
Artificial Intelligence is changing how we build software, but it also introduces brand new security risks. If you're a developer or security professional stepping into the world of AI, how do you make sure your applications are safe?
We've just published a new course on the freeCodeCamp YouTube channel that will teach you how to build security into AI. The course was created by security expert Robert Herbig.
Here’s a quick look at what you'll learn:
AI vs. Traditional App Security: Understand why securing an AI model isn't the same as securing a standard web app.
Threat Modeling for AI: Learn how to identify potential weaknesses in your AI systems, from poisoned training data to supply chain attacks.
Input & Output Risks: Dive into specific attack vectors like prompt injection and adversarial examples, and learn how to prevent sensitive data leaks.
As Robert says, "Security must be a foundational layer in AI development, not an afterthought."
“The factory of the future will have only two employees, a man and a dog. The man will be there to feed the dog. The dog will be there to keep the man from touching the equipment.” – Warren G. Bennis
The first piece of software I ever sold was to a local hardware store.
I can still remember the smell of that place: a mix of sawdust, metal, and paint thinner. Their inventory was a glorious, chaotic mess, tracked on paper and by the owner’s memory. He needed a better way.
So, we (me and a high-school friend) built him one. A simple CRUD app in Visual FoxPro. It wasn’t pretty. It probably had more bugs than a summer night the beach of San Blas, Mexico. But it worked. Seeing the owner use it for the first time, seeing his relief as he could finally track his nuts, bolts, and screws—was a revelation. I had taken a real-world problem and solved it with nothing but a keyboard and my brain.
That feeling is why I fell in love with coding. It’s a mix of craft, art, and mastery.
And it’s that feeling that has me thinking about our future.
Then, a few weeks ago, I stumbled upon a mesmerizing ASMR video of a master woodworker making tiles. This guy wasn’t just making tiles; he was conducting a symphony of efficiency. He felled a tree, milled the wood, and meticulously shaped each piece, transforming raw timber into a perfect stack. Every movement was precise, honed by years of practice to maximize his materials and work with incredible speed.
I saw myself in him. I saw that kid in the hardware store, wrestling with Visual FoxPro. It was the same spark.
That video was a lightbulb moment. One day, coding by hand with nothing but a reference book will be seen just like that—a beautiful craft, a hobby, maybe even a performance art. But building commercial apps? That’s going to be a different beast entirely, just like manufacturing tiles is different from that woodworker’s art. The designers and builders will still be essential, but their jobs will be unrecognizable. The skills they need will have shifted dramatically.
Carpentry wasn’t eliminated, just as grocery cashiers haven’t completely disappeared. But their jobs have evolved. Cashiers now often manage inventory, handle customer relations, and even recognize theft patterns. Woodworkers now need to understand industrial design, LEAN techniques, and how to operate sophisticated equipment. The fundamentals remain, knowledge of wood, materials, and problem-solving, just as software engineering will always require a grasp of its core principles.
There will always be a human in the loop. But this human is not just a passive observer, like the man watching the dog. They will be a master of system design, a strategic thinker with a deeper understanding of the entire process. AI will augment their capabilities, not replace them.
The whole “Gen-AI will replace coders” panic feels like déjà vu. Remember 15 years ago? Every car manufacturer and hotshot startup was promising fully autonomous driving in 3-5 years. Sound familiar? It’s the same breathless hype we’re hearing from some AI CEOs today, talking about replacing coders in six months or a “single-digit number of years.” Well, 15 years later, Waymo is still getting stumped by a chaotic street protest. The auto industry was absolutely disrupted—we got amazing cruise control and semi-autonomous features out of it—but it wasn’t the total revolution we were sold. The software engineering industry has been disrupted too, but it’s going to need a human in the driver’s seat for many years to come.
The question is, what kind of humans will be needed? It’s time to prepare and upskill in the areas that will position you to be the one who matters.
As for me, I imagine a future where we look back at coders who worked without Gen-AI, using only a reference manual, as artisans. Perhaps they’ll have YouTube channels, and people will watch in awe as they create a fun application without a search engine or a copilot. It will be a fascinating glimpse into a lost art.
And maybe, just maybe, some kid will be in a local shop, see a problem, and feel that same spark I did in that hardware store all those years ago.
We’ve been talking a lot about the Model Context Protocol (MCP) lately, including recent blog posts and sessions at Microsoft Build. In this post, I’d like to share some top tips for how you can use MCP servers we’ve been building to improve your developer productivity.
What’s the experience like? If you’ve never used an MCP server, imagine chatting with GitHub Copilot in VS Code or Visual Studio and being able to say “check the status of my Azure storage accounts” or “create a GitHub issue for this bug I found” – and having it actually connect to those services and perform those actions. MCP servers give your AI assistant real-time access to external tools and data sources, turning it from a code generator into a productivity powerhouse that can interact with your entire development ecosystem.
What makes MCP particularly exciting is that it’s becoming an enterprise-wide standard that enables true vendor interoperability. Companies like Figma, Notion, Linear, Atlassian, Zapier, Stripe, PayPal, Square, MongoDB, Neon, and many others have built MCP servers that all work seamlessly together through the same standardized protocol. This means you can mix and match tools from different vendors in your AI workflow by leveraging the open standard.
Across our teams at Microsoft and GitHub, we’ve been both building and using MCP servers extensively, and we’re constantly sharing discoveries and tips with each other. Here are 10 MCP servers that Microsoft has built that we’ve found particularly useful in our daily work – tools that solve real problems and speed up common development tasks. This isn’t a comprehensive ranking, but rather a practical guide based on our team’s experience with these servers in real-world scenarios.
I’ll include some info on how to get these set up at the end of this post. For now, focus the way these improve your developer productivity, for instance:
azd
and az
CLI switches), you can just describe what you want and let the AI capabilities in your MCP host sort that out for you.Tip
For an overview on what MCPs are and why they’re such a big deal, check out Maria Naggaga’s post: Connect Once, Integrate Anywhere with MCP. And for ready-to-use customizations that work great with MCP servers, explore the Awesome GitHub Copilot Customizations repository.What it does: The Microsoft Learn Docs MCP Server is a cloud-hosted service that provides AI assistants with real-time access to official Microsoft documentation through the Model Context Protocol. It connects to https://learn.microsoft.com/api/mcp
and enables semantic search across Microsoft Learn, Azure documentation, Microsoft 365 documentation, and other official Microsoft sources.
Why it’s useful: While it may seem like “just documentation,” this server is actually crucial for every developer using Microsoft technologies. One of the biggest complaints from .NET developers about AI coding assistants is that they’re not up to date on the latest .NET and C# releases. The Microsoft Learn Docs MCP Server solves this by providing real-time access to the most current documentation, API references, and best practices. Whether you’re working with the latest Azure SDKs, exploring new C# 13 features, or implementing cutting-edge .NET Aspire patterns, this server ensures your AI assistant has access to the authoritative, up-to-date information it needs to generate accurate, modern code.
Real-world use: “What are the az cli commands to create an Azure container app according to official Microsoft Learn documentation?” or “How do I configure Entity Framework with dependency injection in ASP.NET Core?” Or how about “Review this code to make sure it matches the performance recommendations in the Microsoft Learn Documentation.” The server provides comprehensive coverage across Microsoft Learn, Azure docs, and Microsoft 365 documentation using advanced semantic search to find the most contextually relevant information. It returns up to 10 high-quality content chunks with article titles and URLs, always accessing the latest Microsoft documentation as it’s published.
Featured example: The server exposes the microsoft_docs_search
tool that performs semantic search against Microsoft’s official technical documentation. Once configured, you can ask questions like “How do I implement JWT authentication in ASP.NET Core?” and get detailed, official responses with source links. The search quality is exceptional because it understands context – asking about “containers” in an Azure context will return Azure Container Instances documentation, while the same term in a .NET context returns relevant C# collection information.
This is especially useful for rapidly changing or recently updated libraries and use cases. For instance, in some recent coding projects I wanted to leverage features in the latest releases of .NET Aspire and Microsoft.Extensions.AI. By including the Microsoft Learn Docs MCP server, I was able to leverage not just API docs, but walkthroughs and guidance that had just been published.
Pro Tip
Even tool-friendly models need encouragement to use MCP tools! Consider adding a system prompt or copilot-instructions.md like: “You have access tomicrosoft.docs.mcp
– use this tool to search Microsoft’s latest official documentation when handling questions about Microsoft technologies like C#, Azure, ASP.NET Core, or Entity Framework.”
For a great example of this in action, check out the C# .NET Janitor chat mode from the Awesome GitHub Copilot repository. This mode specifically leverages the Microsoft Learn Docs MCP server to help clean up and modernize C# code using the latest patterns and best practices.
What it does: The Azure MCP Server is a comprehensive suite of 15+ specialized Azure service connectors that brings the entire Azure ecosystem into your AI workflow. This isn’t just a single server – it’s a powerful collection that includes resource management, database connectivity (PostgreSQL, SQL Server), Azure Monitor log analysis with KQL, Cosmos DB integration, and much more.
Why it’s useful: Beyond just managing Azure resources, this server dramatically improves code quality when working with Azure SDKs. When you use Azure MCP in Agent mode, it doesn’t just help you write code – it helps you write better Azure code that follows current authentication patterns, error handling best practices, and leverages the latest SDK features. Instead of getting generic code that might work, you get code that follows Azure’s recommended patterns for production workloads.
Key modules include:
Real-world use: “List my Azure storage accounts”, “Query my Log Analytics workspace for errors in the last hour”, or “Help me build an Azure application using Node.js with proper authentication”
Full demo scenario: Here’s a complete walkthrough that shows the power of combining Azure MCP with GitHub Copilot for Azure extension in VS Code. When you have both installed and prompt:
“Create a Python script that uploads a file to Azure Blob Storage using DefaultAzureCredential authentication. The script should connect to my Azure storage account named ‘mycompanystorage’, upload to a container named ‘documents’, create a test file with the current timestamp to upload, handle errors gracefully and provide informative output, follow Azure best practices for authentication and error handling, include comments explaining how the DefaultAzureCredential authentication works, and make the script well-structured with proper functions and documentation.”
The Azure MCP Server will generate a complete, production-ready Python script that:
What makes this remarkable is that without the Azure MCP, you might get generic blob storage code that works but doesn’t follow current Azure patterns. With Azure MCP, you get code that leverages the latest authentication methods, handles Azure-specific error scenarios, and follows Microsoft’s recommended practices for production applications.
Featured example: I’ve struggled with remembering the specific commands for the az
and azd
CLIs for ad-hoc use. It’s always a two-step process for me: first look up the syntax, then run the command. I’ll often just pop into the portal and click around to get work done because I don’t want to admit I can’t remember CLI syntax. Being able to just describe what I want is amazing, and even better to be able to do that without leaving my IDE!
There’s a great list of use cases in the Azure MCP repository to get you started. For comprehensive setup guides and advanced configuration options, check out the official Azure MCP documentation.
Coming Soon
We’ll be doing a deep dive into the Azure MCP Server in a follow-up blog post, exploring advanced scenarios, multi-service workflows, and power-user tips for maximizing your Azure development productivity.What it does: The official GitHub MCP Server provides seamless integration with GitHub’s entire ecosystem, offering both hosted remote access and local Docker deployment options. This isn’t just about basic repository operations – it’s a comprehensive toolkit that includes GitHub Actions management, pull request workflows, issue tracking, security scanning, notifications, and advanced automation capabilities.
Why it’s useful: This server transforms how you interact with GitHub by bringing the full platform experience directly into your development environment. Instead of constantly switching between VS Code and GitHub.com for project management, code reviews, and CI/CD monitoring, you can handle everything through natural language commands while staying focused on your code.
Note: Different Types of 'Agents'
Don’t confuse this GitHub MCP Server with GitHub’s Coding Agent (the AI agent you can assign issues to for automated coding tasks). The GitHub MCP Server works within VS Code’s Agent mode to provide GitHub API integration, while GitHub’s Coding Agent is a separate feature that creates pull requests when assigned to GitHub issues.Key capabilities include:
Real-world use: “Create a pull request from my feature branch”, “Show me all failed CI runs this week”, “List open security alerts for my repositories”, or “Find all issues assigned to me across my organizations”
Full demo scenario: Here’s a powerful workflow that demonstrates the GitHub MCP Server’s capabilities:
“I need to prepare for our sprint review. Show me all pull requests I’ve created this week, check the status of our CI/CD pipelines, create a summary of any security alerts we need to address, and help me draft release notes based on merged PRs with the ‘feature’ label.”
The GitHub MCP Server will:
Featured example: I love using this for code review workflows. Instead of jumping between VS Code, GitHub notifications, and pull request pages, I can say “Show me all PRs waiting for my review” and then “Add a comment to PR #123 asking about the error handling in the authentication method.” The server handles the GitHub API calls, maintains context about the discussion, and even helps me craft more constructive review comments.
Authentication options: The server supports both OAuth (seamless in VS Code) and Personal Access Tokens, with configurable toolsets to enable only the GitHub functionality you need. You can run it as a remote hosted service for instant setup or locally via Docker for complete control.
Pro Tip
Enable only the toolsets you need by configuring the--toolsets
parameter in your MCP server settings to reduce context size and improve AI tool selection. For example, add "--toolsets", "repos,issues,pull_requests,actions"
to your MCP configuration args for core development workflows, or use "--toolsets", "notifications, security"
if you primarily want GitHub monitoring capabilities.What it does: Connects to Azure DevOps services for comprehensive project management, work item tracking, build pipeline management, and repository operations.
Why it’s useful: For teams using Azure DevOps as their primary DevOps platform, this MCP server eliminates the constant tab-switching between your development environment and Azure DevOps web interface. You can manage work items, check build statuses, query repositories, and handle project management tasks directly from your AI assistant.
Real-world use: “Show me all active work items in the current sprint for the WebApp project”, “Create a bug report for the login issue I just found”, or “Check the status of our build pipelines and show me any recent failures”
Featured example: You can easily check the status of your team’s current sprint with a simple query like “Show me all active work items in the current sprint for the WebApp project” or “Create a bug report for the login issue I just found” without leaving your development environment.
What it does: MarkItDown is a comprehensive document conversion server that transforms various file formats into high-quality Markdown, optimized for LLM consumption and text analysis workflows.
Why it’s useful: Essential for modern documentation workflows! MarkItDown handles an impressive range of file formats while preserving critical document structure like headings, lists, tables, and links. Unlike simple text extraction tools, it focuses on maintaining semantic meaning and formatting that’s valuable for both AI processing and human readability.
Supported file formats:
Advanced capabilities: MarkItDown supports LLM-powered image descriptions (when provided with an OpenAI client), Azure Document Intelligence for enhanced PDF processing, audio transcription for speech content, and a plugin system for extending to additional file formats.
Real-world use: “Convert this PowerPoint presentation to Markdown for our documentation site”, “Extract text from this PDF with proper heading structure”, or “Transform this Excel spreadsheet into a readable table format”
Featured example: To quote the MarkItDown docs:
Markdown is extremely close to plain text, with minimal markup or formatting, but still provides a way to represent important document structure. Mainstream LLMs, such as OpenAI’s GPT-4o, natively “speak” Markdown, and often incorporate Markdown into their responses unprompted. This suggests that they have been trained on vast amounts of Markdown-formatted text, and understand it well. As a side benefit, Markdown conventions are also highly token-efficient.
MarkItDown is really good at preserving document structure, which is important for AI workflows. For instance, when converting a PowerPoint presentation, it keeps slide organization with the right headings, extracts tables as Markdown tables, includes alt text for images, and even processes the speaker notes. Charts get converted to readable data tables, and the resulting Markdown maintains the logical flow of the original presentation. This makes it perfect for feeding presentation content into AI systems or creating documentation from existing slides.
What it does: Provides conversational access to SQL Server databases (on-premises, Azure SQL, or Fabric)
Why it’s useful: Similar to PostgreSQL server but for the Microsoft SQL ecosystem. Connect with a simple connection string and start querying with natural language – no more context switching!
Real-world use: “Find all orders that haven’t been fulfilled in the last 30 days” gets translated to appropriate SQL queries and returns formatted results
Featured example: Once you set up your database connection, you can start having conversations with your data immediately. The blog post shows this off with a simple question: “which database are you connected to?” The MCP server responds by invoking the appropriate database tool, connecting to your SQL Server instance, and returning details about your current database connection – all without writing a single line of SQL. The server supports comprehensive database operations from schema management to data manipulation, all through natural language prompts. For complete setup instructions and configuration examples with VS Code and Claude Desktop, see: Introducing MSSQL MCP Server (Preview).
What it does: Enables AI agents to interact with web pages for testing and automation
Powering GitHub Copilot
The Playwright MCP Server powers GitHub Copilot’s Coding Agent, giving it web browsing capabilities! Learn more about this feature.Why it’s useful: Perfect for automated testing driven by natural language descriptions. AI can navigate websites, fill forms, and extract data through structured accessibility snapshots – this is incredibly powerful stuff!
Real-world use: “Test the login flow and verify that the dashboard loads correctly” or “Generate a test that searches for products and validates the results page” – all without needing the application’s source code
Featured example: My teammate Debbie O’Brien has been doing amazing work with the Playwright MCP Server lately! For example, she recently showed how you can generate complete Playwright tests without even having access to the application’s source code. In her scenario, she asked Copilot to create a test for a movie search app: navigate to the site, search for “Garfield,” and verify the movie appears in results. The MCP spun up a browser session, explored the page structure using DOM snapshots, figured out the right selectors, and generated a fully working TypeScript test that passed on the first run.
What makes this really powerful is that it bridges the gap between natural language instructions and executable test code. Traditional approaches require either manual test writing or access to the codebase for context. But with Playwright MCP, you can test external sites, client applications, or work in black-box testing scenarios where code access isn’t available.
What it does: Manages Microsoft Dev Box environments through natural language
Why it’s useful: Simplifies development environment management tremendously! Create, configure, and manage development environments without remembering specific commands.
Real-world use: “Set up a new Dev Box with the latest .NET SDK and configure it for our project”, “Check the status of all my development environments”, or “Create a standardized demo environment for our team presentations”
Featured example: I’m a big fan of using Dev Box for personal development. My lightbulb moment here was when James Montemagno explained how great Dev Box is for conference demos, since it’s got a super-fast ethernet connection regardless of the conference / hotel / airplane wifi I may be using at the moment. In fact, I recently did some conference demo practice while my laptop was tethered to my phone hotspot while riding on a bus from Bruges to Antwerp! But my next step here is to dig into more team managing multiple development environments and standardized demo environments. And another big use case I’ve been hearing from customers and coworkers, of course, is using Dev Box for preconfigured development environments. In both cases, using an MCP to configure and manage Dev Boxes lets you use natural language interaction, all while staying in your development environment.
What it does: The Azure AI Foundry MCP Server provides developers with comprehensive access to Azure’s AI ecosystem, including model catalogs, deployment management, knowledge indexing with Azure AI Search, and evaluation tools. This experimental server bridges the gap between AI development and Azure’s powerful AI infrastructure, making it easier to build, deploy, and evaluate AI applications.
Why it’s useful: This server transforms how you work with Azure AI services by bringing enterprise-grade AI capabilities directly into your development workflow. Instead of switching between the Azure portal, documentation, and your IDE, you can discover models, deploy services, manage knowledge bases, and evaluate AI performance through natural language commands. It’s particularly powerful for developers building RAG (Retrieval-Augmented Generation) applications, managing multi-model deployments, or implementing comprehensive AI evaluation pipelines.
Key developer capabilities:
Real-world developer use: “Deploy a Phi-4 model to Azure AI Services for my application”, “Create a new search index for my documentation RAG system”, “Evaluate my agent’s responses against quality metrics”, or “Find the best reasoning model for my complex analysis tasks”
Full demo scenario: Here’s a powerful AI development workflow:
“I’m building a customer support agent. Help me find a good reasoning model from the catalog, deploy it to Azure AI Services, create a knowledge base from our documentation, set up an evaluation framework to test response quality, and then help me prototype the integration with GitHub token for testing.”
The Azure AI Foundry MCP Server will:
Featured example: As a developer, I’ve struggled to keep up with the different LLM models available. I know a few main ones, but have been feeling like I’m missing out on some productivity and efficiency gains. And tokens and quotas are stressful and tough to manage – I never know if I’m picking the right model for the right task or burning through my budget inefficiently. I just heard about this MCP Server from James Montemagno when checking around with teammates for MCP Server recommendations for this post, and I’m excited to put it to use! The model discovery capabilities look particularly impressive for someone like me who wants to explore beyond the usual suspects and find models that are optimized for specific tasks. The evaluation framework should help me validate that I’m actually getting better results, not just trying something new for the sake of it.
Experimental Status
This MCP server is experimental and under active development. Features and APIs may change. Perfect for exploring Azure AI capabilities and building prototypes, but validate stability requirements for production use.What it does: Provides developers with essential tools for building AI agents and applications that integrate with Microsoft 365 and Microsoft 365 Copilot, including schema validation, sample code retrieval, and troubleshooting assistance.
Why it’s useful: Building for Microsoft 365 and Copilot involves complex manifest schemas and specific development patterns. This MCP server brings essential development resources directly into your coding environment, helping you validate schemas, find sample code, and troubleshoot common issues without constantly referencing documentation.
Real-world use: “Validate my declarative agent manifest and fix any schema errors”, “Show me sample code for implementing a Microsoft Graph API plugin”, or “Help me troubleshoot my Teams app authentication issues”
Featured example: I reached out to my friend John Miller after chatting with him at Build about M365 Agents, and he recommended this MCP. This could be great for developers new to M365 Agents since it provides templates, sample code, and scaffolding to get started without drowning in documentation. The schema validation features look particularly useful for avoiding manifest structure errors that can cause hours of debugging.
Pro Tip
Use this server alongside the Microsoft Learn Docs MCP Server for comprehensive M365 development support – one provides the official documentation while this one offers practical development tools and troubleshooting assistance.Setting up these MCP servers is straightforward if you’re using Visual Studio Code or Visual Studio 2022 with GitHub Copilot.
Here’s the basic process for VS Code:
For detailed setup instructions, see the VS Code MCP documentation.
Pro Tip: Manage MCP Servers like a pro!
The VS Code Extensions view now includes a handy new UI to manage installed MCP Servers! You’ve got quick access to start, stop, and manage any installed MCP Servers using a clear, simple interface. Try it out!For Visual Studio 2022 (version 17.14 or later):
.mcp.json
file in your solution directory (recommended location: <SOLUTIONDIR>\.mcp.json
)For detailed Visual Studio setup instructions, see the Visual Studio MCP documentation.
Each MCP server comes with its own configuration requirements (connection strings, authentication, etc.), but the setup pattern is consistent across both IDEs.
The MCP ecosystem is growing rapidly! Microsoft and the broader community are actively developing new servers and improving existing ones. Keep an eye on the official Microsoft MCP repository for updates and new server releases.
The Power of an Open Standard: What makes MCP truly transformative is that it’s an enterprise-wide standard that enables genuine vendor interoperability. You’re not limited to just Microsoft’s MCP servers – you can seamlessly integrate tools from dozens of leading technology companies. Mix Microsoft’s Azure MCP with GitHub’s repository management, add Notion for documentation, Linear for project tracking, Stripe for payment processing, and MongoDB for database operations – all working together through the same standardized protocol. This vendor-neutral approach means you can build the exact workflow that fits your team’s needs without being locked into any single ecosystem.
If you’re building your own tools or have specific data sources you work with regularly, consider creating a custom MCP server. The standardized protocol makes it much easier than traditional integration approaches, and your server will automatically work with any MCP-compatible client.
New to MCP? If you’re just getting started with the Model Context Protocol, check out our Let’s Learn – MCP Events series. This beginner-friendly series walks you through MCP fundamentals and is perfect preparation for deeper learning at MCP Dev Days.
Join us at MCP Dev Days – July 29-30! If you’re excited about MCP and want to dive deeper, don’t miss our upcoming virtual event. Over two days, you’ll get hands-on learning, real-world demos across VS Code and GitHub Copilot, and insights from community partners like Arcade, Block, Okta, and Neon. Day 1 focuses on productivity and community, while Day 2 goes deep into building MCP servers with security best practices.
The post 10 Microsoft MCP Servers to Accelerate Your Development Workflow appeared first on Microsoft for Developers.