[Feature] fabric-sqlendpoint MCP server requires separate OAuth consent when an existing Azure AD session/token already works
- Dominant language
- C#
- Stars
- 3.7k
- Forks
- 624
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 220
Description
**Describe the bug**
This is a feature request. The `fabric-sqlendpoint` MCP server (providing `fabric-sqlendpoint-execute_query`, per the `sqldw-consumption-cli` skill) requires its own separate registration/OAuth consent before its tools become available. In an environment that already has an authenticated Azure AD session (e.g. via `az login`), this is an unnecessary extra step: a plain Azure AD access token for the `https://database.windows.net` audience, obtained from that same session, is sufficient to connect directly to a Fabric Lakehouse SQL analytics endpoint / Warehouse over TDS.
**Expected behavior**
`fabric-sqlendpoint` (or an equivalent lighter-weight tool) should be able to reuse an already-authenticated Azure identity's token for the `database.windows.net` audience, the same way other Fabric MCP tools in this same server family (`fabric-mcp-server`'s `core_*`/`datafactory_*`/`onelake_*` tools) already reuse the `api.fabric.microsoft.com`-audience token from the ambient session, rather than requiring its own independent consent/registration flow.
**Actual behavior / proof it's unnecessary**
When `fabric-sqlendpoint-execute_query` was unavailable in a given session (server not registered/consented), the same query capability was achieved directly with zero additional auth setup:
```powershell
$token = az account get-access-token --resource https://database.windows.net --query accessToken -o tsv
$conn = New-Object System.Data.SqlClient.SqlConnection
$conn.ConnectionString = "Server=;Database=;Encrypt=True;TrustServerCertificate=False;"
$conn.AccessToken = $token
$conn.Open()
# ... ExecuteReader / ExecuteScalar work immediately, no extra consent step
```
This connected successfully and queried a Lakehouse SQL analytics endpoint (88 tables, full row counts across all of them) using only credentials already available from `az login` -- the same credential source used for every other Fabric REST/OneLake call in the session.
**Reproduction Steps**
1. In a session with `fabric-sqlendpoint` MCP server not registered/consented, but with an active `az login` session
2. Attempt to use `fabric-sqlendpoint-execute_query` -- observe it's unavailable / requires separate setup per [mcp-setup/](../../mcp-setup/)
3. Instead, acquire a token via `az account get-access-token --resource https://database.windows.net` and connect directly via `SqlConnection.AccessToken` (or equivalent in another language) to the same SQL analytics endpoint -- observe it works immediately with no additional consent
**Environment**
- Fabric MCP Server / `fabric-sqlendpoint` data-plane MCP server
- Windows 11, Azure CLI (`az`) authenticated session
Contributor guide
Assessment
This issue has not been assessed yet.