refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

  • 1upstream call per actionall 10 Azure Resource Graph actions
  • 4actions pageeach page of a long list is one call
  • 7reads can be cacheda cache hit costs nothing
  • 100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Azure Resource Graph action.

10 actions by area: the id your agent calls, what it does, and its effect.

Graph queries6
  • azure_resource_graph.graph_queries.create_or_updateCreate or replace a saved graph querywrite
  • azure_resource_graph.graph_queries.deleteDelete a saved graph querydestructive
  • azure_resource_graph.graph_queries.getGet a saved graph queryread
  • azure_resource_graph.graph_queries.listList saved graph queries in a resource groupread
  • azure_resource_graph.graph_queries.list_by_subscriptionList saved graph queries in a subscriptionread
  • azure_resource_graph.graph_queries.updateUpdate a saved graph querywrite
Operations1
  • azure_resource_graph.operations.listList the Resource Graph REST operationsread
Resources1
  • azure_resource_graph.resources.queryRun a Resource Graph (KQL) query across subscriptionsread
Resources history1
  • azure_resource_graph.resources_history.queryList snapshots of resources over a time interval (preview)read
Subscriptions1
  • azure_resource_graph.subscriptions.listList the subscriptions the credential can seeread

Questions

The Azure Resource Graph MCP server, answered.

Is there an Azure Resource Graph MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 10 Azure Resource Graph actions across graph queries, operations, resources and resources history, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Azure Resource Graph.

What do I need to connect Azure Resource Graph?

Entra application (client) id of a service principal with Reader on the subscriptions or management groups to query and Entra client secret. Plus your tenant id. The free call account { op: "connections.requirements", service: "azure_resource_graph" } lists exactly what to paste.

Can an AI agent delete or change things in Azure Resource Graph?

Only if its key allows it, and only with an explicit confirmation. 1 Azure Resource Graph action is destructive, including delete a saved graph query. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Azure Resource Graph API limit?

actionlake paces every call to the limits in the Azure Resource Graph service file: 15 calls per 5 seconds per connection. Repeated reads are answered from cache (7 Azure Resource Graph actions can be), which never reaches Azure Resource Graph.

What does an Azure Resource Graph action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (4 Azure Resource Graph actions page). Cache hits, searches, dry runs and calls Azure Resource Graph refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Azure Resource Graph API does it cover?

The Azure Resource Graph (KQL inventory across subscriptions, saved graph queries, resource history) API Azure Resource Manager Microsoft.ResourceGraph: resourcegraph.json (2024-04-01), graphquery.json (2024-04-01), resourceshistory.json (2021-06-01-preview) at management.azure.com. It is built from Azure Resource Graph's documentation as read on 23 October 2026. 10 actions in 5 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Azure Resource Graph data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Azure Resource Graph credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

More connectors like Azure Resource Graph

Shares the most action names with

Joins with, on shared entities

Browse

actionlake is independent. It is not made or endorsed by Azure Resource Graph; the name is the vendor's own. Counts are from the Azure Resource Graph service file, version 1.0.0.

Give your agent Azure Resource Graph today.

Connect Azure Resource Graph freeSee pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.