mcp-server-azure-devops — Watchlist

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Monitor this implementation for changes in adoption, MCP interface, maintenance and permission boundary.

Reviewed Oct 10, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

Read and modify Azure DevOps work items and project resources

What we know

An MCP server for Azure DevOps Read and modify Azure DevOps work items and project resources.

Maintenance / activity evidence

GitHub REST pushed_at 2026-10-09T16:41:03Z

Tracking evidence observed Oct 10, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: medium.

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Scoped by connected account, local OS, and configuration; verify exact permissions before installation. Reported action classes: potential work item changes; not verified. Complete write authority is not verified.
Azure DevOps personal access token / organisation settings
Sensitive access: Repository and work item data

Permissions depend on access-token scopes; writes may affect project records; enumerate tools before enabling write access.

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

393 repository stars

Stars observed Oct 9, 2026.

Repository total for Tiberriver256/mcp-server-azure-devops.

All limitations / Review context

Has mcp-server-azure-devops changed its specific MCP integration, install method or privilege scope, and does it justify shortlist promotion?

High-impact permissions explicitly documented; no known blocker to an accurately caveated public Radar listing in limited first-party review.

Permissions depend on access-token scopes; writes may affect project records; enumerate tools before enabling write access.
Scoped by connected account, local OS, and configuration; verify exact permissions before installation.
Azure DevOps personal access token / organisation settings
Repository and work item data
Reviewed write actions: potential work item changes; not verified
Sensitive access: Repository and work item data
Complete write authority is not verified.
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
No exhaustive advisory or runtime review performed; never infer installation safety.
Write actions/tool inventory not confirmed against exact tool documentation; listed action classes remain illustrative or context-dependent. Empty inventory does not establish read-only.
Setup and runtime permissions are implementation- and account-specific; follow linked upstream documentation.
Repository pushed_at explicitly observed

Original activity observations

GitHub REST pushed_at 2026-10-09T16:41:03Z

Technical identity

github.com/Tiberriver256/mcp-server-azure-devops

Exact implementation source: https://github.com/Tiberriver256/mcp-server-azure-devops ↗
Reviewed resource type: MCP Server
Repository identity: Tiberriver256/mcp-server-azure-devops

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 10, 2026 · Latest source observation Oct 10, 2026

GitHub repository ↗
tiberriver256/mcp-server-azure-devops
Recorded repository material and project history.

Setup · Watchlist

Install & Agents

Publisher instructions.

Source evidence observed Oct 12, 2026.

Additional setup details required — see the specific gaps below.

Install / connect
Publisher instructions
Run the publisher package via npx from a configured MCP client. Select ONE authorization route: Azure Identity (requires az login) or Personal Access Token (PAT).
npx -y @tiberriver256/mcp-server-azure-devops

Configure / authenticate

MCP100 setup guide

Use ONE Azure DevOps authentication mode: Azure Identity, Azure CLI or PAT, matching docs/authentication.md. Set AZURE_DEVOPS_ORG_URL and optional project. Use az login for local Azure CLI/Identity, or create a limited-expiry scoped PAT and set AZURE_DEVOPS_AUTH_METHOD=pat plus AZURE_DEVOPS_PAT. On-prem Azure DevOps Server supports PAT only; do not publish credentials.

Advanced configuration · azure cli authentication

azure cli authentication · Review before use

az login

Advanced configuration · mcpServers json

{
  "mcpServers": {
    "azureDevOps": {
      "args": [
        "-y",
        "@tiberriver256/mcp-server-azure-devops"
      ],
      "command": "npx",
      "env": {
        "AZURE_DEVOPS_AUTH_METHOD": "azure-identity",
        "AZURE_DEVOPS_DEFAULT_PROJECT": "your-project-name",
        "AZURE_DEVOPS_ORG_URL": "https://dev.azure.com/your-organization"
      }
    }
  }
}

Advanced configuration · mcpServers json PAT alternative

{
  "mcpServers": {
    "azureDevOps": {
      "args": [
        "-y",
        "@tiberriver256/mcp-server-azure-devops"
      ],
      "command": "npx",
      "env": {
        "AZURE_DEVOPS_AUTH_METHOD": "pat",
        "AZURE_DEVOPS_DEFAULT_PROJECT": "your-project-name",
        "AZURE_DEVOPS_ORG_URL": "https://dev.azure.com/your-organization",
        "AZURE_DEVOPS_PAT": "REPLACE_WITH_YOUR_PAT"
      }
    }
  }
}

Check connection
Suggested check
Inspect the registered Azure DevOps tool listing, then try a read-only project query with the minimum required permissions. Diagnose invalid/expired credentials, insufficient scopes, wrong org URL or inaccessible default project via the official authentication guide.
Remove / uninstall / revoke
Delete the exact `azureDevOps` MCP entry from Claude Desktop/Cursor MCP client configuration and reload the client. Leave Azure DevOps account, PAT and repositories unchanged. No client-side unregister is equivalent to Azure token revocation.

Official Documentation & Sources

What it does

An MCP server for Azure DevOps Read and modify Azure DevOps work items and project resources.

Capability: Developer Tools
Resource type: MCP Server
Best fit: Read and modify Azure DevOps work items and project resources

Representative uses

Inspect repository and project data
Support development or testing tasks
Automate bounded tool workflows
Read and modify Azure DevOps work items and project resources

Limitations

Permissions depend on access-token scopes; writes may affect project records; enumerate tools before enabling write access.
Setup and runtime permissions are implementation- and account-specific; follow linked upstream documentation.
Repository pushed_at explicitly observed

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Azure DevOps personal access token / organisation settings
Permissions: Scoped by connected account, local OS, and configuration; verify exact permissions before installation.
Data handling: Repository and work item data
Cost: may incur external API or infrastructure charges; unverified
Risk and cautions: Permissions depend on access-token scopes; writes may affect project records; enumerate tools before enabling write access.

Access scope and cautions

Write actions: Not verified potential work item changes; not verified
Sensitive access: Repository and work item data
Risk level: high
Security notes: Permissions depend on access-token scopes; writes may affect project records; enumerate tools before enabling write access.

The reviewed evidence does not establish the complete write authority of this MCP. Consult the unresolved evidence before granting write access.

FAQ

Based on reviewed evidence as of 2026-10-09. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Inspect repository and project data; Support development or testing tasks; Automate bounded tool workflows; Read and modify Azure DevOps work items and project resources.

What setup and authentication are documented?

A complete connection procedure is not verified. Client notes: Command provided only where first-party command or package existence is established; verify the client configuration against upstream documentation. Installation/authentication detail is incomplete; do not infer settings from package name. These facts do not supply missing installation commands, credentials or a verified authentication procedure. Authentication: Azure DevOps personal access token / organisation settings

Can it modify data or perform write operations?

Not verified. The available evidence does not establish the complete write authority. The partial inventory lists: potential work item changes; not verified. Recorded permission context: Scoped by connected account, local OS, and configuration; verify exact permissions before installation.

What data-handling boundary should I consider?

Repository and work item data Recorded sensitive-access context: Repository and work item data.

What limitations and risks should I check before use?

Permissions depend on access-token scopes; writes may affect project records; enumerate tools before enabling write access. Setup and runtime permissions are implementation- and account-specific; follow linked upstream documentation. Repository pushed_at explicitly observed. No exhaustive advisory or runtime review performed; never infer installation safety.