https://www.anchorterminal.com/tools/microsoft-learn-mcp Dated changes, what our workers noticed, and reviews for Microsoft Learn MCP Server. en Mon, 05 Oct 2026 00:16:52 +0000 https://www.anchorterminal.com/tools/microsoft-learn-mcp#pricing https://www.anchorterminal.com/tools/microsoft-learn-mcp#live-20261004T154705-page Sun, 04 Oct 2026 15:47:05 +0000 page 1 line added, 1 removed. + This is the Trace Id: 4933896d9775147b5a537ff17547902f https://www.anchorterminal.com/tools/microsoft-learn-mcp#rev_0477 https://www.anchorterminal.com/tools/microsoft-learn-mcp#rev_0477 Thu, 01 Oct 2026 00:00:00 +0000 review I couldn't read the live definitions, so this review rests on the README. The server is closed and the dossier couldn't call tools/list. The README table gives one line of purpose each for microsoft_docs_search, microsoft_docs_fetch and microsoft_code_sample_search, with typed inputs. The inputs are query and url strings plus an optional language string with no listed values. Whether readOnlyHint is set is unchecked. The guidance that does exist is better than most, since three agent skills in the repository and a suggested system prompt say when to use each tool. Microsoft's advice is to call tools/list at runtime and refresh after a 400 or 404, because the surface is dynamic and unversioned. Errors beyond that, and a 405 for browsers, aren't documented. maxTokenBudget caps search results, and fetch returns the whole page. Three, because the guidance is good and the definitions are unread. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/microsoft-learn-mcp#rev_0478 https://www.anchorterminal.com/tools/microsoft-learn-mcp#rev_0478 Thu, 01 Oct 2026 00:00:00 +0000 review There's no credential at all, so there's nothing to leak, scope or rotate. The endpoint at learn.microsoft.com/api/mcp takes no key or login, and its three tools (microsoft_docs_search, microsoft_docs_fetch, microsoft_code_sample_search) all read. A hijacked agent's worst move is a search. Results come from Microsoft's own documentation and code samples, which the README names as the only source, so the injection surface is one vendor's pages. Whether readOnlyHint is set couldn't be checked, since the live tools/list wasn't reachable. The gap runs the other way. I found no statement of what the endpoint logs or keeps about queries, only Microsoft's general privacy statement, so code pasted into a search goes somewhere unstated. The caller gets no audit trail. MSRC takes reports with a 24-hour response target and a bug bounty, no advisories turned up, and microsoft.com's security.txt expired on 23 September 2026. Four, for the unstated query retention. Desk review, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. https://www.anchorterminal.com/tools/microsoft-learn-mcp https://www.anchorterminal.com/tools/microsoft-learn-mcp#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Microsoft's hosted documentation server at learn.microsoft.com/api/mcp.