Model Context Protocol (MCP) from REST API lab

Why it matters

API Management can put one governed front door before many MCP servers, so access, traffic and monitoring are set in one place instead of in each tool.

What to practise

Deploy the notebook’s Bicep: API Management, weather, product catalog and place-order REST APIs exposed as MCP servers, a pass-through to the Microsoft Learn MCP server, API Center and an MCP insights workbook. List tools, optionally with MCP Inspector over Streamable HTTP, then call them from an OpenAI agent, a Foundry agent and LangChain. The notebook still uses the earlier name Azure AI Foundry. Watch rate-limit-by-key, counted per client IP, throttle the pass-through, and validate-jwt return 401 without a valid token and admit the call with one.

How it fits

This is 2.3.7: compare REST-to-MCP exposure with pass-through. Ask which policy admits the client, which limits traffic, and what credential the backend would need, since 2.3.7 keeps all three separate. Then ask whether a per-IP counter is the partition you want.