AzureDevOps-MCP (RyanCardin15/AzureDevOps-MCP) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 97 tools. No publisher has claimed this listing.

Warning

74/100

AzureDevOps-MCP

Item: AzureDevOps-MCP
Rating: 74
Author: M8ven

This server provides a convenient API for interacting with Azure DevOps services, enabling AI assistants and other tools to manage work items, code repositories, boards, sprints, and more. Built with the Model Context Protocol, it provides a standardized interface for communicating with Azure DevOps

→ RyanCardin15/AzureDevOps-MCP · listed on modelscope

Warning. Serious findings were identified. Review the full report before connecting. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

RyanCardin15

Source: ModelScope

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

ModelScopenot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Reads files from sensitive locations

Touches: .env

🔐

You'll be asked for 2 credentials: AZURE_DEVOPS_PASSWORD, AZURE_DEVOPS_PERSONAL_ACCESS_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes97 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

listWorkItems

List work items based on a WIQL query

getWorkItemById

Get a specific work item by ID

searchWorkItems

Search for work items by text

getRecentlyUpdatedWorkItems

Get recently updated work items

getMyWorkItems

Get work items assigned to you

createWorkItem

Create a new work item

updateWorkItem

Update an existing work item

addWorkItemComment

Add a comment to a work item

updateWorkItemState

Update the state of a work item

assignWorkItem

Assign a work item to a user

createLink

Create a link between work items

bulkCreateWorkItems

Create or update multiple work items in a single operation

getBoards

Get all boards for a team

getBoardColumns

Get columns for a specific board

getBoardItems

Get items on a specific board

moveCardOnBoard

Move a card on a board

getSprints

Get all sprints for a team

getCurrentSprint

Get the current sprint

getSprintWorkItems

Get work items in a specific sprint

getSprintCapacity

Get capacity for a specific sprint

getTeamMembers

Get members of a team

listProjects

List all projects

getProjectDetails

Get details of a specific project

createProject

Create a new project

getAreas

Get areas for a project

getIterations

Get iterations for a project

createArea

Create a new area in a project

createIteration

Create a new iteration in a project

getProcesses

Get all processes

getWorkItemTypes

Get work item types for a process

getWorkItemTypeFields

Get fields for a work item type

listRepositories

List all repositories

getRepository

Get details of a specific repository

createRepository

Create a new repository

listBranches

List branches in a repository

searchCode

Search for code in repositories

browseRepository

Browse the contents of a repository

getFileContent

Get the content of a file

getCommitHistory

Get commit history for a repository

listPullRequests

List pull requests

createPullRequest

Create a new pull request

getPullRequest

Get details of a specific pull request

getPullRequestChangedFiles

Get changed files in a pull request

getPullRequestComments

Get comments on a pull request

approvePullRequest

Approve a pull request

mergePullRequest

Merge a pull request

runAutomatedTests

Execute automated test suites

getTestAutomationStatus

Check status of automated test execution

configureTestAgents

Configure and manage test agents

createTestDataGenerator

Generate test data for automated tests

manageTestEnvironments

Manage test environments for different test types

getTestFlakiness

Analyze and report on test flakiness

getTestGapAnalysis

Identify gaps in test coverage

runTestImpactAnalysis

Determine which tests to run based on code changes

getTestHealthDashboard

View overall test health metrics

runTestOptimization

Optimize test suite execution for faster feedback

createExploratorySessions

Create new exploratory testing sessions

recordExploratoryTestResults

Record findings during exploratory testing

convertFindingsToWorkItems

Convert exploratory test findings to work items

getExploratoryTestStatistics

Get statistics on exploratory testing activities

runSecurityScan

Run security scans on repositories

getSecurityScanResults

Get results from security scans

trackSecurityVulnerabilities

Track and manage security vulnerabilities

generateSecurityCompliance

Generate security compliance reports

integrateSarifResults

Import and process SARIF format security results

runComplianceChecks

Run compliance checks against standards

getComplianceStatus

Get current compliance status

createComplianceReport

Create compliance reports for auditing

manageSecurityPolicies

Manage security policies

trackSecurityAwareness

Track security awareness and training

rotateSecrets

Rotate secrets and credentials

auditSecretUsage

Audit usage of secrets across services

vaultIntegration

Integrate with secret vaults

listArtifactFeeds

List artifact feeds in the organization

getPackageVersions

Get versions of a package in a feed

publishPackage

Publish a package to a feed

promotePackage

Promote a package version between views

deletePackageVersion

Delete a version of a package

listContainerImages

List container images in a repository

getContainerImageTags

Get tags for a container image

scanContainerImage

Scan a container image for vulnerabilities and compliance issues

manageContainerPolicies

Manage policies for container repositories

manageUniversalPackages

Manage universal packages

createPackageDownloadReport

Create reports on package downloads

checkPackageDependencies

Check package dependencies and vulnerabilities

getAICodeReview

Get AI-based code review suggestions

suggestCodeOptimization

Suggest code optimizations using AI

identifyCodeSmells

Identify potential code smells and anti-patterns

getPredictiveBugAnalysis

Predict potential bugs in code changes

getDeveloperProductivity

Measure developer productivity metrics

getPredictiveEffortEstimation

AI-based effort estimation for work items

getCodeQualityTrends

Track code quality trends over time

suggestWorkItemRefinements

Get AI suggestions for work item refinements

suggestAutomationOpportunities

Identify opportunities for automation

createIntelligentAlerts

Set up intelligent alerts based on patterns

predictBuildFailures

Predict potential build failures before they occur

optimizeTestSelection

Intelligently select tests to run based on changes

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configALLOWED_TOOLSAll tools

configAZURE_DEVOPS_API_VERSIONAPI version for on-premises No -

configAZURE_DEVOPS_AUTH_TYPEpat

configAZURE_DEVOPS_COLLECTIONCollection name for on-premises No -

configAZURE_DEVOPS_DOMAINDomain for NTLM auth No -

configAZURE_DEVOPS_IS_ON_PREMISESfalse

configAZURE_DEVOPS_ORG_URLURL of your Azure DevOps organization or server Yes -

🔐 secretAZURE_DEVOPS_PASSWORDPassword for NTLM/Basic auth No -

🔐 secretAZURE_DEVOPS_PERSONAL_ACCESS_TOKENPersonal access token (for 'pat' auth) No -

configAZURE_DEVOPS_PROJECTDefault project to use Yes -

configAZURE_DEVOPS_USERNAMEUsername for NTLM/Basic auth No -

configMCP_MODE

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

97/97 tools missing one or more hints — listWorkItems (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); getWorkItemById (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); searchWorkItems (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +94 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

No access to sensitive paths

Reads sensitive paths: .env

Remove reads of sensitive system paths. If you genuinely need them, document why in the README.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 4 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/ryancardin15/azuredevops-mcp?variant=verified)](https://m8ven.ai/mcp/ryancardin15/azuredevops-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: 249bb4743e8860a38d643f9095cc5539c96ef80b

code hash: 049fbaa1142d017813dd53f787be632a0169666be8825cd7a56b7740b83b06c9

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client