.NET-native agentic cloud operations with embedded MCP

Working demonstrations of building agentic applications in .NET on an embedded StackQL MCP server.

The idea in one paragraph: StackQL treats cloud and SaaS providers as data sources accessed via SQL. Agents doing platform engineering, SRE and audit work need to query, reason about and act on actual running state, not on state files. The StackQL MCP server is the agent interface to that engine, with a small fixed tool surface and safety modes gating writes. The StackQL.Mcp NuGet package embeds that server in a .NET application - it downloads and sha256-verifies the pinned server bundle on first run (or vendors it into a single-file publish) and hands you a connected MCP client. The server's tools are Microsoft.Extensions.AI functions out of the box (each McpClientTool is an AIFunction), so any MEAI function-calling loop - here, Claude via Anthropic's OpenAI-compatible endpoint - can drive your cloud estate with every action expressed as readable SQL.

The programs

Program	What it shows	Needs
minimal/	The smallest embedding: builder, StackqlMode.ReadOnly, github null_auth, list tools, one run_select_query, one refused run_mutation_query, dispose.	.NET 9; no credentials
copilot/	The agent. MCP tools -> Microsoft.Extensions.AI function calling over Claude. Ask questions about your estate in English; every answer shows the SQL it ran. --check preflights without a model call; -p is one-shot; otherwise REPL.	ANTHROPIC_API_KEY
driftwatch/	The reference service: a Worker Service that runs a suite of SQL drift checks (public exposure, missing licenses, baseline drift) on a schedule and posts findings to a Teams Adaptive Card, each finding showing the exact SQL that produced it.	no credentials (Teams webhook optional)

Quick start

git clone https://github.com/stackql/dotnet-embedded-mcp-with-stackql
cd dotnet-embedded-mcp-with-stackql
dotnet build

dotnet run --project minimal                     # smallest embedding, zero credentials
dotnet run --project copilot -- --check          # agent preflight, zero credentials

export ANTHROPIC_API_KEY=sk-ant-...              # then the agent for real:
dotnet run --project copilot -- -p "which stackql org repos have no license? show the SQL"
dotnet run --project copilot                     # REPL

dotnet run --project driftwatch                  # scheduled drift checks (Ctrl+C to stop)

First run of any program downloads the platform's server bundle from releases.stackql.io, verifies it against the sha256 pins shipped in the package, and caches the binary under ~/.stackql/mcp-server-bin/<version>/<platform>/. Later runs are offline.

Why this shape

• The agent's tools are the StackQL MCP tools, so what the agent decides to do is always a readable SQL statement. The tool-call trace is the audit trail (copilot prints it to stderr).
• Safety is a server-side contract: everything here runs StackqlMode.ReadOnly, so writes are refused however the model is prompted. Escalation (Safe, DeleteSafe, FullAccess) is an explicit builder decision.
• The github provider's null_auth mode means every program in this repo runs with zero credentials. Point WithAuth(...) (and real provider credentials in the environment) at AWS/Azure/Google/Databricks and the same programs work against your estate.
• Single-artifact deployment: dotnet publish -p:PublishSingleFile=true -p:StackqlVendorBundle=/path/to/stackql-mcp-<platform>.mcpb vendors the server into the executable - no network at run time (driftwatch is set up for it).

Versioning

StackQL.Mcp is version-locked to the stackql release it embeds; this repo pins the minor (0.10.* in Directory.Build.props). Package source lives in stackql/stackql packaging/mcpb/dotnet.

Model

copilot defaults to claude-sonnet-5; override with COPILOT_MODEL. Claude is reached through Anthropic's OpenAI-compatible endpoint with the standard Microsoft.Extensions.AI + OpenAI SDK stack, so any MEAI IChatClient drops in. (The community Anthropic.SDK MEAI adapter is currently binary-incompatible with the Microsoft.Extensions.AI.Abstractions >= 10.5 floor required by ModelContextProtocol.Core inside StackQL.Mcp.)

CI

.github/workflows/ci.yml builds everything and runs the zero-credential smokes (minimal, copilot --check) on every push and PR. When the ANTHROPIC_API_KEY repo secret is configured, an agent-live job additionally runs one real one-shot copilot prompt.

References

• Package and docs: StackQL.Mcp on NuGet; source in stackql/stackql packaging/mcpb/dotnet
• StackQL MCP server: stackql.io/docs/mcp
• Server bundles: built by stackql/stackql packaging/mcpb, published on stackql/stackql releases
• The Rust sibling of this repo: rust-embedded-mcp-with-stackql

MIT licensed.