examples — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited examples (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A FastMCP server for developing Fabric notebooks and Dataflow Gen2 through the Fabric REST API (https://api.fabric.microsoft.com/v1). Tools take a workspace (display name or GUID) and an item name/GUID; call list_workspaces first.
Read tools always work; create/update/delete/run tools require "writable": true in config.json.
Discovery / read
list_workspaceslist_items — filter by item_type (Notebook, Dataflow, Lakehouse, …)get_item — item metadataget_item_definition — decoded definition parts of any item (generic/advanced)Notebooks
create_notebook — from source (code string) or ipynb (full notebook JSON)get_notebook — returns the source extracted from the notebook's ipynbupdate_notebook — replace contentrun_notebook — run on demand with optional parameters → returns a jobInstanceIdDataflow Gen2
create_dataflow — from a Power Query M mashup_documentget_dataflow — decoded parts (mashup.pq = the M query, queryMetadata.json)update_dataflow — replace the M documentrefresh_dataflow / publish_dataflow — on-demand jobsJobs / lifecycle
get_job — status of a notebook run / dataflow refreshcancel_jobdelete_itemDefinition create/update are long-running operations; the server polls them to completion automatically. Notebook/dataflow runs return ajobInstanceIdyou monitor withget_job(they aren't polled to completion).
currently notes the run may not complete successfully via API.
Set "auth" in config.json:
| value | how it signs in |
|---|---|
broker (default) | Windows WAM broker popup (no Azure CLI needed) |
azure-cli | reuse an az login token |
interactive | browser sign-in popup |
service-principal | app registration; secret from client_secret_env (see .env.example) |
default | DefaultAzureCredential |
The identity needs an appropriate workspace role (Admin/Member/Contributor) to create and run items. Default token scope is https://api.fabric.microsoft.com/.default.
python -m venv .venv
.\.venv\Scripts\python.exe -m pip install -r requirements.txt
copy config.example.json config.json # then edit if needed (broker auth works as-is)
.\.venv\Scripts\python.exe server.py # smoke test (Ctrl+C to stop)See examples/mcp.json:
{
"mcpServers": {
"fabric": {
"command": "C:\\path\\to\\mcp-fabric\\.venv\\Scripts\\python.exe",
"args": ["C:\\path\\to\\mcp-fabric\\server.py"],
"env": {}
}
}
}Claude Desktop reads its MCP servers from claude_desktop_config.json. Open it from Settings → Developer → Edit Config (this creates the file if it doesn't exist), or edit it directly:
%APPDATA%\Claude\claude_desktop_config.json~/Library/Application Support/Claude/claude_desktop_config.jsonAdd this server under mcpServers, using absolute paths to the venv's Python and server.py:
{
"mcpServers": {
"fabric": {
"command": "C:\\path\\to\\mcp-fabric\\.venv\\Scripts\\python.exe",
"args": ["C:\\path\\to\\mcp-fabric\\server.py"],
"env": {}
}
}
}On macOS the paths are POSIX, e.g. "command": "/Users/you/mcp-fabric/.venv/bin/python". Save the file and fully quit and reopen Claude Desktop (use Quit from the tray/menu-bar icon — closing the window isn't enough). The server's tools then appear in the tools (🔌) menu of a new chat.
MIT — see LICENSE.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.