Azure DevOps MCP Server

Brings on-premises Azure DevOps Server (including TFVC) to AI assistants with 49 tools for work items, repositories, pipelines, test plans, and wiki, along with profile-based secrets and write safety layers.

→ burcusipahioglu/azure-devops-mcp-onprem · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

✅

48 tools verified — handlers match their declared behaviour

40 read-only tools verified — handlers contain no write/delete/exec

✅

No credential exfiltration, no sensitive file access, no obfuscation

Static analysis found nothing flowing your secrets to unexpected places.

✅

Open source with a license and README

Anyone can audit the code, the license is declared, and the publisher documents what it does.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configAZURE_DEVOPS_AUDIT_LOG

configAZURE_DEVOPS_AUDIT_REDACT— Audit privacy: add =1 to keep numeric IDs and field shape but drop all string values (titles, comments, branch names). Useful when work-item content carries classified data.

configAZURE_DEVOPS_ENABLED_DOMAINS— work_items,tfvc,pipelines

configAZURE_DEVOPS_ENV_FILE— /abs/path That exact path

configAZURE_DEVOPS_MODE— Readonly mode Server refuses all 8 write tools with a clear error; reads unaffected. CI, demos, sandbox, emergency stop =readonly

configAZURE_DEVOPS_ORG_URL— Restart the client. All 48 tools appear in the tool picker. Server name is auto-detected from (e.g. https://dev.azure.com/acme → acme); override with AZURE_DEVOPS_SERVER_NAME.

configAZURE_DEVOPS_PAT— mcp.json configs sync to the cloud (Claude Desktop, VS Code Settings Sync), get pasted into tickets, end up in dotfile repos. Inlining there is one git add . away from a public leak.

configAZURE_DEVOPS_PROFILE— Profile-based secrets =name → gitignored .env.<name>; no PAT in cloud-synced mcp.json. Multi-instance is a natural byproduct.

configAZURE_DEVOPS_PROJECT— YourProjectName

configAZURE_DEVOPS_RATE_LIMIT_WRITES_PER_MIN— Rate limit Global sliding 60s window across all writes — runaway-loop fence, not a throughput regulator =10 (default; 0 disables)

configAZURE_DEVOPS_RESOURCE_DIR

configAZURE_DEVOPS_SERVER_NAME— Restart the client. All 48 tools appear in the tool picker. Server name is auto-detected from AZURE_DEVOPS_ORG_URL (e.g. https://dev.azure.com/acme → acme); override with .

configAZURE_DEVOPS_SSL_IGNORE— =true # uncomment for self-signed certs

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/burcusipahioglu-azure-devops-mcp-onprem-1txq8k)](https://m8ven.ai/mcp/burcusipahioglu-azure-devops-mcp-onprem-1txq8k)

commit: 6a00265b1bbcecc0e746ad51671dba2622f63439

code hash: a2c292c73d5adb18cf5728c576338da8de8842355220c3f9adb03289cf34806a

verified: 6/18/2026, 11:40:37 AM

view raw JSON →