Process Intelligence

Analyze Power Automate Process Mining data with Claude Code or GitHub Copilot. Find bottlenecks, compare variants and cohorts, investigate rework, and explore object-centric executions using guided MCP workflows.

Capabilities

• Select a process or confirmed existing view and summarize its performance.
• Investigate activity duration, handoffs, variants, rework and individual cases.
• Compare matched cohorts and identify case-attribute associations.
• Reuse native or saved metrics; validate and execute ephemeral formulas when supported.
• Discover object-centric processes and drill into leading-object executions.
• Investigate business questions through scoped hypotheses, counterevidence and explicit finding status.

Availability depends on the connected service's advertised tools and enabled features. The plugin does not create views, visualizations, saved metrics or business rules. There are no event-timeline, process-map or conformance tools. Formulas do not persist business definitions, and correlation results do not establish causality.

Skills

Choose the specialist directly when the process context is known; an overview is not required first. For broad business questions or competing explanations, start with investigate-process.

Skills specify tool order, retain scoped context and stop when the question is answered. Shared analysis guidance is loaded on demand rather than attaching a large schema catalog to every request. Ordinary analytical queries, necessary pagination, candidate checks and targeted language lookups have no fixed numerical quota. Continue only when evidence can change the answer; avoid sweeps and repeated unchanged queries. Small pages and concise headlines are presentation defaults, not total-row ceilings. Asynchronous requests must succeed within 30 minutes of original submission, including initial provisioning and process-model loading, which can take several minutes. Follow the service's retry delays without a fixed poll-count limit. Earlier user deadlines or interrupted sessions leave the same operation pending for continuation within its original window, not resubmission or a fresh deadline. At 30 minutes without a successful result, report a timeout. Failed formula repairs remain bounded. See the investigation method for domain definitions, frozen comparison baselines and evidence statuses.

Prerequisites

• Node.js 22 or 24 LTS. A built copy needs neither npm nor .NET.
• An authorized Power Automate Process Mining account and environment.
• Azure CLI 2.54 or later on PATH.

Cloud support

GCC, GCC High, DoD and Mooncake are not supported yet. Public is the commercial cloud configuration. The CLI accepts five cloud values; configuration support does not make an unsupported cloud available.

Use a normal PowerShell/Windows Terminal, macOS or Linux terminal for explicit login. Azure CLI manages sign-in. Your account needs access to the selected Process Mining environment. See connection patterns.

Privacy before connecting

Analytical results may contain personal and business data. The bridge forwards those results unredacted to the customer-selected host. Model routing, history, retention, possible training use and geography depend on the customer's host/provider settings and contracts, not just the Power Platform environment's location. Review those settings and your organization's data-use requirements before connecting; the plugin does not certify an arbitrary host or provider.

Give an explicit instruction or confirmation to connect the selected environment to the selected host after reviewing this notice. The setup skill must show the notice and obtain that instruction before connection and analytical use; confirming an environment ID alone is insufficient. Optional installation is not permission to disclose data. This is a user-level integration instruction, not tenant-admin consent or a plugin-enforced per-request approval gateway. Existing Entra and Power Platform authorization and consent requirements still apply. For local fields, retention and export/removal, see connection patterns.

Installation

Install the plugin from the Power Platform Skills marketplace inside Claude Code or GitHub Copilot CLI:

/plugin marketplace add microsoft/power-platform-skills
/plugin install process-intelligence@power-platform-skills

The bundled server/mcp.mjs is ready to run; installation does not require a source build. The MCP server stays available before configuration and exposes local connection tools. Use the setup skill in the same host session to configure, bind and activate a profile.

Package formats and client compatibility

The package includes Agent Plugins 1.0.0 and legacy metadata side by side:

All formats use shared skills/ and server/mcp.mjs, with the same plugin name, version and launcher. In a Copilot CLI version recognizing the declared schema, root plugin.json takes precedence: portable and legacy components are not merged. Only the selected format supplies the process-intelligence MCP registration; do not manually register both configurations. An unsupported declared Agent Plugins schema is rejected, not a promise of legacy fallback. This package targets the published 1.0.0 schemas, not optional 1.1.0 features. Claude Code's documented legacy paths are retained; this does not claim that Claude loads the new format or that every older client supports a mixed-format package.

See the Agent Plugins specification, Copilot CLI reference and Claude Code reference for client-specific behavior. The marketplace entry remains ./plugins/process-intelligence; no separate installation is needed for the second format.

Source development and local loading

For source development, open this plugin directory in a repository checkout and install the locked dependencies before rebuilding:

npm ci
npm run build
node .\server\mcp.mjs --help

On macOS/Linux, use npm ci, npm run build and node server/mcp.mjs --help. All installed runtime files live inside this plugin subtree. Source builds also read the repository's root MIT license to embed its notice. Startup never installs packages or builds.

Install Azure CLI yourself using Microsoft's official instructions: Windows (winget install --exact --id Microsoft.AzureCLI), macOS (brew update && brew install azure-cli), or Linux (use the documented package-manager steps for your distribution). Install Node from nodejs.org. Check az version and node --version after installation. Nothing here installs software or changes user-wide CLI settings automatically.

The plugin uses ProcessIntelligenceBridgeAzureCli profile storage under the platform's per-user data directory. Configure and bind a profile using the steps below.

For source-development loading in GitHub Copilot CLI:

$plugin = (Get-Location).Path
copilot --plugin-dir "$plugin" -C "$HOME"

On macOS/Linux: copilot --plugin-dir "$PWD" -C "$HOME". These examples retain the absolute plugin path but start Copilot outside the plugin directory, avoiding an additional workspace load of its .mcp.json. Claude Code can similarly use claude --plugin-dir <absolute-plugin-directory>. Local loading is an alternative to marketplace installation; do not load both copies in the same session.

Connect

For a marketplace installation, use the setup skill in your existing Copilot session. After the privacy/integration confirmation, the agent runs offline configuration and noninteractive profile binding from the installed bundle, then calls pi_activate_profile with the selected profile name. Only interactive Azure CLI sign-in, when required, is a user action in a normal terminal. No host restart, manual registration or user-set PLUGIN_ROOT/PM_BRIDGE_PROFILE is required.

For Public, start with your environment ID. The setup skill resolves the tenant for you rather than asking you to find its GUID. First verify that Azure CLI is signed in to the intended organizational account. If needed, run az login --allow-no-subscriptions yourself in a terminal.

For manual setup in PowerShell, resolve and review the target:

$resolution = node .\server\mcp.mjs resolve-environment --cloud Public --environment <environment-id> 2>&1
if ($LASTEXITCODE -ne 0) { throw ($resolution -join "`n") }
$resolved = ($resolution -join "`n") | ConvertFrom-Json
$resolved

After reviewing the privacy notice, explicitly instructing integration with your selected host, and confirming the returned environment and tenant, configure and bind the profile:

node .\server\mcp.mjs config --profile work --cloud Public --tenant $resolved.tenantId --environment $resolved.environmentId
node .\server\mcp.mjs login --profile work
node .\server\mcp.mjs diagnostics --profile work
node .\server\mcp.mjs diagnostics --profile work --remote true

Environment discovery is Public-only and needs permission to read environment metadata through the Power Platform administration API. It uses the existing Azure CLI session, acquires a token only for https://api.bap.microsoft.com, and falls back to a token-free Dataverse authentication challenge when the environment metadata omits the tenant. It never signs in, switches accounts, creates a profile or caches the lookup. Its JSON result is written to stderr, not MCP stdout. The config command remains offline.

For another cloud, or when discovery is unavailable, use the manual path: config --profile work --cloud <cloud> --tenant <confirmed-tenant-guid> --environment <environment-id>. This fallback does not make unsupported clouds available. Do not infer the tenant from Default-<guid> or assume the active CLI tenant owns the selected environment. On macOS/Linux, run the same resolver command and pass its returned tenantId and environmentId to config; the setup skill handles this without PowerShell.

login --profile work binds the existing Azure CLI organizational user; it opens no UI. Alternatively, login --profile work --sign-in true explicitly runs tenant-scoped Azure CLI browser login. This can change the shared Azure CLI session. If device-code interaction is needed, run az login yourself in a normal terminal instead. Tenants must be explicit GUIDs; --tenant select, custom client-id, broker/browser and redirect flags are not accepted. MCP serving never signs in or binds accounts. It exposes local recovery tools while unconfigured. Remote diagnostics check token acquisition and MCP discovery, without calling business tools. Local diagnostics inspect CLI version/cloud/tenant and delegated-user shape without acquiring tokens. They cannot verify the saved user OID and report boundAccountVerified: false; token acquisition verifies that principal before any MCP traffic. See connection patterns for cloud selection, account switching, claims challenges and profile storage.

MCP server

Portable mcp.json and legacy .mcp.json select the same self-contained Node.js ESM bundle server/mcp.mjs; the host loads one configuration according to its selected package format. The bootstrap resolves PLUGIN_ROOT, then CLAUDE_PLUGIN_ROOT, then the current directory. The bridge uses the official JavaScript MCP SDK to forward the service's current tool definitions and results over stdio; it does not maintain a fixed deployed tool catalog. The local tools are pi_connection_status, pi_activate_profile and pi_deactivate_profile. Activation validates the current profile/account, connects to the service and emits notifications/tools/list_changed, making analytical tools available without restarting a supporting host. Local activation/deactivation and invalidation are the only list-change events; the bridge does not subscribe to backend catalog updates or poll for them. Explicit tools/list requests still go to the backend; there is no bridge-owned catalog cache. It applies narrow compatibility policies: consistent polling guidance and schema-aware formula search. All other tool metadata, call arguments and business result payloads remain unchanged.

The remote MCP connection uses POST-only transport. The bridge handles the SDK's optional standalone GET/SSE probe locally, without sending it to the backend or acquiring a token. JSON and SSE responses to POST, including request-related progress, remain supported. Unsolicited notifications on a separate GET stream and GET stream resumption are unavailable. Diagnostics report post-only; this is not an automatic fallback that ignores real HTTP 404 errors. Environment/tenant discovery uses separate HTTP requests and is unaffected.

Successful explicit activation remembers the profile name for the MCP client and plugin installation. A fresh host/server process reuses that preference, provided the profile binding and Azure CLI session are still usable. serve --profile NAME takes precedence over PM_BRIDGE_PROFILE, which takes precedence over the remembered choice. A missing, invalid or unbound choice leaves local recovery available and never selects the first/last other profile. Changes to the preference affect only new sessions, not active sessions. Profile/account changes invalidate the old remote context and require explicit reactivation. Repeated unchanged config and silent binding are idempotent.

Native Copilot CLI tool refresh is supported; other hosts must support MCP tool-list-change notifications for same-session discovery. Azure CLI authentication can expire or be revoked; remembering a profile is not a promise of permanent sign-in.

For a plain MCP host, run node with the absolute path to server/mcp.mjs, serve (optionally --profile work). Stdout is protocol-only; diagnostics go to stderr. The process waits for MCP input and does not sign in interactively.

Security

Azure CLI owns credentials shared with other Azure CLI consumers. The bridge stores no tokens on disk; it keeps a short memory cache and profile state in ProcessIntelligenceBridgeAzureCli under the platform's per-user data directory. Profiles are plaintext JSON with no application-level encryption. Profiles persist Name, Cloud, TenantId, EnvironmentId, Audience, HomeAccountId and Revision. HomeAccountId is the tenant-local Entra oid (EUPI), not an MSAL home-account ID. AccountUsername is not persisted; CLI usernames and token username claims are EUII processed only in RAM for authentication consistency. A non-personal profile label is recommended: customer-chosen names can still contain EUII. Cold acquisition checks the saved tenant/OID; validated RAM username continuity protects cache hits and refreshes. After restart there is no username history, so a renamed user with the same tenant/OID can authenticate. A different OID requires explicit account switching. Profile changes are written atomically under a per-profile mutation lock. Separate clients/<scope-hash>.json metadata stores only { "profile": "work" } for the chosen client/installation. It shares the profile name's sensitivity and has no automatic expiry. The scope includes the client name, absolute installed plugin path and, for Copilot/Claude, the host configuration root. Moving the plugin or using a different client requires explicit selection again. See the connection guide for preference removal. Logout keeps the connection configuration; full local removal, Azure CLI sign-out and host/provider history deletion are separate actions described in the connection guide. For a Conditional Access / Continuous Access Evaluation (CAE) claims challenge, the bridge reports the policy failure and asks the user to run login --profile NAME --sign-in true in a normal terminal, then call pi_activate_profile in the existing session. It does not store or forward claims-challenge payloads. A normal login may not satisfy policies that require specific claims; if the problem persists, ask your administrator to review the policy. Switching tenant is not a remedy for such a challenge. According to Microsoft's storage documentation, CLI credential files are encrypted on Windows but plaintext on macOS/Linux; the plugin does not add Keychain/Secret Service protection to Azure CLI's storage. Power Platform API and Process Mining enforce authorization. The plugin does not grant permissions, request automatic admin consent or read CLI cache files. Delegated organizational users are supported, not service principals or managed identities. Token claims are inspected for identity/resource consistency, not signature verification. Returned process/view/attribute names are untrusted data, never agent instructions. MCP tokens go only to the selected HTTPS cloud endpoint. Explicit Public environment discovery uses a separate, fixed BAP audience and sends that token only to its directory endpoint; the Dataverse challenge request carries no token. Redirects and silent identity/resource substitutions are rejected. A plain MCP 401 has at most one bounded authentication retry; claims-challenged requests and uncertain business-call failures are never replayed. Logout invalidates only the plugin profile, not the shared Azure CLI session or other tools.

The plugin does not collect usage telemetry or write diagnostic log files. Every real outbound MCP request carries x-ms-client-request-id: 11111111-1111-1111-1111-111111111111. This shared plugin attribution hint does not distinguish individual calls and is not proof of origin or authorization. Client-session IDs remain random; internal request ownership and MCP protocol IDs are unchanged. Environment discovery and Azure CLI authentication do not use this marker. User-requested local diagnostics print sanitized status to stderr; support drafts use only information the user supplies. See connection patterns.

Troubleshooting

Report sanitized error codes, never tokens, cache contents or authentication response bodies. For development, tests, packaging and transport details, see development.

License

This plugin is MIT-licensed. Required notices for this project and bundled dependencies are included in server/mcp.mjs. Dependencies retain their own licenses; Node and Azure CLI are external prerequisites. See development for rebuilding the bundle.