[BUG] Generate CLI Command return 503/401

[robinsujob]

Describe the bug

Hi team,

I use copilot cli and config Azure MCP to Generate CLI Command

Prompt: use azure mcp server to find how many resource groups? and gen cli command

But it returns:

 ✘ Generate CLI Command
   {  "status": 503,  "message": "Service unavailable or network connectivity issues. Details: Response status code does not indicate success: 401
   (Unauthorized).. To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azmcp/troubleshooting (
   https://aka.ms/azmcp/troubleshooting).",  "results": {  "message": "Response status code does not indicate success: 401 (Unauthorized).",  "stackTrace":
   null,  "type": "HttpRequestException"  },  "duration": 0 }

I tried another question about list resource group it could be works, indicated I have permission to access Azure

Expected behavior

return command suggestion

Actual behavior

 ✘ Generate CLI Command
   {  "status": 503,  "message": "Service unavailable or network connectivity issues. Details: Response status code does not indicate success: 401
   (Unauthorized).. To mitigate this issue, please refer to the troubleshooting guidelines here at https://aka.ms/azmcp/troubleshooting (
   https://aka.ms/azmcp/troubleshooting).",  "results": {  "message": "Response status code does not indicate success: 401 (Unauthorized).",  "stackTrace":
   null,  "type": "HttpRequestException"  },  "duration": 0 }

Reproduction Steps

1. config mcp server

{
  "mcpServers": {
    "microsoft-learn": {
      "tools": [
        "*"
      ],
      "type": "http",
      "url": "https://learn.microsoft.com/api/mcp",
      "headers": {}
    },
    "azure-mcp-server": {
      "type": "local",
      "command": "npx",
      "tools": [
        "*"
      ],
      "args": [
            "-y",
            "@azure/mcp@latest",
            "server",
            "start"
      ],
      "env": {}
    }
  }
}

2. Config env for auth, refer: https://github.com/microsoft/mcp/blob/main/docs/Authentication.md

3. use copilot cli to ask "use azure mcp server to find how many resource groups? and gen cli command"

Environment

WSL / Ubuntu 24.04 / Copilot CLI

[joshfree]

Thanks for sharing this issue via github, @robinsujob. @KarishmaGhiya can you please help?

[KarishmaGhiya]

@robinsujob I ran the prompt on my end and this is what it returned -

1. First, it ran mcp tool "Ran List Resource Groups - azure-mcp-server" and returned a 200
2. Ran mcp tool "Generate CLI Command - azure-mcp-server" and returned a 200

Perfect! Here are the results:

Resource Group Count: <COUNT>
You have 243 resource groups in subscription <SUBSCRIPTION>.

Generated Azure CLI Command

This command will output: <COUNT>
"az group list --subscription <SUBSCRIPTION> --query "length(@)""
The Azure MCP server successfully:

✅ Listed all <COUNT> resource groups across multiple regions
✅ Generated the equivalent Azure CLI command for you to use

---

After this, I again put the prompt "can you run the generated Azure CLI command?" to which it responded -

az group list --subscription <SUBSCRIPTION> --query "length(@)"
This will output: <COUNT>

Note: Make sure you're authenticated with Azure CLI first. If you haven't already, run:
az login --tenant <TENANT>

---

Next when I tried this command locally on Powershell CLI on my end -az group list --subscription <SUBSCRIPTION> --query "length(@)" it gives me an error since it's unable to process a few characters in this command. Then I replied to Copilot -

This is the result I get when I run the CLI command - "argument --query: invalid jmespath_type value: 'length(@'
To learn more about --query, please visit: '[https://docs.microsoft.com/cli/azure/query-azure-cli](vscode-file://vscode-app/c:/Users/kaghiya/AppData/Local/Programs/Microsoft%20VS%20Code/resources/app/out/vs/code/electron-browser/workbench/workbench.html)'"

Response from Copilot - Sorry for the confusion! In PowerShell, use this simpler approach:

(az group list --subscription<SUBSCRIPTION> | ConvertFrom-Json).Count

And this last command when I ran locally worked!

[KarishmaGhiya]

@robinsujob This was my experience - https://github.com/microsoft/mcp/issues/1215#issuecomment-3565230118 I'd recommend you to try removing any other mcp server from the above config file you have and retry the prompts I shared. Let me know if that helps.

[robinsujob]

I remove other mcps except azure-mcp, and tried again. It doesn't works for me. @KarishmaGhiya

BTW, my env is WSL / Ubuntu 24.04 / Copilot CLI

[KarishmaGhiya]

@robinsujob Can you make sure you are authenticated? It looks like is that the service is sending you 401. Also you mentioned trying to use Copilot CLI. Please note that our team only supports the Azure MCP Cli and not Copilot Cli. I verified on my end that the equivalent Azure MCP cli command worked. Also, when I tried the prompt you shared "Generate CLI command", Copilot generated Azure CLI command and that worked on my end after I was authenticated.

• Can you share what CLI command it generated that gave you a 503? I don't see that in the logs. My recommendation would be to make sure you are authenticated and try running the Azure CLI command I shared with you.

[KarishmaGhiya]

Also if Github Copilot CLI is sending you 503 instead of 401, then I recommend you to file a bug on Github Copilot CLI for masking that error https://github.com/github/copilot-cli/issues. @robinsujob

[robinsujob]

@robinsujob Can you make sure you are authenticated? It looks like is that the service is sending you 401. Also you mentioned trying to use Copilot CLI. Please note that our team only supports the Azure MCP Cli and not Copilot Cli. I verified on my end that the equivalent Azure MCP cli command worked. Also, when I tried the prompt you shared "Generate CLI command", Copilot generated Azure CLI command and that worked on my end after I was authenticated.

• Can you share what CLI command it generated that gave you a 503? I don't see that in the logs. My recommendation would be to make sure you are authenticated and try running the Azure CLI command I shared with you.

Hi @KarishmaGhiya, As shown in my previous screenshot, I first asked MCP to list my resources and received the expected result, which indicates that I was authenticated. After that, I tried to use the Generate CLI command feature, but it returned an error code.

I’m a bit confused about why authentication would be required for generating a CLI command. My understanding was that this feature only generates the command based on some knowledge, rather than executing it. Could you confirm if authentication is indeed mandatory for generating the CLI command?

[JasonYeMSFT]

@robinsujob Generating Azure CLI command tool does requrie user level authentication. This is the design decision made by the owning team of the backend API for this tool. What kind of credential did you use for the resource listing operation (e.g. Managed Identity of the host machine, Azure CLI, Azure Powershell, etc.)? The backend service only accepts tokens from some known clients.