Azure MCP Server vs Netlify API + MCP

Azure MCP Server 73

Entra ID through DefaultAzureCredential (az login, managed identity, service principal, workload identity federation, and Azure Pipelines service connections since 3.0.0), so access is RBAC-scoped and nothing secret sits in the MCP config. HTTP mode authenticates incoming callers and can act on behalf of the user (28 of 30). --read-only drops write tools, --namespace narrows the surface, and reading secrets, connection strings or private keys asks the user first through elicitation. Since 3.0.0 the MySQL and PostgreSQL query tools are marked destructive, so --read-only drops them, and new Storage accounts, Event Hubs namespaces and Recovery Services vaults are created with Shared Key, local authentication or public networking off. Destructive operations still get no confirmation, and 3.0.0 removed the confirmation-only --force option from sql server delete (14 of 20). Monitor and Application Insights queries, blobs and database rows reach the model as they are. We found no prompt-injection guidance, though endpoint validation through Microsoft.Security.AntiSSRF now covers more data-plane and control-plane tools, and 4.0.0-beta.4 (29 October) rejects IoT Hub and resource group names such as rg1/../rg2 that could send a request to another resource group (5 of 15). Azure's Activity Log records the writes made with the caller's identity, and telemetry can go to your own Application Insights (11 of 15). SECURITY.md and SUPPORT.md send reports to MSRC, Microsoft runs a bug bounty and MSRC assigned CVEs this year, but no GitHub advisories are published and www.microsoft.com/.well-known/security.txt still had Expires 2026-09-23 on 1 November (15 of 20). 28+14+5+11+15 = 73.

Netlify API + MCP 59

Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59.

Azure MCP Server 74

About 430 commands (per the 1 October count) in 67 top-level groups in the command reference of 16 October. The default namespace mode shows one tool per namespace, still over 30, but --namespace, --tool (exact-name matching since 3.0.0-beta.50), consolidated mode and a single-tool mode shrink it (15 of 25). Resource Graph queries, pagination on some data tools and a compact structured-output mode (14 of 20). 3.0.0 returns 404 for missing resources where it returned 500 or 400, returns 400 for invalid input where it returned 500, rejects unknown parameters and, per the release notes, gives clearer authentication and RBAC errors. The router lists valid command names instead of dumping help. We found no reference that documents the error shapes (17 of 20). Every command carries destructive, idempotent, readOnly, openWorld and secret metadata, and Destructive defaults to true when unset. The email and SMS send tools were marked read-only until 1 October 2026 (16 of 20). DefaultAzureCredential needs no config, packages exist for Node, .NET and Python, but subscription and resource group are required on most tools (12 of 15). 15+14+17+16+12 = 74.

Netlify API + MCP 69

Lists are sized with per_page up to 100 and there is no field selection. The hosted MCP server registers about 11 tools by default, a reader and an updater selector per domain plus coding context and design import, and lists all 25 operations one by one only for OpenAI clients, so the context cost is low either way (18 of 25). page and per_page with a Link header, few filters, and MCP pagination bounds enforced since v1.19.0 (15 of 20). Errors return a code and message; the MCP server answers a bad selector with text telling the agent to pick an operation again (12 of 20). No idempotency key for deploys or sites, though timed-out uploads are safe to retry; every MCP tool declares readOnly, destructive, idempotent and openWorld hints since v1.18.0, with project renames marked destructive (12 of 20). Few required parameters, a Go client, a JS client and the CLI (12 of 15). 18 + 15 + 12 + 12 + 12 = 69.

Azure MCP Server 60

Free under MIT with nothing to buy for the server, so 20 + 20 + 20. Every tool acts on an Azure subscription that Microsoft bills separately, which this grade doesn't cover. No payment protocol (0).

Netlify API + MCP 55

No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). netlify deploy --allow-anonymous publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55.