MI
CloudAI & ML

Microsoft Fabric Real-Time Intelligence MCP Server for Kusto

Accelerate real-time analytics with the Microsoft Fabric MCP server for Kusto, Eventhouse and Eventstreams using your favorite LLM models.

View on GitHub
Quick Install
npx -y @Microsoft/fabric-rti-mcp

Overview

The Microsoft Fabric Real-Time Intelligence (RTI) MCP Server for Kusto is a lightweight bridge that connects large language models (LLMs) to Microsoft Fabric services such as Kusto (Azure Data Explorer), Eventhouse and EventStreams. It implements the Model Context Protocol (MCP) to expose model-backed capabilities—natural language understanding, generation and streaming inference—tightly integrated with real-time analytics pipelines. The server enables developers to drive Kusto queries, enrich streaming events and produce explanations or summaries directly from model outputs.

This server is useful when you want to combine the expressiveness of LLMs with the high-throughput, low-latency analytics of Fabric components. Common scenarios include translating natural-language intent into Kusto Query Language (KQL), generating explanations for query results, enriching events before ingestion, or triggering automated actions based on model-driven reasoning in near real time.

Features

  • Connector to Kusto (Azure Data Explorer) for running and validating KQL queries
  • Integration with Eventhouse and EventStreams for ingesting and enriching streaming data
  • Pluggable model backends (OpenAI, Azure OpenAI, self-hosted LLM endpoints)
  • HTTP MCP API that supports synchronous and streaming responses
  • Request batching, caching and basic rate-limiting controls
  • Authentication and role-based access integration with Fabric/Azure credentials
  • Observability: structured logs and metrics for latency, throughput and error tracking
  • Configurable prompt templates and KQL safety checks to reduce risk of malformed queries

Installation / Configuration

Prerequisites:

  • A running Kusto (Azure Data Explorer) cluster and database
  • Access to Eventhouse or EventStreams if you plan to use streaming integration
  • API credentials for your LLM provider (OpenAI/Azure OpenAI or other)

Clone the repo and run with Docker:

git clone https://github.com/Microsoft/fabric-rti-mcp.git
cd fabric-rti-mcp
docker build -t fabric-rti-mcp .
docker run -p 8080:8080 \
  -e KUSTO_CLUSTER="https://<cluster>.<region>.kusto.windows.net" \
  -e KUSTO_DATABASE="mydb" \
  -e AZURE_CLIENT_ID="<client-id>" \
  -e AZURE_CLIENT_SECRET="<client-secret>" \
  -e AZURE_TENANT_ID="<tenant-id>" \
  -e OPENAI_API_KEY="<openai-key>" \
  fabric-rti-mcp

Example docker-compose (simplified):

version: "3.8"
services:
  mcp:
    image: fabric-rti-mcp:latest
    ports:
      - "8080:8080"
    environment:
      KUSTO_CLUSTER: "https://<cluster>.kusto.windows.net"
      KUSTO_DATABASE: "mydb"
      AZURE_CLIENT_ID: "<client-id>"
      AZURE_CLIENT_SECRET: "<client-secret>"
      AZURE_TENANT_ID: "<tenant-id>"
      OPENAI_API_KEY: "<openai-key>"

Configuration file (YAML) example:

server:
  port: 8080

kusto:
  cluster: "https://<cluster>.kusto.windows.net"
  database: "mydb"
  auth: "azure-msi"  # or client-credentials

models:
  default:
    provider: "azure-openai"
    engine: "gpt-4o"
    max_tokens: 1024

eventing:
  eventhouse_url: "https://<eventhouse-endpoint>"
  eventstreams_url: "https://<eventstreams-endpoint>"

Available Resources

  • GitHub repository: https://github.com/Microsoft/fabric-rti-mcp
  • Connectors:
    • Kusto (execute/read KQL)
    • Eventhouse (ingest/enrich)
    • EventStreams (publish/subscribe)
  • Model backends:
    • OpenAI / Azure OpenAI
    • Generic HTTP LLM endpoints (adapter-based)
  • Observability:
    • Prometheus-compatible metrics and structured logs

Use Cases

  1. Natural language to KQL

    • Scenario: A BI user asks “Show me the top 5 product categories by revenue this month.”
    • Flow: User sends prompt → MCP translates NL to KQL using a prompt template and safety checks → MCP runs the query against Kusto and returns results (optionally summarized by LLM).

    Example request (HTTP):

    curl -X POST http://localhost:8080/api/v1/execute \
  -H "Content-Type: application/json" \
  -d '{
    "model":"default",
    "type":"nl-to-kql",
    "prompt":"Top 5 product categories by revenue this month"
  }'

  2. Enrich streaming events before ingestion

    • Scenario: Add sentiment, intent, or a short summary to incoming user messages in Eventhouse.
    • Flow: Streaming message arrives → MCP invokes LLM enrichers → augmented event forwarded to Kusto/EventStreams for analytics.

  3. Explain anomalies in query results

    • Scenario: An alert fires when an anomaly is detected. Automatically generate a human-readable explanation.
    • Flow: MCP runs diagnostic KQLs and feeds the findings into an LLM prompt to produce an explanation included in the alert payload.

  4. Interactive dashboards with conversational queries

    • Scenario: Dashboard users type free-form questions; MCP maps questions to queries, executes them, and returns a narrative insight or chart metadata.

Security and Best Practices

  • Use least-privilege Azure AD credentials for Kusto and Eventhouse access.
  • Sanitize and validate generated KQL before execution (MCP provides safety hooks).
  • Limit model selection and token usage per tenant to control costs.
  • Enable logging and metrics for auditability and performance monitoring.

For developer setup, configuration examples and sample integrations, see the GitHub repository (link above) for source code, sample prompts and end-to-end demos.

Tags:ai-mlcloud