Azure API Center registry discovery for approved MCP servers

Chapter 5 of 6

Implement#

1. Complete the client and ownership records#

Resolve every __REQUIRED_*__ value in the approved private configuration path. Add one approvedServers entry for every server that passed the approved runtime control decision. Keep the approved names identical in both JSON files.

Run preflight:

$targetScope = "<approved API Center discovery scope alias>"
.\scripts\preflight.ps1 -TargetScope $targetScope

target_scope="<approved API Center discovery scope alias>"
./scripts/preflight.sh --target-scope "$target_scope"

2. Set the approved lifecycle stage#

In the Azure portal, open the approved API Center and select Inventory > Assets. Open every MCP server in the ownership record and set its approved version lifecycle to Production through the normal inventory change path.

Keep candidate servers at Design or Preview. Mark retired servers Deprecated before their next client discovery window.

3. Configure developer access#

Under Consumption > Portal settings, confirm that Microsoft Entra ID is configured and anonymous access is disabled. Confirm the developer group has Azure API Center Data Reader at the exact API Center resource scope.

This role controls access to visible data-plane records. The discovered MCP server's runtime authorization controls server and tool calls.

4. Configure Data API visibility#

Under Consumption > Data API settings, configure API visibility with the two built-in conditions recorded in registry-ownership.json. Use the portal preview to compare the visible MCP records with approvedServers.

Save the change only when every previewed MCP server name is approved and every approved name is present.

5. Configure the client path#

For Visual Studio Code, GitHub Copilot, or another registry-capable tool, map registry.endpoint into the client's current MCP registry setting. If the Azure API Center extension for Visual Studio Code is the chosen path, also provide the data-plane host, portal application client ID, and tenant ID from the approved configuration system.

Use only the documented API Center data-plane endpoint.

6. Check live discovery#

Have the approved OAuth credential helper place a short-lived token for the documented API Center data-plane delegated scope in the API_CENTER_ACCESS_TOKEN environment variable. The scripts read the token from the environment and do not print or retain it.

.\scripts\check-discovery.ps1

./scripts/check-discovery.sh

The scripts follow cursor pagination, compare returned server.name values with the ownership record, and avoid printing unexpected names.