Azure MCP Server 3.0: stricter by default, and what that changes
Today's Extensions digest reads the 3.0.0 changelog: rejected unknown parameters, safer resource defaults, endpoint validation and a new MCP protocol version. No package was run.
Facts checked October 13, 2026
Azure MCP Server 3.0.0 is the latest npm version, published October 12, 2026 (UTC), after 50 betas. The changelog lists stricter inputs, secure-by-default resource creation and migration to the MCP 2026-07-28 protocol. I read the changelog and metadata; I did not install or run anything. Changelog
What the release says changed
The 3.0.0 entry in the project changelog is dated October 12, 2026 and says the release spans 50 beta iterations. It lists new namespaces (including Azure Backup, Resilience Management, SRE Agent, Terraform, Optimization and Advisor), structured output, and a migration to the MCP 2026-07-28 stateless protocol with automatic backward compatibility for clients on 2025-11-25.
Azure MCP Server CHANGELOG, section 3.0.0Stricter contracts
The changelog says unused parameters, custom retry options and confirmation-only options were removed across namespaces, and that unknown parameters are now rejected. For anyone with saved prompts, scripts or agent configs that pass extra arguments, this is the line to check. A call that used to be tolerated may now fail, which is better than silently ignoring a flag you believed was active.
Secure by default, as described
For new resources the changelog lists: Storage accounts with Shared Key authentication disabled, Event Hubs namespaces with local authentication disabled, NFS file shares with RootSquash and encrypted transit, and Recovery Services vaults with public network access disabled. It also lists cloud-specific endpoint validation based on Microsoft.Security.AntiSSRF, and telemetry that no longer records option values. These are the project's statements about defaults; I did not create a resource to confirm them.
Where to get it, as documented
The changelog documents npm (npx @azure/mcp@3.0.0), NuGet (dotnet tool install -g Azure.Mcp --version 3.0.0), PyPI (pip install msmcp-azure==3.0.0), Docker (mcr.microsoft.com/azure-mcp:3.0.0) and .mcpb bundles. The npm registry lists 3.0.0 as latest with an MIT license field, and the repository LICENSE file is the MIT License. The GitHub releases page lists an Azure.Mcp.Server-3.0.0 entry.
npm registry metadataAnalysis: my inference
Rejecting unknown parameters gives a clearer failure and hands you some work: pin the version, then re-run every saved workflow once. Safer defaults help only for resources created through this server; they do not change resources that already exist. A major version is the vendor's description of changes, so I would not treat it as a security audit.
What I could not confirm
I did not run the server, test the new defaults, or compare tool counts. The changelog does not, in the section I read, give a total tool count for 3.0.0. I make no claim about adoption or quality.
Illustrative upgrade checklist, not executed
# documented install form, pin the exact version (not run here)
npx @azure/mcp@3.0.0
# before rollout
1. list every saved prompt/script/agent config that calls this server
2. re-run each once against 3.0.0; note any unknown-parameter rejection
3. record version, date and who approved the change