Azure DevOps Management Context Protocol Server

This robust adapter furnishes a standardized interface via the Model Context Protocol (MCP) for interacting with Microsoft Azure DevOps services. It enables external systems and AI agents to orchestrate work items, manage source repositories, inspect build artifacts, and control project configurations.

Operational Summary

This server abstracts the underlying REST APIs of Azure DevOps, presenting a unified, protocol-compliant endpoint for managing standard ALM entities across cloud and on-premises installations.

Core Functionality Domains

The integration exposes capabilities categorized across eight primary functional areas:

Work Item Orchestration

Execution of WIQL queries for item retrieval.
Fetching granular data for specific work item identifiers.
Advanced searching across the work item store.
Retrieval of recently modified or user-assigned tasks.
Creation, updating, state transitions, and reassignment of tickets.
Managing hierarchical links and bulk modifications.

Board and Iteration Management

Querying team-specific Kanban boards and column layouts.
Retrieving and manipulating work items located on boards.
Accessing sprint definitions, current status, and team capacity planning.
Enumerating team membership.

Project Configuration Tools

Listing and creation of top-level projects.
Discovery of project metadata, area paths, and iteration structures.
Management of process templates and available work item schemas (fields).

Source Code (Git) Operations

Repository enumeration and detailed metadata retrieval.
Branch listing and content browsing (file retrieval).
Inspection of commit lineage.
Management of Pull Requests (listing, creation, detail fetching, review approval, and merging).

Quality Assurance & Testing Harness

Triggering automated test suites.
Reporting on test execution metrics and agent configuration.
Analysis tools: test impact assessment, flakiness diagnostics, and gap identification.
Management of exploratory testing sessions and result conversion into actionable work items.

Security and Compliance (DevSecOps)

Initiation and result retrieval for security scans (SAST/DAST).
Tracking reported vulnerabilities and generating compliance audit reports.
Policy enforcement checks and security awareness tracking.
Secret management utilities (rotation, auditing, vault integration).

Package and Artifact Handling

Management of artifact feeds and package version lifecycles (publishing, promotion, deletion).
Container image registry operations (listing, tagging, scanning).
Universal package handling and dependency reporting.

AI-Assisted Development Enhancements

Tools for generating AI-driven code critiques and suggestions (smells, optimizations).
Predictive analytics for effort estimation and bug probability.
Metrics retrieval for developer velocity and code quality trends.
Intelligent refinement of pending work items and automation opportunity detection.

Deployment and Initialization

Rapid Deployment via NPX

Execution is straightforward using the Node Package Execute utility:

bash npx @ryancardin/azuredevops-mcp-server@latest

Client Integration (Cursor Example)

Direct installation into supported IDE/MCP clients is facilitated via specialized deep links that pre-populate configuration details:

Crucial Step: Following automated setup, environment variables within the client's MCP settings must be updated with genuine organizational access details.

Server Configuration Variables

The adapter relies on environment variables for authentication and targeting. Configuration schemas differ slightly for cloud vs. on-premises deployments.

Variable Name	Purpose	Cloud Required	On-Prem Required
`AZURE_DEVOPS_ORG_URL`	Root URL of the Azure DevOps instance	Yes	Yes
`AZURE_DEVOPS_PROJECT`	Default project context	Yes	Yes
`AZURE_DEVOPS_IS_ON_PREMISES`	Boolean flag (`true`/`false`)	No	Yes (if applicable)
`AZURE_DEVOPS_AUTH_TYPE`	Method: `pat`, `ntlm`, `basic`, `entra`	No	No
`AZURE_DEVOPS_PERSONAL_ACCESS_TOKEN`	Security token for PAT authentication	Conditional	Conditional
`AZURE_DEVOPS_USERNAME`/`PASSWORD`	Credentials for legacy auth methods	No	No
`ALLOWED_TOOLS`	Restrict exposed functionality via comma-separated list	No	No

For on-premises setups, additional parameters such as AZURE_DEVOPS_COLLECTION and AZURE_DEVOPS_API_VERSION are mandatory.

Interaction Examples

Client interactions are structured as JSON messages directed to the MCP endpoint.

**Querying Active Work Items (WIQL): **

{ "tool": "listWorkItems", "params": { "query": "SELECT [System.Id], [System.Title] FROM WorkItems WHERE [System.State] = 'Active' ORDER BY [System.CreatedDate] DESC" } }

**Submitting a New Code Review Approval: **

{ "tool": "approvePullRequests", "params": { "repositoryId": "repo-guid-123", "pullRequestId": 42, "reviewerId": "user-alias" } }

Technical Structure

The codebase divides responsibilities into distinct layers for clarity and maintainability:

Service Layer: Handles all direct, low-level communication with the Azure DevOps REST APIs (e.g., WorkItemService, GitService).
Tools Layer: Wraps the service calls, applying necessary input validation and formatting responses specifically for the MCP protocol contract (e.g., WorkItemTools).

Tool registration occurs centrally within the main entry file (index.ts), where each exposed function is mapped to its corresponding implementation, schema definition, and documentation.

Security Note: PAT Generation

When configuring a Personal Access Token (PAT) for Azure DevOps Services, ensure the token's scope grants at minimum Read/Write access to Work Items and Code, alongside Read access for Project and Build/Release data, as required by the activated tools.