Azure DevOps MCP (official)
Capped at 70: no passing tool call yet; the tests add up to 95. Why scores are capped
Test points add up to 95; the score is capped at 70 until a tool call passes. Not a quality or security rating. Methodology
Test points before the cap (95/100)
- Install20/20
- Handshake30/30
- Maintenance25/25
- Docs10/15
- License10/10
Tested npm @azure-devops/mcp 2.11.0 (MIT; repo microsoft/azure-devops-mcp, 2,085 GitHub stars when checked). Takes the organization name as its first argument; the default sign-in is an interactive Microsoft browser login, which we don't do. Initialize and tools/list worked (44 tools, with read-only hints on 29). For the real call we started it with --authentication envvar and no token: core_list_projects answered that ADO_MCP_AUTH_TOKEN is not set. Core tools not tested. Many tools write work items, pull requests, branches and wiki pages; none were called.
Tool-call test (2026-11-11, direct MCP stdio client, no LLM): fail. 0 of 1 call passed; every tool needs an Azure DevOps sign-in or token. Core tools not tested. Evidence: local test run, Nov 11, 2026.
Transport (tested 2026-11-11): stdio
Token cost (estimate): approx. 16641 tokens, cl100k estimate (44 tools, measured 2026-11-11, version 2.11.0). This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k_base.
Permissions: 26 read, 18 write (state-changing), 0 unclassified · Auth: API key · Rate limit: unknown · Pricing unit: unknown
Auth: API key. Rate limit: unknown. Pricing unit: unknown.
advsec_get_alert_details— readadvsec_get_alerts— readcore_get_identity_ids— readcore_list_project_teams— readcore_list_projects— readpipelines_artifact— write (state-changing)pipelines_build— readpipelines_build_log— readpipelines_definition— readpipelines_run— readpipelines_write— write (state-changing)repo_branch— readrepo_create_branch— write (state-changing)repo_file— readrepo_file_write— write (state-changing)repo_pull_request— readrepo_pull_request_org— readrepo_pull_request_thread— readrepo_pull_request_thread_write— write (state-changing)repo_pull_request_write— write (state-changing)repo_repository— readrepo_search_commits— readsearch_code— readsearch_wiki— readsearch_workitem— readtestplan— readtestplan_show_test_results_from_build_id— readtestplan_test_case_write— write (state-changing)testplan_test_plan_write— write (state-changing)testplan_test_suite_write— write (state-changing)wiki— readwiki_upsert_page— write (state-changing)wit_backlog— write (state-changing)wit_query— readwit_work_item— readwit_work_item_attachment— readwit_work_item_attachment_link— write (state-changing)wit_work_item_attachment_upload— write (state-changing)wit_work_item_comment_write— write (state-changing)wit_work_item_link_write— write (state-changing)wit_work_item_write— write (state-changing)work— readwork_capacity_write— write (state-changing)work_iteration_write— write (state-changing)
listing-flags calls_need_key or auth_kind
Score 70/100 · Tools 44 · Token cost approx. 16,641 tokens · Compare · Last tested 2026-11-11 · Version tested 2.11.0 · Package @azure-devops/mcp · Repo microsoft/azure-devops-mcp
Summary: Azure DevOps MCP (official) completed an MCP handshake without credentials and exposed 44 tools.
Evidence summary
- Handshake
- pass
- Tools listed
- 44
- Context cost
- approx. 16641 tokens, cl100k estimate (44 tools, measured 2026-11-11, version 2.11.0; an estimate) ranking · add up your servers' context cost
- API key
- Connects without a key; tool calls need one
- Tested
- 2026-11-11
Test results
| Test | Result | Points | Evidence |
|---|---|---|---|
| install | pass | 20 | npm install @azure-devops/mcp (Node 20, Linux) succeeded in 4s. |
| handshake | pass | 30 | MCP initialize + tools/list over stdio succeeded with no credentials; 44 tools listed in 15.3s. |
| maintenance | pass | 25 | Repo pushed 4 days before test; 2,085 GitHub stars. |
| docs | partial | 10 | README over 3,000 chars; install instructions present. Check of the package's own README (README shipped in npm package). |
| license | pass | 10 | MIT (OSI-approved). |
Local-model readiness
Token cost (estimate): approx. 16641 tokens, cl100k estimate for 44 tools · about 203% of an 8k context. This is an estimate from our testing (counted with cl100k_base).
Small-model friendly (schema heuristic, not a model result): unknown.
Not tested
Small-model task runs: Not yet tested.
What we tested and what we didn't
Tested on 2026-11-11
- Install from the registry
- We connected with no credentials and asked for its tool list: it listed 44 tools (Method details: MCP
initializethentools/list) - Maintenance signals (last push, archived/deprecated status)
- Docs (README length, install and config example)
- License (OSI-approved or not)
- Token cost (estimate)
Not tested
- Security: not audited (no code review, no permission or data-flow analysis)
- Real tasks (no functional task runs yet)
- Behaviour with real credentials or a real account
- Performance, rate limits or load
- Correctness of results beyond the listed tasks
Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.
Known security issues
Checked on 2026-11-11 for version 2.11.0 against OSV, GitHub advisories, GitHub repository advisories. Scope: the package itself; dependencies not scanned.
No published advisories found in OSV and GitHub advisories for @azure-devops/mcp 2.11.0 as of 2026-11-11. This is not a security audit.
Monthly roundup: MCP security issues, October 2026.
Tool list changes
Baseline recorded from the 2026-11-11 test run; changes appear after the next test.
Snapshot hash (fingerprint of the tool list)
fc81f0c2cabf: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.
Raw test record (JSON)
{
"name": "@azure-devops/mcp",
"version": "2.11.0",
"registry": "npm",
"status": "working",
"tested": "2026-11-11",
"tools_count": 44,
"deprecated": false,
"archived": false,
"tests": {
"install": [
"pass",
20,
"`npm install @azure-devops/mcp` (Node 20, Linux) succeeded in 4s."
],
"handshake": [
"pass",
30,
"MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 44 tools listed in 15.3s."
],
"maintenance": [
"pass",
25,
"Repo pushed 4 days before test; 2,085 GitHub stars."
],
"docs": [
"partial",
10,
"README over 3,000 chars; install instructions present. Check of the package's own README (README shipped in npm package)."
],
"license": [
"pass",
10,
"MIT (OSI-approved)."
]
}
}Install
npx -y @azure-devops/mcp testedmcp-sample-org
Pin the version we tested
npx -y @azure-devops/mcp@2.11.0 testedmcp-sample-org
tested 2026-11-11. Newer versions may differ and were not tested by us.
{
"mcpServers": {
"azure-devops-mcp": {
"command": "npx",
"args": [
"-y",
"@azure-devops/mcp@2.11.0",
"testedmcp-sample-org"
]
}
}
}Tools listed
advsec_get_alert_details, advsec_get_alerts, core_get_identity_ids, core_list_project_teams, core_list_projects, pipelines_artifact, pipelines_build, pipelines_build_log, pipelines_definition, pipelines_run, pipelines_write, repo_branch, repo_create_branch, repo_file, repo_file_write, repo_pull_request, repo_pull_request_org, repo_pull_request_thread, repo_pull_request_thread_write, repo_pull_request_write, repo_repository, repo_search_commits, search_code, search_wiki, search_workitem, testplan, testplan_show_test_results_from_build_id, testplan_test_case_write, testplan_test_plan_write, testplan_test_suite_write, wiki, wiki_upsert_page, wit_backlog, wit_query, wit_work_item, wit_work_item_attachment, wit_work_item_attachment_link, wit_work_item_attachment_upload, wit_work_item_comment_write, wit_work_item_link_write
Tool history: captured Nov 11, 2026. All tool history.
Quick config
{
"mcpServers": {
"azure-devops-mcp": {
"command": "npx",
"args": [
"-y",
"@azure-devops/mcp",
"testedmcp-sample-org"
]
}
}
}Add to config Opens the config generator with this server selected.
Setup
- Install. Run
npm install @azure-devops/mcp(Node 20). This is the exact command we ran on 2026-11-11. - Configure. Add the mcpServers entry below to your MCP client config.
- Verify. Restart the client and check that tools/list returns tools (44 in our test).
{
"mcpServers": {
"azure-devops-mcp": {
"command": "npx",
"args": [
"-y",
"@azure-devops/mcp",
"testedmcp-sample-org"
]
}
}
}Test history
- 2026-11-11: New
Related: Best DevOps MCP servers
FAQ
Is Azure DevOps MCP deprecated?
No. @azure-devops/mcp was not deprecated or archived when we last tested it on 2026-11-11.
What replaces Azure DevOps MCP?
Nothing; Azure DevOps MCP (official) is not deprecated as of 2026-11-11.
Does Azure DevOps MCP need an API key?
It connects and lists 44 tools without a key, but its tool calls need one.
Embed the badge
Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.