diff --git a/.devcontainer/configure-mcp.mjs b/.devcontainer/configure-mcp.mjs index ab737480..3e9da3ff 100644 --- a/.devcontainer/configure-mcp.mjs +++ b/.devcontainer/configure-mcp.mjs @@ -15,7 +15,7 @@ const defaults = { "azure-mcp": { type: "stdio", command: "npx", - args: ["-y", "@azure/mcp@2.0.5", "server", "start"], + args: ["-y", "@azure/mcp@3.0.0", "server", "start"], env: { NPM_CONFIG_ALLOW_REMOTE: "all" }, }, }; diff --git a/.github/agents/05-iac-planner.agent.md b/.github/agents/05-iac-planner.agent.md index 5d3eeea4..cef58481 100644 --- a/.github/agents/05-iac-planner.agent.md +++ b/.github/agents/05-iac-planner.agent.md @@ -153,8 +153,8 @@ and the saved checkpoint; read only the predecessor sections the current phase n ## IaC Track Detection Run `apex-recall show --json` and check `decisions.iac_tool`; ask the user when it is unset. -`"Bicep"` uses the Bicep AVM metadata tools and patterns. `"Terraform"` uses the public Terraform Registry API -and Terraform patterns; no Terraform MCP server is required. +`"Bicep"` uses Bicep AVM metadata tools and patterns. `"Terraform"` uses Azure MCP `azureterraform` lookup +with the public Terraform Registry API as fallback and the AVM module index for existence; plus Terraform patterns. ## Read Skills First diff --git a/.github/agents/06t-terraform-codegen.agent.md b/.github/agents/06t-terraform-codegen.agent.md index a77a2aea..a29a4e90 100644 --- a/.github/agents/06t-terraform-codegen.agent.md +++ b/.github/agents/06t-terraform-codegen.agent.md @@ -322,15 +322,17 @@ For EACH resource in `04-iac-contract.json#resources[]` (canonical source; `04-implementation-plan.md` is the prose mirror): 1. Read the approved source and exact version from `04-iac-contract.json#modules.terraform[]`. -2. Query the public Terraform Registry API for that pinned module version; - inspect inputs, outputs, and linked source. No Terraform MCP server is required. +2. Retrieve the pinned module version's README with the Azure MCP `azureterraform` `avm get` command + (`--module-name`, `--module-version`); fall back to the public Terraform Registry API when the tool is + unavailable. Inspect inputs, outputs, and linked source. 3. Cross-check the approved pins and parameter types against the retrieved schema; flag mismatches using the AVM Known Pitfalls in the Terraform patterns skill. 4. Preserve the approved exact `X.Y.Z` module version. Do not replace it with a version range or select a newer release. An unavailable pin or required version change returns to the Planner under the existing plan-lock contract. -5. For non-AVM resources, verify arguments against the pinned provider's official - Registry documentation and `terraform providers schema -json` after isolated +5. For non-AVM resources, verify arguments against the pinned provider's documentation (Azure MCP + `azureterraform` `azurerm get` or `azapi get`, else the official Registry docs) and + `terraform providers schema -json` after isolated `terraform init -backend=false -input=false`. Do not infer missing schemas from memory. 6. Check region limitations 7. Save to `agent-output/{project}/04-preflight-check.md` diff --git a/.github/instructions/iac-terraform-best-practices.instructions.md b/.github/instructions/iac-terraform-best-practices.instructions.md index a1293378..9212863a 100644 --- a/.github/instructions/iac-terraform-best-practices.instructions.md +++ b/.github/instructions/iac-terraform-best-practices.instructions.md @@ -92,7 +92,7 @@ once, passed everywhere. | `>= 3.0` provider version range | Use `~> 4.0` major-series constraint | | Raw `azurerm_*` when AVM exists | Use AVM-TF modules or get approval | | `connection_string` auth | Use managed identity RBAC | -| AVM-TF `version = "~> X.Y"` | Use exact semver `version = "X.Y.Z"` — resolved live from `registry.terraform.io` at plan time | +| AVM-TF `version = "~> X.Y"` | Use exact semver `version = "X.Y.Z"` — resolved live from the AVM registry at plan time | ## Validation diff --git a/.github/skills/apex-azure-compliance/references/azure-quick-review.md b/.github/skills/apex-azure-compliance/references/azure-quick-review.md index b8db09fc..7d2324c2 100644 --- a/.github/skills/apex-azure-compliance/references/azure-quick-review.md +++ b/.github/skills/apex-azure-compliance/references/azure-quick-review.md @@ -8,6 +8,7 @@ This skill enables comprehensive Azure compliance assessments using Azure Quick - **Azure authentication** - Logged in via Azure CLI (`az login`) or using Service Principal/Managed Identity - **Reader permissions** - Minimum Reader role on target subscription or management group +- **azqr 3.0.0 or later on `PATH`** - Azure MCP 3.0.0 lists `extension_azqr` only when azqr is installed locally; without it, run `azqr scan --subscription ` directly ## Assessment Workflow diff --git a/.github/skills/apex-azure-cost-optimization/references/azure-quick-review.md b/.github/skills/apex-azure-cost-optimization/references/azure-quick-review.md index 4b24013a..e8f5ded0 100644 --- a/.github/skills/apex-azure-cost-optimization/references/azure-quick-review.md +++ b/.github/skills/apex-azure-cost-optimization/references/azure-quick-review.md @@ -25,7 +25,7 @@ excludeSections: Execute the scan using Azure MCP or CLI: ```powershell -# Via Azure MCP (preferred if available) +# Via Azure MCP (only listed when azqr 3.0.0 or later is installed locally) # Use the extension_azqr tool with subscription and optional resource-group parameters # Or via direct CLI: diff --git a/.github/skills/apex-azure-defaults/references/avm-modules.md b/.github/skills/apex-azure-defaults/references/avm-modules.md index d549b475..af3263a5 100644 --- a/.github/skills/apex-azure-defaults/references/avm-modules.md +++ b/.github/skills/apex-azure-defaults/references/avm-modules.md @@ -7,10 +7,17 @@ > > - **Bicep:** `curl -sf https://mcr.microsoft.com/v2/bicep/avm/res/{path}/tags/list` > → highest non-prerelease semver in `tags[]`. -> - **Terraform:** `curl -sf https://registry.terraform.io/v1/modules/Azure/avm-res-{path}/azurerm/versions` -> → first entry in `modules[0].versions[]`. -> - **Guidance:** Azure MCP provides Azure Terraform documentation and best -> practices; Registry metadata still comes from the public registry APIs. +> - **Terraform:** Azure MCP `azureterraform avm versions --module-name avm-res-{path}` lists versions; or +> `curl -sf https://registry.terraform.io/v1/modules/Azure/avm-res-{path}/azurerm/versions` +> → highest stable exact semver in `modules[0].versions[]` (the API is not sorted). +> - **Guidance:** Azure MCP provides Azure Terraform documentation, best practices, +> AVM module READMEs (`avm get`) and provider docs (`azurerm get`, `azapi get`). Use it +> only for modules the index lists as published. `avm versions` reports a module absent from the AVM list +> as `status: 400` with `results.type: "ArgumentException"` and "not found in available modules"; only that +> response means "unpublished". Any other status or error is a verification failure — stop and escalate, +> do not emit a raw-resource exception. `avm get` on an unknown version returns `status: 422` (HTTP 404), and +> `azurerm get` returns `status: 200` even for unknown types: empty `arguments` plus a "Documentation not +> found" `summary` means the resource type does not exist. > - **Validator:** `npm run validate:avm-versions:freeze` (planner agents > MUST call this before `apex-recall complete-step 4`). > diff --git a/.github/skills/apex-azure-defaults/references/terraform-conventions.md b/.github/skills/apex-azure-defaults/references/terraform-conventions.md index 6b2a0504..174dc163 100644 --- a/.github/skills/apex-azure-defaults/references/terraform-conventions.md +++ b/.github/skills/apex-azure-defaults/references/terraform-conventions.md @@ -9,11 +9,14 @@ Use one source for each concern: | Need | Source | | --- | --- | | Azure Terraform guidance | Azure MCP documentation and best-practice tools | -| Provider/module search and versions | Public Terraform Registry API | +| Provider docs and AVM module READMEs | Azure MCP `azureterraform` (`azurerm get`, `azapi get`, `avm get`) | +| Module versions | Azure MCP `azureterraform avm versions`, or the public Terraform Registry API | +| Provider versions and search | Public Terraform Registry API | | Initialized provider resource schemas | `terraform providers schema -json` | | Existing Azure resource IDs | Azure MCP resource tools or Azure CLI | -Resolve an AVM-TF module version directly from the Registry API: +Resolve an AVM-TF module version with the Azure MCP `azureterraform avm versions` command, or directly from +the Registry API: ```bash curl -sf https://registry.terraform.io/v1/modules/Azure/avm-res-{path}/azurerm/versions \ @@ -21,13 +24,11 @@ curl -sf https://registry.terraform.io/v1/modules/Azure/avm-res-{path}/azurerm/v | sort_by(split(".") | map(tonumber)) | last' ``` -The API does not return versions newest-first; always sort as above. - -Use `https://registry.terraform.io/v1/providers/{namespace}/{provider}/versions` +The API does not return versions newest-first; always sort as above (apply the same stable-semver +filter and sort to `avm versions` output). Use `https://registry.terraform.io/v1/providers/{namespace}/{provider}/versions` for provider versions with the same sort (`hashicorp/azurerm`, `hashicorp/random`, `Azure/azapi` — azapi is not under `hashicorp`). Run `terraform init` before -`terraform providers schema -json`. Do not claim Azure MCP exposes Terraform -Registry metadata. +`terraform providers schema -json`. Azure MCP does not list provider versions; use the Registry API for those. ## Tag Syntax (HCL) diff --git a/.github/skills/apex-azure-diagnostics/SKILL.md b/.github/skills/apex-azure-diagnostics/SKILL.md index aacf0030..87cd45b3 100644 --- a/.github/skills/apex-azure-diagnostics/SKILL.md +++ b/.github/skills/apex-azure-diagnostics/SKILL.md @@ -117,9 +117,11 @@ For AI-powered diagnostics, use: ``` mcp_azure-mcp_applens intent: "diagnose issues with " - command: "diagnose" + command: "applens_resource_diagnose" parameters: - resourceId: "" + resource: "" + question: "" + resource-group: "" Provides: - Automated issue detection @@ -134,9 +136,11 @@ For querying logs and metrics: ``` mcp_azure-mcp_monitor intent: "query logs for " - command: "logs_query" + command: "monitor_workspace_log_query" parameters: - workspaceId: "" + subscription: "" + workspace: "" + table: "" query: "" ``` diff --git a/.github/skills/apex-azure-diagnostics/references/aks/general-diagnostics.md b/.github/skills/apex-azure-diagnostics/references/aks/general-diagnostics.md index 563814ab..8f0d310f 100644 --- a/.github/skills/apex-azure-diagnostics/references/aks/general-diagnostics.md +++ b/.github/skills/apex-azure-diagnostics/references/aks/general-diagnostics.md @@ -45,12 +45,15 @@ For AI-powered diagnostics: ```text mcp_azure-mcp_applens intent: "diagnose AKS cluster issues" - command: "diagnose" + command: "applens_resource_diagnose" parameters: - resourceId: "/subscriptions//resourceGroups//providers/Microsoft.ContainerService/managedClusters/" + resource: "" + question: "diagnose AKS cluster issues" + resource-group: "" + resource-type: "Microsoft.ContainerService/managedClusters" ``` -> 💡 **Tip:** AppLens automatically detects common issues and provides remediation recommendations using the cluster resource ID. +> 💡 **Tip:** AppLens automatically detects common issues and provides remediation recommendations for the named cluster. --- diff --git a/.github/skills/apex-azure-validate/references/policy-validation.md b/.github/skills/apex-azure-validate/references/policy-validation.md index 69e2a95c..031a8710 100644 --- a/.github/skills/apex-azure-validate/references/policy-validation.md +++ b/.github/skills/apex-azure-validate/references/policy-validation.md @@ -17,7 +17,7 @@ az account show --query id -o tsv Call the Azure MCP Policy tool to retrieve policies for your subscription: ``` -mcp_azure-mcp_policy(command: "list", parameters: { subscription_id: "" }) +mcp_azure-mcp_policy(command: "policy_assignment_list", parameters: { subscription: "" }) ``` Replace `` with the actual subscription ID obtained from step 1. diff --git a/.github/skills/apex-iac-common/references/avm-module-index.md b/.github/skills/apex-iac-common/references/avm-module-index.md index 0fca4ce1..b78e9dd5 100644 --- a/.github/skills/apex-iac-common/references/avm-module-index.md +++ b/.github/skills/apex-iac-common/references/avm-module-index.md @@ -20,7 +20,9 @@ indexes** maintained by the Azure Verified Modules team. | `tools/scripts/_data/avm-module-cache.json` | Per-module version cache | MCR + `registry.terraform.io`, pre-warmed by the same refresh script | The refresh script keeps all four files current; there is no need to -hand-edit them. In consumer repositories the **Weekly Maintenance** +hand-edit them. Agents may use Azure MCP `azureterraform` (`avm versions`, `avm get`) for live Terraform +version and README lookup, but this index stays the source for module existence, lifecycle status and +resource-type mapping, and the cache stays pre-warmed by the refresh script. In consumer repositories the **Weekly Maintenance** template (`refresh-avm-module-index` job) runs it and opens a refresh PR. That template does not run in APEX: APEX maintainers run `npm run refresh:avm-module-index` manually at least monthly and before diff --git a/.github/skills/apex-iac-common/references/avm-version-freeze-gate.md b/.github/skills/apex-iac-common/references/avm-version-freeze-gate.md index d20529aa..61885aef 100644 --- a/.github/skills/apex-iac-common/references/avm-version-freeze-gate.md +++ b/.github/skills/apex-iac-common/references/avm-version-freeze-gate.md @@ -64,7 +64,8 @@ Re-resolve the latest stable version and update both the implementation plan and `04-iac-contract.json`: - Bicep: `curl -sf https://mcr.microsoft.com/v2/bicep/avm/res/{path}/tags/list` -- Terraform: `curl -sf https://registry.terraform.io/v1/modules/Azure/avm-res-{path}/azurerm/versions` +- Terraform: `curl -sf https://registry.terraform.io/v1/modules/Azure/avm-res-{path}/azurerm/versions`, + or Azure MCP `azureterraform avm versions --module-name avm-res-{path}` - Or use the corresponding MCP helpers. Re-run the validator until exit code 0. diff --git a/.github/skills/apex-terraform-patterns/SKILL.md b/.github/skills/apex-terraform-patterns/SKILL.md index ad9c8167..38d15236 100644 --- a/.github/skills/apex-terraform-patterns/SKILL.md +++ b/.github/skills/apex-terraform-patterns/SKILL.md @@ -34,7 +34,6 @@ Composable architecture building blocks for Azure Terraform. Complements | Plan Interpretation | Pre-deployment validation and change analysis | `references/plan-interpretation.md` | | AVM Pitfalls | Set-type diffs, provider pins, 4.x changes | `references/avm-pitfalls.md` | | Provider Compatibility | Why azurerm 4.x / Terraform 1.11 floors | `references/avm-provider-compatibility.md` | -| AVM Authoring | AVM certification requirements, compliance | `references/avm-authoring-requirements.md` | | Module Refactoring | Monolith → module extraction, state migration | `references/refactor-module.md` | --- @@ -43,8 +42,8 @@ Composable architecture building blocks for Azure Terraform. Complements Wire AVM child modules by passing outputs as inputs (`module..`); never hardcode IDs. **AVM-TF module versions in APEX-generated code MUST be exact semver -(`version = "X.Y.Z"`)** — pinned at plan time from -`registry.terraform.io` (newest stable in `modules[0].versions[]`). Range +(`version = "X.Y.Z"`)** — pinned at plan time to the newest stable release (Azure MCP +`azureterraform avm versions`, or `modules[0].versions[]` from `registry.terraform.io`). Range constraints (`~> X.Y`, `>= X.Y.Z`) are NOT allowed in `04-iac-contract.json` and will be flagged by `npm run validate:avm-versions`. Full code sample (resource group + key vault) and rationale in @@ -115,6 +114,5 @@ Applying a Terraform pattern in a root module: | `references/bootstrap-backend-template.md` | Backend bootstrap template | | `references/deploy-script-template.md` | Deployment script template | | `references/project-scaffold.md` | Project scaffolding structure | -| `references/avm-authoring-requirements.md` | AVM certification: 37 requirements, compliance checklist | | `references/refactor-module.md` | Module extraction, state migration, refactoring patterns | | `references/module-composition.md` | Canonical AVM module composition example with output wiring | diff --git a/.github/skills/apex-terraform-patterns/references/avm-authoring-requirements.md b/.github/skills/apex-terraform-patterns/references/avm-authoring-requirements.md deleted file mode 100644 index 6039470e..00000000 --- a/.github/skills/apex-terraform-patterns/references/avm-authoring-requirements.md +++ /dev/null @@ -1,218 +0,0 @@ - - -# Azure Verified Modules (AVM) — Authoring Requirements - -Mandatory requirements for AVM-certified Azure Terraform modules. -For runtime issues (set-type diffs, provider pins, 4.x changes) see `avm-pitfalls.md`. - -**References:** - -- [Azure Verified Modules](https://azure.github.io/Azure-Verified-Modules/) -- [AVM Terraform Requirements](https://azure.github.io/Azure-Verified-Modules/specs/tf) - ---- - -## Module Cross-Referencing (TFFR1) - -- Modules **MUST** be referenced using Terraform registry with pinned version: - `source = "Azure/xxx/azurerm"` with `version = "1.2.3"` -- **MUST NOT** use git references or non-AVM modules - -## Azure Provider Requirements (TFFR3) - -| Provider | Constraint | -| -------- | ---------- | -| azurerm | `~> 4.0` | -| azapi | `~> 2.0` | - -Authors **MAY** select either or both. **MUST** use `required_providers` block. - -## Code Style Standards - -### Lower snake_casing (TFNFR4) - -**MUST** use `lower_snake_casing` for: locals, variables, outputs, resources, modules. - -### Resource & Data Source Ordering (TFNFR6) - -Resources that are depended on **SHOULD** come first. - -### Count & for_each Usage (TFNFR7) - -- `count` for conditional creation -- `for_each` **MUST** use `map(xxx)` or `set(xxx)` with static literal keys - -```hcl -resource "azurerm_subnet" "pair" { - for_each = var.subnet_map # map(string) - name = "${each.value}-pair" - resource_group_name = azurerm_resource_group.this.name - virtual_network_name = azurerm_virtual_network.this.name - address_prefixes = ["10.0.1.0/24"] -} -``` - -### Block Internal Ordering (TFNFR8) - -1. **Top meta-arguments**: `provider`, `count`, `for_each` -2. **Arguments/blocks** (alphabetical): required → optional → nested blocks -3. **Bottom meta-arguments**: `depends_on`, `lifecycle` (`create_before_destroy`, `ignore_changes`, `prevent_destroy`) - -### Module Block Ordering (TFNFR9) - -1. `source`, `version`, `count`, `for_each` -2. Arguments (alphabetical) -3. `depends_on`, `providers` - -### Lifecycle ignore_changes (TFNFR10) - -**MUST NOT** quote: `ignore_changes = [tags]` not `["tags"]`. - -### Dynamic Blocks (TFNFR12) - -```hcl -dynamic "identity" { - for_each = var.identity_type != null ? [var.identity_type] : [] - content { - type = identity.value - } -} -``` - -### Default Values (TFNFR13) - -Prefer `coalesce()` over ternary for defaults. - -### Provider Declarations in Modules (TFNFR27) - -**MUST NOT** declare `provider` blocks in modules (except `configuration_aliases`). - -## Variable Requirements - -| Rule | ID | Severity | -| ---------------------------------------------------- | ------- | -------- | -| No `enabled`/`module_depends_on` variables | TFNFR14 | MUST | -| Order: required (alpha) then optional (alpha) | TFNFR15 | SHOULD | -| Positive feature switches (`xxx_enabled`) | TFNFR16 | SHOULD | -| All variables have `description` | TFNFR17 | SHOULD | -| All variables have precise `type` (avoid `any`) | TFNFR18 | MUST | -| Sensitive objects: whole variable `sensitive = true` | TFNFR19 | SHOULD | -| Collections: `nullable = false` | TFNFR20 | SHOULD | -| Avoid `nullable = true` unless semantic need | TFNFR21 | MUST | -| Never write `sensitive = false` | TFNFR22 | MUST | -| No default values for sensitive inputs | TFNFR23 | MUST | -| Deprecated vars → `deprecated_variables.tf` | TFNFR24 | MUST | - -## Output Requirements (TFFR2) - -- **SHOULD NOT** output entire resource objects (anti-corruption layer pattern) -- Output _computed_ attributes as discrete outputs -- Sensitive outputs: `sensitive = true` -- `for_each` resources: output as map structure -- Deprecated outputs → `deprecated_outputs.tf` - -```hcl -output "key_vault_id" { - description = "Resource ID of the Key Vault" - value = azurerm_key_vault.this.id -} - -output "subnet_ids" { - description = "Map of subnet names to IDs" - value = { - for key, value in azurerm_subnet.this : key => value.id - } -} -``` - -## Local Values (TFNFR31-33) - -- `locals.tf` **SHOULD** only contain `locals` blocks -- Expressions **MUST** be arranged alphabetically -- Use precise types - -## Terraform Configuration (TFNFR25-26) - -- `terraform.tf` **MUST** contain exactly one `terraform` block -- First line: `required_version` with `~> #.#` format -- `required_providers`: `source` + `version` for each, sorted alphabetically - -```hcl -terraform { - required_version = "~> 1.9" - required_providers { - azurerm = { - source = "hashicorp/azurerm" - version = "~> 4.0" - } - } -} -``` - -## Testing Requirements (TFNFR5) - -Required tools: `terraform validate`, `terraform fmt`, and `terraform test`. -Test provider: set `prevent_deletion_if_contains_resources = false` (TFNFR36). - -## Breaking Changes & Feature Management - -### Feature Toggles (TFNFR34) - -New resources in minor/patch versions **MUST** have a toggle: - -```hcl -variable "create_route_table" { - type = bool - default = false - nullable = false -} - -resource "azurerm_route_table" "this" { - count = var.create_route_table ? 1 : 0 - # ... -} -``` - -### Potential Breaking Changes (TFNFR35) - -**Resource blocks**: adding without conditional, arguments with non-default values, -nested blocks without `dynamic`, renaming without `moved`, changing `count`↔`for_each`. - -**Variable/Output blocks**: deleting/renaming, changing type/default/nullable/sensitive. - -## Documentation (TFNFR2) - -**MUST** use [terraform-docs](https://github.com/terraform-docs/terraform-docs) -with `.terraform-docs.yml` in module root. - -## Compliance Checklist - -### Module Structure - -- [ ] Registry references with pinned versions (no git refs) -- [ ] Azure providers meet version constraints -- [ ] `.terraform-docs.yml` present - -### Code Style - -- [ ] All names use lower snake_casing -- [ ] `for_each` uses `map()` or `set()` with static keys -- [ ] Block ordering follows TFNFR8/TFNFR9 -- [ ] Dynamic blocks for conditional nested objects -- [ ] `coalesce()`/`try()` for defaults - -### Variables & Outputs - -- [ ] Precise types, descriptions, no `any` -- [ ] Collections `nullable = false` -- [ ] No `sensitive = false`, no defaults for sensitive inputs -- [ ] Anti-corruption layer outputs (discrete attributes) -- [ ] Deprecated items in `deprecated_*.tf` - -### Quality - -- [ ] Feature toggles for new resources -- [ ] Breaking changes documented -- [ ] Required test tools configured - -**Total: 37 requirements (21 MUST, 14 SHOULD, 2 MAY)** diff --git a/.vscode/mcp.json b/.vscode/mcp.json index 830f8ddd..f108d458 100644 --- a/.vscode/mcp.json +++ b/.vscode/mcp.json @@ -16,7 +16,7 @@ "command": "npx", "args": [ "-y", - "@azure/mcp@2.0.5", + "@azure/mcp@3.0.0", "server", "start" ], diff --git a/tools/tests/exec-plans/active/azure-skills-plugin-alignment.md b/tools/tests/exec-plans/active/azure-skills-plugin-alignment.md index 889f523d..720a79c0 100644 --- a/tools/tests/exec-plans/active/azure-skills-plugin-alignment.md +++ b/tools/tests/exec-plans/active/azure-skills-plugin-alignment.md @@ -66,7 +66,7 @@ Checked 2026-09-23: `v1.2.51` is still the latest tag, `main` is unchanged since - **Coexistence**: `apex-` names avoid name collisions, and plugin skills appear as `/azure:`. APEX agents reference `apex-*` skills by explicit name or path, so workflow runs keep using APEX copies; free-form chats can load either set. -- **APEX Azure MCP coupling**: [mcp.json](../../../../.vscode/mcp.json) pins `@azure/mcp@2.0.5` and sets +- **APEX Azure MCP coupling**: [mcp.json](../../../../.vscode/mcp.json) pins `@azure/mcp@3.0.0` and sets `NPM_CONFIG_ALLOW_REMOTE=all` for the npm 12 feed. [configure-mcp.mjs](../../../../.devcontainer/configure-mcp.mjs) holds the defaults and release check, [validate-mcp-config.mjs](../../../../tools/scripts/validate-mcp-config.mjs) requires `servers.azure-mcp`, and @@ -473,7 +473,7 @@ The weekly drift report (#723) flagged seven pinned skills. Reviewed 2026-10-05 - No wholesale replacement, consistent with the recorded refresh rule. - No upstream pull requests; the drift report tracks convergence instead. -- Keep the `apex-azure-cost-optimization` and `apex-azure-rbac` names and the pinned `azure-mcp` 2.0.5 server. +- Keep the `apex-azure-cost-optimization` and `apex-azure-rbac` names and the pinned `azure-mcp` 3.0.0 server. - Left out from upstream: Kubernetes app deployment and AKS Automatic readiness; reliability live-change and IaC-patching guides; upgrade automation and Java; cloud-migrate deployment guides; prepare MCP templates, the root plan file, SQL grant scripts and automatic `azd up`; the cost attribution header and the `temp/` and `output/`