FabCon Europe 2026 in 18 demos · Part 4 of 18 · MCP servers
Fabric Core MCP server: 43 tools, 25 of them write
A remote MCP endpoint turns Fabric REST operations into tools an agent calls as you. Most of them change something.
The Fabric Core MCP server is a remote Model Context Protocol endpoint that exposes Fabric resource-management operations as tools. An AI agent picks a tool, and the server calls the Fabric REST API with the signed-in identity's permissions. It is generally available, per Learn's What's new page. On November 3, 2026, the Learn tools reference lists 43 tools. Of those, 25 create, change, move, reset, or delete something.
It is the write side of the MCP door in FabCon Europe 2026 in 18 demos. The demo clip from October 21 counted 27 tools. Two weeks later, Learn lists 43, including a new OneLake section.
In short
- Fabric Core MCP is a GA remote MCP endpoint for Fabric workspaces, items, roles, folders, and OneLake settings.
- The Learn tools reference lists 43 tools on November 3, 2026, and 25 of them write. They include delete_workspace, add_workspace_role, and a tool that replaces an item's whole OneLake role set.
- GA does not make the writes safe. Every call runs with your Fabric role, and Learn warns that “Autonomous or misconfigured clients may perform destructive actions,” so a person should approve every write.
What the Fabric Core MCP server is and how it works
The endpoint is https://api.fabric.microsoft.com/v1/mcp/core. Any MCP host that speaks Streamable HTTP can connect, such as VS Code with GitHub Copilot. Sign-in is a browser-based OAuth 2.0 flow with Microsoft Entra ID.
Each tool maps to one Fabric REST API operation. The server adds no permissions of its own. Calls run under the authenticated identity's Fabric role, and Learn notes that this identity can differ from the person at the keyboard. Fabric records supported operations in audit logs.
Figure 1 sorts the 43 tools by area and marks the 25 that write.
Workspaces 5 tools, 3 write
- list_workspaces
- get_workspace
- create_workspace
- update_workspace
- delete_workspace
Workspace roles 5 tools, 3 write
- list_workspace_roles
- get_workspace_role
- add_workspace_role
- update_workspace_role
- delete_workspace_role
Items 8 tools, 5 write
- list_items
- get_item
- get_item_definition
- create_item
- update_item
- update_item_definition
- delete_item
- bulk_move_items
Folders 6 tools, 4 write
- list_folders
- get_folder
- create_folder
- update_folder
- delete_folder
- move_folder
Search and guidance 2 tools, 0 write
- search_catalog
- get_knowledge
Capacities and operations 3 tools, 0 write
- list_capacities
- get_operation_state
- get_operation_result
OneLake shortcuts 6 tools, 4 write
- onelake_list_shortcuts
- onelake_get_shortcut
- onelake_create_shortcut
- onelake_create_shortcuts_in_bulk
- onelake_delete_shortcut
- onelake_reset_shortcut_cache
OneLake data access roles 4 tools, 3 write
- onelake_list_data_access_roles
- onelake_create_or_update_single_data_access_role
- onelake_create_or_update_data_access_roles
- onelake_delete_data_access_role
OneLake settings 4 tools, 3 write
- onelake_get_settings
- onelake_modify_default_tier
- onelake_modify_diagnostics
- onelake_modify_immutability_policy
The write tools are ordinary admin work. Learn says Contributors can create, edit, and delete supported items, and Members can add users with the same or lower permissions. On delete_workspace, Learn is blunt: “Deleting a workspace permanently removes all items within it. You can't undo this operation.”
What the demo shows
The 17-second clip makes real calls from a terminal through a script named fabric_mcp.py. The runbook's script counts a tool as read-only when the server marks it with the readOnlyHint annotation.
- 0:00 The window title shows api.fabric.microsoft.com/v1/mcp/core. A comment reads “remote MCP server, token from Entra ID.”
- 0:04
initanswers “FabricMCPServer 13.0.28519.813 protocol 2025-11-25.” - 0:07
toolsprints “27 tools: 12 read-only, 15 write,” then the write list from create_workspace to move_folder. - 0:12
call list_workspacesreturns the personal My workspace, two shared workspaces, and a RequestId.
The runbook's verification run on the same day shows build 13.0.28520.305. The server changes under you, so rerun the tool list before you trust any count.
Limits and catches
The catch: your role is the only hard limit. An agent signed in as a workspace Admin can call delete_workspace, and Learn says that cannot be undone. The one step that can stop it first is your client's approval setting, and MCP does not standardize it.
Learn's warning, word for word:
“MCP clients can invoke operations based on the authenticated identity's Fabric role-based access control (RBAC) permissions. Autonomous or misconfigured clients may perform destructive actions.”
“Certain safeguards, such as flags to prevent destructive operations, aren't standardized in the MCP specification and might not be supported by all clients.”
Microsoft Learn, Fabric Core MCP Server overview, Permissions and risk
- Prompt You, or an agent loop with no person in it
- Tool choice The agent picks from a tool list that changes over time
- Approval Your client's setting. MCP has no standard flag for it.
- Core MCP Calls the Fabric REST API as the signed-in identity
- Fabric role Allows whatever that role allows
- Audit log Records supported operations, after the fact
Four more sharp edges come from the tools reference:
- onelake_create_or_update_data_access_roles replaces an item's complete role set. A role you leave out loses its grants. Use DryRun, or the single-role tool.
- onelake_create_shortcut with CreateOrOverwrite replaces an existing shortcut. The default is Abort.
- An HTTP 200 response can still carry
result.isError: true. Check both. - Shortcut and role lists come in pages. The first page is not the full inventory.
Learn adds that the server “may interact with clients and services that process data outside Fabric's compliance boundaries.” The MCP overview also says: “Don't assume that every MCP tool call appears in Fabric audit logs.”
The Core MCP pages on Learn name no tenant setting for the server. Workspace outbound access protection covers OneLake shortcuts, see part 14, outbound access protection. The search_catalog tool runs the same search as part 7, the OneLake catalog search API.
How to count the Core MCP tools yourself
You need nothing beyond your Azure CLI sign-in, and no Fabric capacity. Try it first as an identity with Viewer on one workspace. The steps follow runbook D04.
python3 fabdemo.py core-mcp init
python3 fabdemo.py core-mcp tools
python3 fabdemo.py core-mcp call list_workspacesExpected result: the server name and protocol version, the tool count split into read-only and write tools, and the workspaces you can see. The October 21 run printed 27 tools, so expect a higher count now. Time and cost: about 2 minutes, no Fabric capacity needed.
In VS Code, run MCP: Add Server, pick HTTP, enter the endpoint, and name it fabric. Then compare part 3, the Fabric IQ MCP server, which only reads.
What to do on Monday
On Monday: Wait on Core MCP for autonomous agents. Turn it on only where a person approves every write.
Key facts at a glance
Checked on Microsoft Learn on November 3, 2026.
| ID | Fact | Source |
|---|---|---|
| K1 | Endpoint api.fabric.microsoft.com/v1/mcp/core, Streamable HTTP, OAuth 2.0 with Entra ID. | Get started with Fabric Core MCP |
| K2 | GA since September 2026. The overview page itself carries no label. | What's new in Microsoft Fabric |
| K3 | 43 tools: 25 write, 18 read. | Core MCP tools reference |
| K4 | October 21 live run: 27 tools, 12 read-only, 15 write. | Runbook D04 |
| K5 | Calls use the authenticated identity's Fabric RBAC. Connecting grants nothing extra. | What are Fabric MCP Servers? |
| K6 | Deleting a workspace removes all its items and cannot be undone. | Core MCP tools reference |
Frequently asked questions
How many tools does the Fabric Core MCP server have?
The Learn tools reference lists 43 tools as of November 3, 2026. Of those, 25 create, change, move, reset, or delete something, and 18 only read. The October 21 recording showed 27, so recount before you write a policy.
Is the Fabric Core MCP server generally available?
Yes. Microsoft Learn's What's new in Microsoft Fabric page lists Fabric Core MCP Server as generally available in September 2026. The overview page itself carries no status label. GA does not make its 25 write tools safe for autonomous clients.
Can the Fabric Core MCP server do more than my Fabric role allows?
No. Calls use the authenticated identity's Fabric permissions, and connecting the server grants nothing extra. It can do everything that role allows, including deleting a workspace the identity administers.
How do I stop an agent from running destructive Core MCP tools?
Use your MCP client's approval settings and review each proposed tool call. Learn notes that flags to prevent destructive operations are not standardized in MCP. Sign in with a least-privilege identity as the second guard.
Are Fabric Core MCP calls recorded in the audit log?
Fabric records supported Core operations with the identity that ran them. Learn also warns not to assume that every MCP tool call appears in Fabric audit logs. Treat the log as evidence after the fact, not as a guard.
Sources
Microsoft Learn, checked on November 3, 2026, then the recap materials.
- Learn: Fabric Core MCP Server overview
- Learn: Fabric Core MCP Server tools reference
- Learn: Get started with Fabric Core MCP Server
- Learn: What are Fabric MCP Servers?
- Learn: Roles in workspaces in Microsoft Fabric
- Learn: What's new in Microsoft Fabric, generally available features
- Runbook D04: Fabric Core MCP server