Turning a System of Record into an AI Agent: Building MCP Tools on Azure

A practical, end-to-end walkthrough of taking a read-only slice of an enterprise source system and exposing it to an AI agent as a set of Model Context Protocol (MCP) tools — using Azure Logic Apps, API Management, and Agent Foundry. All identifiers below are placeholders; swap in your own. The goal We wanted a simple outcome: a user asks a business question in plain language and gets a straight answer — no dashboards, no field names, no training on the underlying system. That means an AI agent with safe, read-only access to a backend system of record, exposed as discrete tools the model can call. The constraints shaped every decision: Read-only. The agent can retrieve and analyze, never write. Safe. Records in most business systems contain free text (notes, subjects, descriptions) that could carry prompt-injection payloads. Tool output must be treated as data, never instructions. Composable. The agent should see many small, well-described tools — "list records", "aggregate by category", "record change history" — not one giant "query the system" tool. The architecture Five layers, one direction of flow: Agent (Agent Foundry) │ MCP (JSON-RPC over HTTP) ▼ MCP server (API Management) │ REST operation per tool ▼ API gateway (API Management) │ single POST, routed by body ▼ Tool executor (Logic App) │ OAuth token + REST calls ▼ Source system (REST API) The key design choice: one backend endpoint, many logical tools. The Logic App exposes a single HTTP trigger that accepts { "tool": "records.list", "parameters": { ... } } and routes internally. API Management then fans that single endpoint out into many named operations, and its MCP feature turns those operations into agent tools. This keeps the backend trivial to maintain while the agent still sees a rich, typed tool catalog. Step 1 — Design the tools Start from the questions , not the schema. A useful toolset usually falls into a few families: Records: list / get / search / filter for the core business entities. Activity