Vendor-published
Microsoft Learn MCP MCP server
Official Microsoft Learn MCP Server – real-time, trusted docs & code samples for AI and LLMs.
Identity and maintenance
| Registry name | com.microsoft/microsoft-learn-mcp |
|---|---|
| Publisher domain | microsoft.com |
| Maintainer type | Vendor-published namespace com.microsoft -> microsoft.com; host learn.microsoft.com is within microsoft.com |
| Latest version seen | 1.0.0 |
| Last checked | |
| Last changed | Separate from “last checked”: we check far more often than anything changes. |
Enterprise evaluation
Every row below exists whether or not we found an answer. Expand any row to see the exact source and the date. Unknown means undocumented, never unsupported.
| Access and authentication | |
|---|---|
| Authentication required Whether the hosted endpoint accepted a connection with no credentials when we checked. | No We checked checkedPOST initialize without credentials -> HTTP 200; the server responded and did not require credentials Unauthenticated connection attempt — https://learn.microsoft.com/api/mcp |
| OAuth 2.1 authorization Whether the server publishes OAuth discovery metadata a client can follow automatically. | Not documented We checked checkedno OAuth discovery document at either well-known location OAuth discovery metadata — https://learn.microsoft.com/api/mcp |
| Dynamic client registration Without it, an IdP administrator must register a client by hand before anyone can connect. | Could not reach source We checked checkedno authorization-server metadata document found Authorization server metadata — https://learn.microsoft.com/api/mcp |
| Documented scopes | Not checked |
| Read and write are separate scopes A single opaque scope means read-only access cannot be granted: approving access approves everything. | Not checked |
| Deployment and transport | |
| Streamable HTTP transport | Yes Registry checked"type": "streamable-http", "url": "https://learn.microsoft.com/api/mcp" |
| SSE transport | No Registry checkedno sse remote declared |
| Vendor-hosted endpoint Data leaves your network. Where it goes is a question for the vendor's documentation. | Yes Registry checked1 remote endpoint(s) declared |
| Self-hostable package A published npm, PyPI, container or bundle artifact you can run inside your own perimeter. | No Registry checkedno installable package declared |
| Supply chain | |
| Public source repository | Yes Registry checkedhttps://github.com/MicrosoftDocs/mcp |
| Open-source license | Yes CC-BY-4.0 Vendor checkedlicense: CC-BY-4.0 GitHub repository — https://github.com/MicrosoftDocs/mcp |
| Repository actively maintained | Yes Vendor checkedlast push 9 days ago GitHub repository — https://github.com/MicrosoftDocs/mcp |
| Package deprecated | Not checked |
| Secret inputs marked as secret Credential-shaped inputs the publisher did not flag as secret may be logged by a client. | Not checked |
| Documented controls | |
| Audit logging documented | Not documented |
| Access controls documented | Not documented |
| Data residency documented | Not documented |
| Data retention documented | Not documented |
Tools exposed without credentials
This endpoint answered an unauthenticated tools/list, so the inventory below is what any client can enumerate before authenticating. We listed the names; we did not call anything.
- microsoft_code_sample_search
- microsoft_docs_fetch
- microsoft_docs_search
What remains unknown
10 of 18 criteria are undocumented. These are the questions to put to the vendor — not conclusions about the product.
- OAuth 2.1 authorization — no OAuth discovery document at either well-known location
- Dynamic client registration — no authorization-server metadata document found
- Documented scopes — no source found
- Read and write are separate scopes — no source found
- Package deprecated — no source found
- Secret inputs marked as secret — no source found
- Audit logging documented — no source found
- Access controls documented — no source found
- Data residency documented — no source found
- Data retention documented — no source found
How we checked
One unauthenticated initialize request, plus the two OAuth discovery documents. Nothing was installed or executed. The exact request headers are below so you can reproduce the result — endpoint behaviour can depend on them.
POST https://learn.microsoft.com/api/mcp user-agent: mcpcompare.ai/1.0 (+https://mcpcompare.ai/methodology/probe; probe@mcpcompare.ai) content-type: application/json accept: application/json, text/event-stream mcp-protocol-version: 2025-06-18 -> HTTP 200 (open) checked 2026-09-19T17:17:13.284Z
Questions people ask
- Does the Microsoft Learn MCP MCP server require authentication?
- No. It accepted a connection with no credentials when we checked on 2026-09-19.
- Can I grant read-only access to the Microsoft Learn MCP MCP server?
- Not documented. We found no scope list to read.
- Can the Microsoft Learn MCP MCP server be self-hosted?
- Not from the registry record. No installable package is declared, so the vendor-hosted endpoint is the only documented option.