1# AKS MCP Reference
2 
3Use this reference when AKS-aware MCP tools are available in the client.
4 
5## Preference Order
6 
71. `mcp_azure_mcp_aks`
82. The AKS-MCP tools that surface after discovery in the client
93. Supporting Azure tools such as `mcp_azure_mcp_applens`, `mcp_azure_mcp_monitor`, and `mcp_azure_mcp_resourcehealth`
104. Raw `az aks` and `kubectl` only when required functionality is missing from MCP
11 
12## Happy Path
13 
14After selecting `mcp_azure_mcp_aks`, let the client enumerate the exact AKS-MCP tools it exposes and choose the smallest tool that fits the task.
15 
16Favor the obvious read paths first:
17 
18- cluster and Azure-side inspection
19- detector or diagnostic workflows
20- monitoring, metrics, or control-plane-log checks
21- kubectl-style read operations
22 
23## Authentication And Access
24 
25AKS-MCP is Azure CLI-backed. Expect service principal, workload identity, managed identity, or existing `az login` auth, usually keyed by `AZURE_CLIENT_ID`. If `AZURE_SUBSCRIPTION_ID` is set, expect the server to select that subscription after login.
26 
27Default to `readonly`. Only suggest `readwrite` or `admin` when the current diagnostic step truly requires it.
28 
29## Detector Notes
30 
31For detector-style workflows, use the cluster resource ID, keep the time window within the last 30 days, cap each run to 24 hours, and stay within the supported AKS detector categories.
32 
33## Fallback Rule
34 
35If the client does not expose the AKS-MCP surface needed for a check, then fall back to:
36 
37- `az aks` for Azure-side AKS operations
38- raw `kubectl` for Kubernetes-side inspection
39