jonathan-vella/apex/apex-azure-resources

Azure Resources

Discover, inventory, and visualize existing Azure resources. Combines two related capabilities:

• Lookup mode — query and list resources (single type or cross-cutting via

Azure Resource Graph). Replaces the legacy azure-resource-lookup skill.

• Visualize mode — analyze a resource group and generate a detailed Mermaid

architecture diagram. Replaces the legacy azure-resource-visualizer skill.

Both modes share references/azure-resource-graph.md for KQL patterns.

Prerequisites

Confirm authorized subscription IDs and read access. Use installed Azure CLI with Resource Graph support or an available MCP tool; tool names below are routing hints, not proof of runtime availability. Installation requires authorization.

Mode A: Lookup

Use this mode when the user wants to list / find / show Azure resources.

When to Use Lookup

• List resources of any type (VMs, web apps, storage accounts, container apps, databases, etc.)
• Show resources in a specific subscription or resource group
• Query resources across multiple subscriptions or resource types
• Find orphaned resources (unattached disks, unused NICs, idle IPs)
• Discover resources missing required tags or configurations
• Get a resource inventory spanning multiple types
• Find resources in a specific state (unhealthy, failed provisioning, stopped)
• Answer "what resources do I have?" or "show me my Azure resources"
• List web apps, websites or App Services — there is no dedicated MCP list command for App

Service, so these prompts go to Azure Resource Graph

💡 Tip: For single-resource-type queries, first check if a dedicated MCP

tool can handle it (see routing table below). If none exists, use Azure

Resource Graph (ARG).

Quick Reference

MCP Tools

Rules

• Prefer dedicated MCP tools for single-resource-type queries (compute, storage, cosmos, etc.) before falling back to Azure Resource Graph
• Use ARG for cross-cutting queries — cross-subscription, cross-type, orphaned resources, tag audits
• Generate queries via `extension_cli_generate` — do not hand-author KQL when intent-based generation is available
• Shape output with `--query` JMESPath for tabular display; do not load raw JSON dumps into context
• Mode A is read-only — lookup never modifies resources; remediation is out of scope (use apex-azure-deploy)
• Mode B (Visualize) is for documentation — emit Mermaid only when the user explicitly asks for a diagram; do not auto-visualize lookup results
• No secrets in diagrams or inventories — represent keys, connection strings and Key Vault secrets with

placeholder names only; never copy values from app settings or outputs

• Out of scope: deploying resources (use apex-azure-deploy), cost optimization (use apex-azure-cost-optimization), security scanning (use apex-azure-compliance), troubleshooting (use apex-azure-diagnostics)

Lookup Workflow

Three-step procedure: (1) check for a dedicated MCP tool by resource type (compute / storage / cosmos / keyvault / sql / acr / aks / appservice / eventhubs / servicebus); (2) if no full-coverage tool, generate an Azure Resource Graph query via extension_cli_generate; (3) execute with --query JMESPath shaping. Full per-resource-type tool table and example commands in `references/lookup-workflow.md`.

Lookup Constraints

• ✅ Always use =~ for case-insensitive type matching (types are lowercase)
• ✅ Always scope queries with --subscriptions; --first limits rows, not authorization scope
• ✅ Prefer dedicated MCP tools for single-resource-type queries
• ❌ Never use ARG for real-time monitoring (data has slight delay)
• ❌ Never attempt mutations through ARG (read-only)

Lookup Error Handling

Mode B: Visualize

Use this mode when the user asks for a diagram of a resource group, or to understand how individual resources fit together.

When to Use Visualize

The user wants to:

• Create an architecture diagram of an existing resource group
• See how resources connect (VNets, private endpoints, identities, app settings)
• Document deployed infrastructure with embedded Mermaid

For the full Visualize-mode procedure (resource discovery, diagram construction, file creation, quality standards, constraints, edge cases, and output format), load [references/visualize.md](references/visualize.md).

Reference Index

Load these on demand — do NOT read all at once: