Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You can connect a Foundry IQ knowledge base to a LangGraph application by treating Azure AI Search’s MCP endpoint as a remote tool server. LangGraph loads the endpoint’s knowledge_base_retrieve tool with langchain-mcp-adapters, supplies an Azure Search bearer token in the required HTTP header, binds the tool to your chat model, and lets a ToolNode execute retrieval inside the graph.
The direct route gives your application control over identity and credentials. A Foundry Toolbox route provides a managed MCP entry point when a team needs shared configuration or centralized policy. The APIs are documented individually; validate the complete endpoint, identity, and LangGraph deployment in your own Azure environment before production use.
What the connection looks like
Azure AI Search hosts the Foundry IQ knowledge base and exposes an MCP endpoint. A Python LangGraph process acts as the MCP client:
- It connects to the knowledge-base endpoint over HTTP.
MultiServerMCPClientdiscovers the tools exposed by that endpoint.- The application receives
knowledge_base_retrieveand binds it to the chat model. - LangGraph calls the model, executes the retrieval tool when the model requests it, and sends the tool result back for an answer.
The endpoint pattern documented for the Foundry IQ connection is:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
https://<search-service>.search.windows.net/knowledgebases/<knowledge-base-name>/mcp?api-version=2026-08-01-previewReplace both placeholders with the Azure AI Search service host and the exact knowledge-base name. The API version shown is a preview value from Microsoft’s connection documentation; check the current Azure AI Search documentation before deployment because preview versions can change.
Foundry Agent Service is not required for this direct call. Microsoft states that applications supporting the Azure AI Search knowledge-base APIs can call a knowledge base directly.
Prerequisites and version checks
- An Azure AI Search service with a Foundry IQ knowledge base and at least one configured knowledge source.
- A workload or user identity that can obtain an Azure AI Search access token and has the Search data permissions required by the knowledge source.
- Python 3.10 or later for the Microsoft LangChain and LangGraph examples.
- LangGraph, LangChain, and
langchain-mcp-adaptersinstalled according to their current documentation. - A chat-model deployment that supports tool calling. If you use Foundry model capabilities, create a Foundry project and deploy an appropriate model.
- The current MCP endpoint API version and any SDK minimums. Microsoft’s native Python path lists
azure-ai-projects>=2.0.0; that package is relevant when you also use Foundry projects, managed agents, retrievers, vector stores, or Toolbox features.
The native Foundry connection route documented by Microsoft does not support hub-based projects. That limitation applies to that route; it does not change the basic HTTP MCP pattern, but you should confirm your project type before choosing an SDK-based integration.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose a connection route
| Route | Best fit | Decisions you must make |
|---|---|---|
| Direct knowledge-base MCP endpoint | A LangGraph service that can manage Azure Search authentication and wants a direct connection | Workload identity, token acquisition, Search permissions, endpoint versioning, and application-side credential handling |
| Foundry Toolbox in front of the endpoint | Teams that need a shared MCP entry point, reusable tool configuration, or centralized credentials and policy | Toolbox setup, client compatibility, identity mode, and which team owns policy and configuration |
Microsoft documents MCP compatibility with LangGraph for Toolbox endpoints and demonstrates a knowledge-base-to-Toolbox arrangement for a hosted agent. It does not establish a universal performance or security winner. Select the route that matches where identity is managed and who must administer the tool.
Build the direct LangGraph client
1. Store the endpoint and token inputs outside code
Set environment variables (or use your platform’s secret manager) for the endpoint, access token, and model name:
FOUNDRY_IQ_MCP_ENDPOINT=https://<search-service>.search.windows.net/knowledgebases/<knowledge-base-name>/mcp?api-version=2026-08-01-preview
AZURE_SEARCH_TOKEN=<short-lived-bearer-token>
MODEL_NAME=<tool-capable-model-deployment>Do not commit a token or place a long-lived key in source control. A managed identity, workload identity, or federated user credential is preferable to a hand-managed secret when your hosting platform supports it.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
2. Create the MCP client with the Azure Search authorization header
The MCP adapter supports custom HTTP headers. The Foundry integration uses x-ms-query-source-authorization for the bearer token:
import os
from langchain_mcp_adapters.client import MultiServerMCPClient
endpoint = os.environ["FOUNDRY_IQ_MCP_ENDPOINT"]
search_token = os.environ["AZURE_SEARCH_TOKEN"]
client = MultiServerMCPClient(
{
"foundry-iq": {
"transport": "http",
"url": endpoint,
"headers": {
"x-ms-query-source-authorization": f"Bearer {search_token}"
},
}
}
)
tools = await client.get_tools()Run this code in an async context. The returned list should contain knowledge_base_retrieve. Inspect the discovered tool names during setup and fail fast if the retrieval tool is absent instead of running an apparently grounded graph with no retrieval capability.
3. Bind the discovered tool to your model
Use LangChain’s model initializer, then bind the MCP tools:
from langchain.chat_models import init_chat_model
model = init_chat_model(os.environ["MODEL_NAME"])
bound_model = model.bind_tools(tools)The model must support tool calls. The adapter does not turn a non-tool-capable model into a retrieval agent; it only exposes the remote tool in the model’s tool schema.
4. Add model and tool nodes to the graph
A minimal message-state graph can route model tool calls to a ToolNode and then return the result to the model:
from langgraph.graph import MessagesState, StateGraph, START
from langgraph.prebuilt import ToolNode, tools_condition
async def call_model(state: MessagesState):
response = await bound_model.ainvoke(state["messages"])
return {"messages": [response]}
builder = StateGraph(MessagesState)
builder.add_node("call_model", call_model)
builder.add_node("tools", ToolNode(tools))
builder.add_edge(START, "call_model")
builder.add_conditional_edges("call_model", tools_condition)
builder.add_edge("tools", "call_model")
graph = builder.compile()When the model emits a tool call, tools_condition routes execution to the tool node. The tool result is appended to the message state, and control returns to call_model for the final response.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
5. Invoke the graph with retrieval instructions
Tool binding alone does not guarantee retrieval. Give the model an explicit system instruction and a user question:
result = await graph.ainvoke(
{
"messages": [
{
"role": "system",
"content": (
"For questions that depend on the knowledge base, call "
"knowledge_base_retrieve before answering. Distinguish "
"retrieved evidence from general model knowledge, cite the "
"returned sources when available, and say when the retrieved "
"material does not support an answer."
),
},
{"role": "user", "content": "What is our incident retention policy?"},
]
}
)Microsoft recommends explicit instructions for consistent tool use and source attribution. The instruction should also tell the model not to present unsupported information as if it came from the knowledge base.
Authentication and Azure permissions
How the token is used
The LangGraph host obtains an Azure AI Search access token using its workload or user identity. It sends that token as:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesx-ms-query-source-authorization: Bearer <token>The exact token acquisition code depends on where LangGraph runs: an Azure-hosted workload may use managed identity, while a developer process may use a signed-in developer credential or another approved Azure identity. Keep acquisition and refresh outside the graph nodes so a token can be renewed without changing graph state.
Required data access
The identity used for retrieval needs the Search data role required by the knowledge base. Microsoft’s native integration example uses a project managed identity with Search Index Data Reader for read-only index access. Treat that as an example of the least-privilege read role, not as proof that every knowledge source has identical requirements.
For a standalone LangGraph host, do not assume a Foundry project identity is inherited automatically. Assign permissions to the identity that actually makes the HTTP request, and verify the token audience and claims match Azure AI Search.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
When Toolbox is preferable
A Foundry Toolbox can place a managed MCP-compatible entry point in front of the knowledge base. It is useful when several applications should consume the same tool configuration, when credential handling should be centralized, or when a platform team needs a single place to apply policy. Microsoft’s hosted-agent quickstart uses a managed identity with this arrangement.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →That hosted-agent identity setup does not automatically transfer to an arbitrary LangGraph deployment. The LangGraph process still needs a supported identity path to the Toolbox endpoint, and you must confirm that your MCP client supports the Toolbox connection mode you select.
How Foundry IQ retrieval works
Foundry IQ knowledge bases use Azure AI Search agentic retrieval. A knowledge base can coordinate retrieval across configured sources, plan or decompose a question, search with keyword, vector, or hybrid techniques, rerank results, and optionally synthesize an answer with source references.
Query planning is optional
Microsoft’s FAQ says an LLM is required for parallel processing of multiple subqueries. Without query planning, the service can still perform minimal retrieval reasoning and merge results from multiple sources. The documentation lists Azure OpenAI in Foundry Models gpt-4o, gpt-4.1, and gpt-5 series for query planning at the time documented. Check the current supported-model list before selecting a deployment because availability can change.
Retrieval is not the same as authorization
Document-level permissions are enforced only when a knowledge source supports them and the permissions are explicitly configured for synchronization, unless that source’s documentation specifies another behavior. A successful retrieval call therefore does not, by itself, prove that every document-level access boundary is active. Verify source configuration and runtime identity with representative restricted documents.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Grounding and source attribution in the graph
Use system instructions that define three separate classes of information:
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
- Retrieved evidence: statements supported by the current
knowledge_base_retrieveresult. - General model knowledge: background information not found in the knowledge base.
- Unsupported claims: details the retrieved material does not establish.
Require the answer to identify or link the returned source references when the retrieval response provides them. Also tell the model to state that it cannot verify an answer when the tool returns no supporting material. This prevents a fluent model response from being mistaken for a knowledge-base result.
For high-impact workflows, add application-level checks after the tool node. For example, reject a final response that claims a policy answer when the tool result contains no source reference, or route an empty result to a human review queue. These checks are separate from MCP and LangGraph wiring, but they make the grounding contract enforceable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test the integration before production
- Confirm endpoint construction. Check the Search service hostname, exact knowledge-base name, path spelling, and current API version.
- Confirm tool discovery. Log the discovered tool names without logging authorization headers. Verify that
knowledge_base_retrieveis present. - Test authorization independently. Use the same runtime identity and token path as the graph. Confirm the token is accepted by the endpoint.
- Run a known-answer query. Ask about a document with an unambiguous, distinctive fact and verify that the returned result includes the expected source reference.
- Test an unknown question. Confirm the model says the knowledge base does not support an answer rather than inventing one.
- Test source boundaries. Use identities with different permissions and verify that restricted material is handled according to the configured knowledge-source permissions.
- Exercise failures. Expire a token, use an invalid knowledge-base name in a test environment, and simulate an unavailable endpoint. Ensure the graph returns a controlled error instead of silently answering from memory.
- Check refresh behavior. Verify that long-running workers can obtain a fresh token and that a retry does not duplicate user-visible messages.
The documented components establish the APIs and connection patterns. They do not establish performance, latency, or success rates for every standalone LangGraph deployment, so measure those characteristics in the environment and region where you will operate.
Troubleshooting common failures
| Symptom | Checks | Likely correction |
|---|---|---|
| HTTP 403 from the MCP endpoint | Runtime identity, Search data role, token audience, token claims, and whether the token is still valid | Assign the required Search permission to the calling identity and acquire a token for the correct Azure resource |
| HTTP 400 or 404 | Search hostname, exact knowledge-base name, URL path, and API version | Rebuild the endpoint from the current Microsoft format and confirm the knowledge base exists in that Search service |
No tools returned by get_tools() |
HTTP transport setting, endpoint reachability, authentication header, and adapter version | Fix the MCP connection first; do not compile a graph that assumes retrieval is available |
| The graph answers without grounding | Whether discovery included knowledge_base_retrieve, whether the model is tool-capable, and whether the system prompt requires retrieval |
Bind the discovered tool, use a tool-capable model, and make the retrieval instruction explicit |
| Sources are missing from the final answer | Raw tool result, model instructions, and any response transformation that may discard metadata | Preserve source references in message state and instruct the model to attribute retrieved material |
| Restricted documents appear in results | Whether the source supports document-level permissions, synchronization settings, and the identity used at runtime | Configure supported permission synchronization and test with the actual caller identity |
Operational and security practices
- Use short-lived tokens and a managed identity or workload identity where available.
- Keep the endpoint and model deployment in configuration, not hard-coded graph logic, so an API-version change can be made without rewriting nodes.
- Redact authorization headers and sensitive retrieved content from application logs.
- Set timeouts and bounded retries around MCP calls. A retry policy should distinguish an expired token from a malformed endpoint or a permission failure.
- Record tool name, request correlation ID, latency, and success or failure status for observability, while following your data-retention policy for document content.
- Pin compatible package versions in deployment and test upgrades of LangGraph, LangChain, and the MCP adapter together.
- Keep retrieval and answer generation separate in audit records so investigators can see what evidence was available to the model.
Direct endpoint or Toolbox: a practical decision
Choose the direct endpoint when one LangGraph service owns the Azure identity, can rotate tokens safely, and needs the fewest moving parts. It gives the application a short path from graph to knowledge base, but credential acquisition, permission assignment, endpoint upgrades, and policy enforcement remain application responsibilities.
Choose Toolbox when several clients need the same MCP configuration or a platform team must manage credentials and policy centrally. It adds a service boundary and its own setup and identity decisions, but can prevent every consuming application from implementing separate connection logic.
“Azure AI Search knowledge bases expose the
knowledge_base_retrieveMCP tool for agent integration.”— Microsoft Foundry documentation, Connect a Foundry IQ knowledge base to Foundry Agent Service
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
In either route, the critical production checks are the same: the caller is authorized, the retrieval tool is discovered, source references survive the graph, and prompts prevent unsupported answers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
