API Center private tool catalog to Foundry Toolbox

Optional implementation module ยท 180 minutes

Connect an approved remote MCP server in Azure API Center to a dedicated Toolbox, then run a
read-only check.

Control objective

Connect an approved remote MCP server in Azure API Center to a dedicated versioned Toolbox in
Microsoft Foundry.

Compare the catalog record, project connection, allowed tool, and live Toolbox tool list.

Azure API Center iconAzure API Center
Microsoft Foundry iconMicrosoft Foundry
Foundry Agent Service iconAgent consumers

Why it matters

Problem. Agent teams need one reusable, governed connection path for an approved MCP tool.

Solution. Toolbox provides a stable MCP-compatible endpoint without copying endpoint,
credential, and tool settings into every agent.

Current product path

  1. Azure API Center stores the approved MCP server record.
  2. Foundry Tools discovers the private catalog under Build > Tools.
  3. The operator configures the selected record as a project connection.
  4. Toolbox exposes a versioned, MCP-compatible endpoint for agent reuse.

The private tool catalog is public preview and the catalog handoff is portal-led.

Preflight decision

Proceed only when the named owner records the accepted preview and discovery decisions, the
selected API Center asset, version, and deployment, the Foundry project connection, and the
approved MCP tool name.

Stop if the record is missing, access has not propagated, or the catalog cannot represent the
approved authentication method.

Architecture and authority

Azure API Center icon1. Catalog
Approved MCP record and deployment
Microsoft Foundry icon2. Foundry Tools
Portal discovery and project connection
Foundry Agent Service icon3. Toolbox
Immutable version and stable consumer endpoint

Live state: API Center holds inventory, the project connection holds authentication, and the
Toolbox version holds tool exposure.

Catalog, Toolbox, and runtime boundary

Azure API Center discovery feeds a versioned Foundry Toolbox, while runtime tool authorization remains a separate control.

Implementation tradeoffs

Decision Route Limit
Catalog API Center private tool catalog Public preview; portal-led
Reuse New dedicated Toolbox Adds a managed object
Tool surface One allowed_tools entry Tool rename needs a new version
Approval always Agent runtime must enforce the prompt
Check Version-specific tools/list No remote tool call

Retained implementation

  • catalog-toolbox-binding.json links the approved catalog record to Foundry names and owners.
  • toolbox-version.json defines the MCP server, allowed tool, and approval requirement.
  • check_toolbox.py checks the immutable version without invoking the remote tool.
  • Paired preflight scripts stop when decisions remain unresolved, scope drifts, or a name collides.

No credential, token, tenant ID, endpoint, or tool result belongs in the repository.

Implementation path

  1. Complete the catalog record and Toolbox payload.
  2. Confirm the MCP server record in API Center under Build > Tools.
  3. Configure the project connection through the catalog flow.
  4. Run preflight.
  5. Create the first Toolbox version through the Foundry v1 data-plane API.
  6. Run tools/list against the version-specific endpoint.

Safety gates

  • Dedicated Toolbox name must be absent
  • Endpoint digest must match the approved API Center deployment
  • Project connection must exist in the intended Foundry project
  • Payload must contain one MCP object and one allowed tool
  • require_approval must be always
  • No fallback to an unreviewed custom MCP entry

Observable result

The version-specific Toolbox endpoint returns exactly:

<server_label>.<allowed_tool_name>

Its tool metadata reports:

require_approval = always

The check lists tools and leaves the remote operation untouched.

What remains in operation

Owner Responsibility
API catalog owner MCP server record in API Center, version, deployment, and access
Foundry tool owner Project connection, Toolbox versions, and default
Agent release owner Consumer endpoint and approval experience
MCP owner Runtime tool definition and MCP tool security controls

Restore route

  1. Move consuming agents away from the Toolbox endpoint.
  2. Check the implementationSession marker.
  3. Confirm the Toolbox still contains only this module's MCP connection.
  4. Delete the exact dedicated Toolbox through the approved Foundry change path.
  5. Remove the project connection only when no other consumer uses it.

Keep the MCP server record in API Center unless its owner separately retires the MCP server.

  • The governed-agent deployment manages agent release and endpoint consumption.
  • The API Center inventory holds the MCP server record.
  • The MCP security control governs authentication, tool safety, and runtime behavior.

This module configures only the connection from the catalog to Toolbox.

Thank you!

Notes: This module extends API Center and MCP inventory without changing the numbered sequence.

Notes: The catalog is the inventory source. Toolbox is the reusable runtime surface.

Notes: Keep this focused on the handoff from governed inventory to reusable consumption.

Notes: This is a real preview decision, not a footnote.

Notes: The repository files record the intended Toolbox configuration and the endpoint digest used to compare it with API Center. They do not store live credentials.

Notes: Catalog access lets the team find and configure the record. It does not authorize a runtime tool call.

Notes: Standard mode fits because the change and check are both narrow.

Notes: Filled artifacts stay in the approved private configuration store.

Notes: The first version of the new Toolbox becomes its default version.

Notes: A failed gate sends the issue to the API catalog, identity, or MCP control owner.

Notes: This confirms the intended connection without causing a business-side effect.

Notes: Reconcile after endpoint, authentication, tool-name, connection, or default-version changes.

Notes: No automatic removal script is shipped because consumers must be coordinated first.

Notes: The optional module adds no session number and changes no sequence dependency.