Add 12 new OneLake tools: Security, Shortcuts, Settings

- Data Access Security: list, get, create-or-update, delete roles
- Shortcuts: list, get, create-or-update, delete, reset-cache
- Settings: get, modify-diagnostics, modify-immutability-policy
- Refactored DFS ListPath methods to follow ADLS Gen2 Path List API spec
- Consolidated path resolution logic via ResolveDirectoryPath helper
- Added 233 unit tests (309 total OneLake tests passing)
- Updated OneLake and Fabric Server READMEs with new tool documentation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Srinivas Thatipamula

servers/Fabric.Mcp.Server/README.md

@@ -30,6 +30,9 @@ A local-first Model Context Protocol (MCP) server that provides AI agents with c
   - [Available Tools](#available-tools)
     - [API Documentation & Best Practices](#api-documentation--best-practices)
     - [OneLake Data Operations](#onelake-data-operations)
+    - [OneLake Security — Data Access Roles](#onelake-security--data-access-roles)
+    - [OneLake Shortcuts](#onelake-shortcuts)
+    - [OneLake Settings](#onelake-settings)
     - [Core Fabric Operations](#core-fabric-operations)
 - [Support and Reference](#support-and-reference)
   - [Documentation](#documentation)
@@ -250,6 +253,33 @@ The Fabric MCP Server exposes tools organized into three categories:
 | `onelake_list_tables` | Lists tables published within a namespace. |
 | `onelake_get_table` | Retrieves the definition for a specific table. |
 
+### OneLake Security — Data Access Roles
+
+| Tool Name | Description |
+|-----------|-------------|
+| `onelake_list_data_access_roles` | Lists all data access roles defined on a single item. |
+| `onelake_get_data_access_role` | Gets the full definition of a single data access role (members, permissions, decision rules). |
+| `onelake_create_or_update_data_access_role` | Upserts a single data access role on a single item. |
+| `onelake_delete_data_access_role` | Deletes a single data access role from an item. |
+
+### OneLake Shortcuts
+
+| Tool Name | Description |
+|-----------|-------------|
+| `onelake_list_shortcuts` | Lists shortcuts defined within an item, recursing through subfolders. |
+| `onelake_get_shortcut` | Gets the properties of a single shortcut. |
+| `onelake_create_or_update_shortcuts` | Creates or updates one or more shortcuts in a single call. |
+| `onelake_delete_shortcut` | Deletes a single shortcut from an item (preserves destination data). |
+| `onelake_reset_shortcut_cache` | Drops cached shortcut reads, forcing re-resolution from destination. |
+
+### OneLake Settings
+
+| Tool Name | Description |
+|-----------|-------------|
+| `onelake_get_settings` | Gets OneLake settings for a workspace (diagnostics + immutability policy). |
+| `onelake_modify_diagnostics` | Modifies diagnostic logging configuration at workspace scope. |
+| `onelake_modify_immutability_policy` | Modifies the workspace-level OneLake immutability policy. |
+
 ### Core Fabric Operations
 
 | Tool Name | Description |

servers/Fabric.Mcp.Server/changelog-entries/1778530260238.yaml

@@ -0,0 +1,3 @@
+changes:
+  - section: "Features Added"
+    description: "Added 12 new OneLake tools: Data Access Security (list, get, create-or-update, delete roles), Shortcuts (list, get, create-or-update, delete, reset-cache), and Settings (get, modify-diagnostics, modify-immutability-policy)"

servers/Fabric.Mcp.Server/changelog-entries/1778530268679.yaml

@@ -0,0 +1,3 @@
+changes:
+  - section: "Bugs Fixed"
+    description: "Refactored OneLake DFS ListPath methods to follow ADLS Gen2 Path List API specification (directory as query parameter)"

tools/Fabric.Mcp.Tools.OneLake/README.md

@@ -7,18 +7,24 @@ Microsoft Fabric OneLake MCP (Model Context Protocol) Tools - Manage and interac
 OneLake is Microsoft Fabric's built-in data lake that provides unified storage for all analytics workloads. This MCP tool provides operations for working with OneLake resources within your Fabric tenant, enabling AI agents to:
 
 - Manage OneLake folders and files
-- Configure data access and permissions
-- Monitor OneLake storage usage and performance
-- Integrate with other Fabric workloads through OneLake
+- Browse items, tables and namespaces
+- Configure OneLake data access security (role-based)
+- Create, list and manage shortcuts (including bulk + cache reset)
+- Read and modify workspace-level OneLake settings (diagnostics, immutability)
 
 **Features:**
-- 19 comprehensive OneLake commands with full MCP integration
+- 31 comprehensive OneLake commands with full MCP integration
 - Complete coverage for OneLake table APIs: configuration, namespace discovery, and table metadata
-- Friendly-name support for workspaces and items across data-plane commands ( `item-create` currently requires GUID IDs )
+- Data access security management: list, get, create/update, and delete roles
+- Shortcut management: list, get, create/update, delete, and cache reset
+- Workspace-level settings: diagnostics and immutability policy configuration
+- Friendly-name support for workspaces and items across all commands
 - Robust error handling and authentication
-- Production-ready with 100% test coverage (132 tests)
+- Production-ready with 100% test coverage (309 tests)
 - Clean, focused API design optimized for AI agent interactions
 
+> **Note:** Item creation has moved to the [Fabric.Mcp.Tools.Core](../Fabric.Mcp.Tools.Core/src) toolset as `core_create_item`. See [Core tools](../Fabric.Mcp.Tools.Core/src) for item creation operations.
+
 ## Prerequisites
 
 - Microsoft Fabric workspace with OneLake enabled
@@ -41,12 +47,14 @@ The OneLake MCP tools are configured to use the Microsoft Fabric production envi
 
 ```
 OneLake Data Plane: https://api.onelake.fabric.microsoft.com
-OneLake DFS API: https://onelake.dfs.fabric.microsoft.com
-OneLake Blob API: https://onelake.blob.fabric.microsoft.com
-OneLake Table API: https://onelake.table.fabric.microsoft.com
-Fabric API: https://api.fabric.microsoft.com/v1
+OneLake DFS API:    https://onelake.dfs.fabric.microsoft.com
+OneLake Blob API:   https://onelake.blob.fabric.microsoft.com
+OneLake Table API:  https://onelake.table.fabric.microsoft.com
+Fabric Core API:    https://api.fabric.microsoft.com/v1
 ```
 
+> **Endpoint routing:** Security, shortcut and settings tools call the **Fabric Core API** (`api.fabric.microsoft.com`). All other tools target the OneLake data plane / DFS / Blob / Table endpoints.
+
 ### Getting Started
 
 Simply use the commands without any environment configuration:
@@ -90,7 +98,7 @@ You can verify which environment you're targeting by checking the endpoints in t
 
 ### Workspace and Item Identifiers
 
-All commands except `item create` accept either GUID identifiers or friendly names via the `--workspace` and `--item` options. The existing `--workspace-id` and `--item-id` switches remain available for scripts that already depend on them. Friendly-name inputs are sent directly to the OneLake APIs without local GUID resolution; when using names, specify the item as `<itemName>.<itemType>` (for example, `SalesLakehouse.lakehouse`). `item create` currently requires the GUID-based `--workspace-id` option. Table-based commands additionally accept schema identifiers through `--namespace` or its alias `--schema`.
+All commands accept either GUID identifiers or friendly names via the `--workspace` and `--item` options. The existing `--workspace-id` and `--item-id` switches remain available for scripts that already depend on them. Friendly-name inputs are sent directly to the OneLake APIs without local GUID resolution; when using names, specify the item as `<itemName>.<itemType>` (for example, `SalesLakehouse.lakehouse`). Table-based commands additionally accept schema identifiers through `--namespace` or its alias `--schema`.
 
 ```bash
 dotnet run -- onelake file list --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse" --path "Files"
@@ -172,18 +180,7 @@ dotnet run -- onelake item list-data --workspace-id "47242da5-ff3b-46fb-a94f-977
 
 #### Create Item
 
-Creates a new item (Lakehouse, Notebook, etc.) in a Microsoft Fabric workspace using the Fabric API.
-
-```bash
-dotnet run -- onelake item create --workspace-id "47242da5-ff3b-46fb-a94f-977909b773d5" --display-name "NewLakehouse" --type "Lakehouse"
-```
-
-> **Note:** `item create` currently requires the GUID-based `--workspace-id` switch; friendly workspace names are not supported for this command yet.
-
-**Parameters:**
-- `--workspace-id`: The ID of the Microsoft Fabric workspace
-- `--display-name`: Display name for the new item
-- `--type`: Type of item to create (e.g., Lakehouse, Notebook)
+> **Moved:** The `item create` command has been moved to [Fabric.Mcp.Tools.Core](../Fabric.Mcp.Tools.Core/src) as `core_create_item`. Use the Core toolset for creating new items (Lakehouse, Notebook, etc.) in a Microsoft Fabric workspace.
 
 ### File Operations
 
@@ -629,6 +626,172 @@ dotnet run -- onelake table get --workspace-id "47242da5-ff3b-46fb-a94f-977909b7
 - `--namespace`/`--schema`: Namespace (schema) name
 - `--table`: Table name to retrieve
 
+### Security — Data Access Roles
+
+These tools manage role-based data access policies on OneLake items (Lakehouse / Warehouse). All security tools call the **Fabric Core API** and require the caller to be a workspace Admin or Member.
+
+#### List Data Access Roles
+
+Lists all data access roles defined on a single item.
+
+```bash
+dotnet run -- onelake security list --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse"
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--item`/`--item-id`: Item identifier
+
+#### Get Data Access Role
+
+Gets the full definition of a single data access role — members, permissions, decision rules.
+
+```bash
+dotnet run -- onelake security get --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse" --role-name "DataAnalysts"
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--item`/`--item-id`: Item identifier
+- `--role-name`: Name of the data access role to retrieve
+
+#### Create or Update Data Access Role
+
+Upserts a single data access role on a single item. Scoped to one role per call — does not affect other roles.
+
+```bash
+dotnet run -- onelake security create-or-update --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse" --role-name "DataAnalysts" --role-definition '{"members":{"fabricItemMembers":[{"itemAccessType":"ReadAll"}]},"decisionRules":[{"effect":"Permit","permission":[{"attributeName":"Path","attributeValueIncludedIn":["Tables/*"]}]}]}'
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--item`/`--item-id`: Item identifier
+- `--role-name`: Name of the data access role
+- `--role-definition`: JSON definition of the role (members + decision rules)
+
+#### Delete Data Access Role
+
+Deletes a single data access role from a single item. Destructive — principals that gained access only via this role lose it.
+
+```bash
+dotnet run -- onelake security delete --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse" --role-name "TempRole"
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--item`/`--item-id`: Item identifier
+- `--role-name`: Name of the data access role to delete
+
+### Shortcut Operations
+
+Shortcuts are references to data stored in external or internal locations (ADLS Gen2, S3, GCS, OneLake, Dataverse, etc.). These tools call the **Fabric Core API**.
+
+#### List Shortcuts
+
+Lists shortcuts defined within an item, recursing through subfolders.
+
+```bash
+dotnet run -- onelake shortcut list --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse"
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--item`/`--item-id`: Item identifier
+- `--parent-path`: (Optional) Parent path to scope the listing
+
+#### Get Shortcut
+
+Gets the properties of a single shortcut (name, path, target, configuration).
+
+```bash
+dotnet run -- onelake shortcut get --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse" --shortcut-name "ExternalData" --shortcut-path "Tables/ExternalData"
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--item`/`--item-id`: Item identifier
+- `--shortcut-name`: Name of the shortcut
+- `--shortcut-path`: Path of the shortcut within the item
+
+#### Create or Update Shortcuts
+
+Creates one or more shortcuts in a single call. Pass `--create-or-overwrite` to upsert (default fails on conflict).
+
+```bash
+dotnet run -- onelake shortcut create-or-update --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse" --shortcuts '[{"name":"ExternalData","path":"Tables/ExternalData","target":{"adlsGen2":{"location":"https://storageaccount.dfs.core.windows.net","subpath":"/container/path"}}}]'
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--item`/`--item-id`: Item identifier
+- `--shortcuts`: JSON array of shortcut definitions
+- `--create-or-overwrite`: (Optional) If set, overwrites existing shortcuts
+
+#### Delete Shortcut
+
+Deletes a single shortcut from an item. The destination data is preserved — only the shortcut reference is removed.
+
+```bash
+dotnet run -- onelake shortcut delete --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse" --shortcut-name "ExternalData" --shortcut-path "Tables/ExternalData"
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--item`/`--item-id`: Item identifier
+- `--shortcut-name`: Name of the shortcut to delete
+- `--shortcut-path`: Path of the shortcut
+
+#### Reset Shortcut Cache
+
+Drops cached shortcut reads for an item, forcing the next read to re-resolve from the destination. Use sparingly — primarily for debugging stale-cache issues.
+
+```bash
+dotnet run -- onelake shortcut reset-cache --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse"
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--item`/`--item-id`: Item identifier
+
+### Settings Operations
+
+Workspace-level OneLake settings for diagnostics and immutability policies. These tools call the **Fabric Core API**.
+
+#### Get Settings
+
+Gets the OneLake settings for a workspace — diagnostics configuration and immutability policy.
+
+```bash
+dotnet run -- onelake settings get --workspace "Analytics Workspace"
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+
+#### Modify Diagnostics
+
+Modifies the diagnostic logging configuration for OneLake at the workspace scope. Replaces the existing diagnostics block; fetch with `get settings` first if you want to merge.
+
+```bash
+dotnet run -- onelake settings modify-diagnostics --workspace "Analytics Workspace" --diagnostics-config '{"logAnalyticsWorkspaceId":"<workspace-id>","level":"Verbose"}'
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--diagnostics-config`: JSON configuration for diagnostic settings
+
+#### Modify Immutability Policy
+
+Modifies the workspace-level OneLake immutability policy. **Warning:** Once enabled, immutability cannot be disabled — confirm with the user before applying.
+
+```bash
+dotnet run -- onelake settings modify-immutability --workspace "Analytics Workspace" --immutability-policy '{"state":"Enabled"}'
+```
+
+**Parameters:**
+- `--workspace`/`--workspace-id`: Workspace identifier
+- `--immutability-policy`: JSON immutability policy configuration
+
 ## Quick Reference - fabmcp.exe Commands
 
 For users with the compiled `fabmcp.exe` executable, here are ready-to-use commands:
@@ -699,6 +862,45 @@ fabmcp.exe onelake table list --workspace "Analytics Workspace" --item "SalesLak
 fabmcp.exe onelake table get --workspace "Analytics Workspace" --item "SalesLakehouse.lakehouse" --schema "sales" --table "transactions"
 ```
 
+### Security Operations
+```cmd
+# List data access roles on an item
+fabmcp.exe onelake security list --workspace "47242da5-ff3b-46fb-a94f-977909b773d5" --item "0e67ed13-2bb6-49be-9c87-a1105a4ea342"
+
+# Get a specific role definition
+fabmcp.exe onelake security get --workspace "47242da5-ff3b-46fb-a94f-977909b773d5" --item "0e67ed13-2bb6-49be-9c87-a1105a4ea342" --role-name "DataAnalysts"
+
+# Delete a data access role
+fabmcp.exe onelake security delete --workspace "47242da5-ff3b-46fb-a94f-977909b773d5" --item "0e67ed13-2bb6-49be-9c87-a1105a4ea342" --role-name "TempRole"
+```
+
+### Shortcut Operations
+```cmd
+# List shortcuts on an item
+fabmcp.exe onelake shortcut list --workspace "47242da5-ff3b-46fb-a94f-977909b773d5" --item "0e67ed13-2bb6-49be-9c87-a1105a4ea342"
+
+# Get a specific shortcut
+fabmcp.exe onelake shortcut get --workspace "47242da5-ff3b-46fb-a94f-977909b773d5" --item "0e67ed13-2bb6-49be-9c87-a1105a4ea342" --shortcut-name "ExternalData" --shortcut-path "Tables/ExternalData"
+
+# Delete a shortcut
+fabmcp.exe onelake shortcut delete --workspace "47242da5-ff3b-46fb-a94f-977909b773d5" --item "0e67ed13-2bb6-49be-9c87-a1105a4ea342" --shortcut-name "ExternalData" --shortcut-path "Tables/ExternalData"
+
+# Reset shortcut cache
+fabmcp.exe onelake shortcut reset-cache --workspace "47242da5-ff3b-46fb-a94f-977909b773d5" --item "0e67ed13-2bb6-49be-9c87-a1105a4ea342"
+```
+
+### Settings Operations
+```cmd
+# Get workspace OneLake settings
+fabmcp.exe onelake settings get --workspace "47242da5-ff3b-46fb-a94f-977909b773d5"
+
+# Modify diagnostics configuration
+fabmcp.exe onelake settings modify-diagnostics --workspace "47242da5-ff3b-46fb-a94f-977909b773d5" --diagnostics-config '{"logAnalyticsWorkspaceId":"<id>","level":"Verbose"}'
+
+# Modify immutability policy
+fabmcp.exe onelake settings modify-immutability --workspace "47242da5-ff3b-46fb-a94f-977909b773d5" --immutability-policy '{"state":"Enabled"}'
+```
+
 **Note:** Replace the workspace identifier (`47242da5-ff3b-46fb-a94f-977909b773d5`) and item identifier (`0e67ed13-2bb6-49be-9c87-a1105a4ea342`) with your actual Fabric workspace and item values (names or IDs).
 
 ## Common Usage Patterns
@@ -831,9 +1033,9 @@ This tool is part of the Microsoft MCP (Model Context Protocol) project. Please
 The OneLake MCP Tools include a comprehensive test suite with 100% command coverage:
 
 #### Test Structure
-- **Total Tests**: 76 tests (all passing)
-- **Command Tests**: 70 tests covering all 11 OneLake MCP commands
-- **Service Architecture Tests**: 6 tests demonstrating testable patterns with dependency injection
+- **Total Tests**: 309 tests (all passing)
+- **Command Tests**: Covering all OneLake MCP commands including security, shortcuts, and settings
+- **Service Architecture Tests**: Demonstrating testable patterns with dependency injection
 
 #### Running Tests
 ```bash