Azure DevOps MCP Server

Governed access to on-prem Azure DevOps (including TFVC) for AI agents and assistants, with typed tools, chainable workflows, and a server-side write-safety layer.

Query work items, repositories, and pipelines in natural language — running locally, no cloud proxy, no telemetry.

Coverage · TFVC · Profiles · Write Safety · Setup

---

At a glance

TFVC native	10 dedicated tools — shelvesets (incl. shelved file content), changesets, diffs, work-item linkage. The reason this server exists.
Write safety	6 layers — MCP annotations · confirmation directive · readonly kill switch · rate limit · dry-run on every write · audit log
Local / on-prem only	PAT auth, no cloud proxy, no third-party calls, no telemetry
48 tools / 6 domains	Work Items · Git · TFVC · Pipelines · Wiki · Test Plans
Typed results	outputSchema + structuredContent on the 8 most-chained read tools — schema-validated results an agent can chain into the next tool without parsing prose
@me token	owner / author / reviewer / assignedTo accept @me — resolved per tenant, stateless for multi-agent setups
PR review flow	/review_pull_request → structured advisory review → on request, published to the PR as file-anchored comments, each one confirmed first
Profile-based secrets	AZURE_DEVOPS_PROFILE=name → gitignored .env.<name>; no PAT in cloud-synced mcp.json. Multi-instance is a natural byproduct.
AI clients	Claude (Code/Desktop), GitHub Copilot, Cursor, Visual Studio Code — any MCP-compatible client

Example questions

"Show me all active bugs assigned to me in this sprint" "What changed in changeset 12345?" "Review PR 123 and post the findings as comments" "List my latest shelvesets" "Trigger the nightly build on the release branch"

---

Coverage

One server across the whole development cycle — Plan, Code, Review, Build & Release, Test, Document — with your own templates exposed as MCP resources alongside the built-in tools and prompts. Every write passes a server-side governance layer — readonly mode, dry-run preview, rate limit, and audit log (see Write Safety); tools can also be scoped per role (see Restrict tools per role below).

Full per-tool parameter reference: Tool Reference ↓

Restrict tools per role

Set AZURE_DEVOPS_ENABLED_DOMAINS to a comma-separated list — disabled domains aren't registered, trimming the AI client's tool list and reducing tool-selection confusion. Default loads all 6. get_current_user is core and always registered.

Role	Domains
Project manager	work_items,wiki
Developer (TFVC)	work_items,tfvc,pipelines
Developer (Git)	work_items,git,pipelines
QA / tester	work_items,test_plans,git
DevOps / release	work_items,pipelines,git,tfvc
Read-only / analyst	work_items,wiki

Unknown domain names fail at startup — no silent typos. Startup log reports what loaded:

Enabled domains (3/6): work_items, tfvc, pipelines
Disabled domains: git, wiki, test_plans

---

TFVC support