fabric-dw 2026.6.0a1.dev170

Python CLI + MCP server for administering Microsoft Fabric Data Warehouses and SQL Analytics Endpoints

fabric-dw

Alpha — work in progress. The API and CLI interface may change without notice. See the open issues for current status.

Python CLI and MCP server for administering Microsoft Fabric Data Warehouses and SQL Analytics Endpoints.

Description

fabric-dw provides two interfaces for managing Microsoft Fabric Data Warehouses and SQL Analytics Endpoints:

• CLI — a command-line tool for common DW administration tasks.
• MCP server — a Model Context Protocol server that exposes DW operations as tools for AI assistants.

Authentication is configured via the FABRIC_AUTH environment variable. The default (FABRIC_AUTH=default) uses azure-identity DefaultAzureCredential, which walks environment variables, Workload/Managed Identity, Azure CLI, Azure Developer CLI, Azure PowerShell, and interactive browser in order — any of these will satisfy it. See the Authentication docs for the full chain, all supported sources, and debugging tips.

Installation

pip install fabric-dw
# or run without installing:
uvx fabric-dw --help

Quick Start

CLI

# List all workspaces you have access to
uvx fabric-dw workspaces list

# List warehouses and SQL Analytics Endpoints in a workspace
uvx fabric-dw warehouses list <workspace-name-or-id>

# Execute a SQL query against a warehouse
uvx fabric-dw sql exec <workspace-name-or-id> <warehouse-name-or-id> "SELECT TOP 10 * FROM dbo.my_table"

# List restore points for a warehouse
uvx fabric-dw restore-points list <workspace-name-or-id> <warehouse-name-or-id>

MCP Server

Add to your MCP client configuration (e.g. Claude Desktop, VS Code):

{
  "mcpServers": {
    "fabric-dw": {
      "command": "uvx",
      "args": ["--from", "fabric-dw", "fabric-dw-mcp"]
    }
  }
}

The MCP server exposes all CLI operations (workspaces, warehouses, SQL endpoints, audit, queries, snapshots, restore points, schemas, tables, views) as MCP tools. Set FABRIC_AUTH in the environment if you need a non-default auth mode.

Run in Docker

The Docker image's default ENTRYPOINT is the MCP server (fabric-dw-mcp). Use it as-is with your MCP client, or override the entrypoint to run the CLI instead.

docker pull ghcr.io/sdebruyn/fabric-dw:latest

# Run the MCP server (default entrypoint — connect via stdio from your MCP client):
docker run --rm -i \
  -e AZURE_CLIENT_ID=… \
  -e AZURE_TENANT_ID=… \
  -e AZURE_CLIENT_SECRET=… \
  -e FABRIC_AUTH=sp \
  ghcr.io/sdebruyn/fabric-dw

# Run the CLI instead (override the entrypoint):
docker run --rm \
  --entrypoint fabric-dw \
  -e AZURE_CLIENT_ID=… \
  -e AZURE_TENANT_ID=… \
  -e AZURE_CLIENT_SECRET=… \
  -e FABRIC_AUTH=sp \
  ghcr.io/sdebruyn/fabric-dw --help

Dev images (built from every main merge): ghcr.io/sdebruyn/fabric-dw:main or :<version>.dev<N>.

Package page: ghcr.io/sdebruyn/fabric-dw

Security environment variables

Variable	Default	Description
FABRIC_MCP_READONLY	unset	Set to 1 to restrict execute_sql to SELECT/WITH and block all mutating tools.
FABRIC_MCP_ALLOW_DESTRUCTIVE	unset	Set to 1 to enable permanently-destructive tools (delete_*, clear_table, restore_warehouse_in_place). Disabled by default.
FABRIC_MCP_WORKSPACES	unset	Comma-separated workspace names or GUIDs the server may touch. Unset = all workspaces allowed.
FABRIC_MCP_ALLOW_REMOTE	unset	Set to 1 to allow the HTTP transport (--transport http) to bind on a non-loopback address. A warning is logged; ensure an authenticating reverse proxy with TLS fronts the endpoint.

HTTP transport

The MCP server can be started in HTTP mode for remote clients:

fabric-dw-mcp --transport http [--host 127.0.0.1] [--port 8000]

Binding to non-loopback addresses requires FABRIC_MCP_ALLOW_REMOTE=1. The HTTP transport has no built-in authentication or TLS — always front it with an authenticating reverse proxy.

Develop in a container

Open the repo in GitHub Codespaces or VS Code's Remote-Containers extension — the devcontainer pre-installs Python 3.13, uv, Azure CLI, and the GitHub CLI.

Contributing

See CONTRIBUTING.md for dev setup, branch flow, and how to run tests locally.

📖 Docs: fdw.debruyn.dev (or run uv run --only-group docs zensical serve locally).

Telemetry

fabric-dw collects anonymous, opt-out usage telemetry (install counts, surface usage, Python/OS version). No SQL, identifiers, or credentials are ever sent. To opt out, set FABRIC_DISABLE_TELEMETRY=1. See the Telemetry docs for the full list of collected fields and all opt-out methods. Telemetry is automatically disabled in CI environments.

Security

Please report vulnerabilities privately — see SECURITY.md.

Code of Conduct

This project follows the Contributor Covenant 2.1.

License

MIT — Copyright (c) 2026 Sam Debruyn