Enterprise AI Gateway

An end-to-end portfolio sample showing a React frontend, a .NET 10 JSON-RPC MCP gateway, Azure SQL grounding, managed identity authentication, Key Vault secret references, Application Insights, GitHub Actions, GHCR, and low-cost Azure hosting.

About This Project

This repository is a self-directed portfolio project, not client or employer work product. It exists to demonstrate hands-on ability across a full stack: cloud infrastructure as code, a governed data-access API, identity and secret management, observability, and CI/CD, wired together end to end rather than left as disconnected samples.

Architecture

Deployed Topology

flowchart LR
	User[Browser] --> Frontend[Azure Blob Static Website<br/>React/Vite assets]
	Frontend -->|HTTPS + CORS| Gateway[Azure Container Apps Consumption<br/>.NET 10 MCP gateway]
	Gateway -->|Entra token via user-assigned identity| SQL[Azure SQL Database<br/>AdventureWorksLT]
	Gateway -->|Key Vault reference| Vault[Azure Key Vault<br/>Anthropic API key]
	Gateway --> Insights[Application Insights]
	Insights --> Logs[Log Analytics Workspace]
	GitHub[GitHub Actions] -->|OIDC + blob upload| Frontend
	GitHub -->|GHCR push| Registry[GitHub Container Registry]
	Registry -->|Public image pull| Gateway

The default deployment is intentionally public and low-cost. This repository is a public portfolio/sample deployment, not a production network design. The public posture is a deliberate trade-off to keep the system accessible from Codespaces and local VS Code while minimizing fixed networking cost. Production deployments for real data should move behind private networking, private DNS, and a WAF/API gateway.

Runtime Request Flow

The gateway provides governed, read-only database access through a JSON-RPC MCP endpoint. The chat endpoint uses Claude only after a tool result has been retrieved:

sequenceDiagram
	participant B as Browser
	participant F as Blob frontend
	participant G as Container App gateway
	participant I as Managed identity
	participant D as Azure SQL

	B->>F: Load index.html and assets
	B->>G: POST /api/v1/mcp initialize
	G-->>B: JSON-RPC initialize result
	B->>G: POST /api/v1/mcp tools/list
	G-->>B: Tool definitions and input schemas
	B->>G: POST /api/v1/mcp tools/call { schema, table, limit }
	G->>I: Request SQL access token
	I->>D: Authenticate as gateway identity
	G->>D: Read schema metadata or safe table rows
	D-->>G: Table metadata or rows
	G->>G: Exclude credential columns; redact and mark personal, contact, and location columns
	G-->>B: MCP text response

/api/v1/mcp returns governed SQL context through JSON-RPC tool results. POST /api/v1/chat uses Anthropic only after retrieving an approved MCP tool result; it never sends database entities or unapproved columns to the provider.

Gateway Boundaries

The gateway is split into explicit ownership boundaries:

• Core/DTOs: MCP request, response, tool, and content contracts.
• Data/Scaffolded: database-first EF Core context and generated SalesLT entities. Regenerate generated files rather than editing them

... View full README on GitHub