Azure DevOps MCP (official)

70/100

Capped at 70: no passing tool call yet; the tests add up to 95. Why scores are capped

Last tested 2026-11-11 (Fresh: tested within 30 days) Connects · tools listedNo tool call tested yet Connects without a key; tool calls need one

No advisories in range for tested 2.11.0 (checked 2026-11-11)

Security review: not tested

Test points add up to 95; the score is capped at 70 until a tool call passes. Not a quality or security rating. Methodology

Test points before the cap (95/100)

  • Install20/20
  • Handshake30/30
  • Maintenance25/25
  • Docs10/15
  • License10/10

Tested npm @azure-devops/mcp 2.11.0 (MIT; repo microsoft/azure-devops-mcp, 2,085 GitHub stars when checked). Takes the organization name as its first argument; the default sign-in is an interactive Microsoft browser login, which we don't do. Initialize and tools/list worked (44 tools, with read-only hints on 29). For the real call we started it with --authentication envvar and no token: core_list_projects answered that ADO_MCP_AUTH_TOKEN is not set. Core tools not tested. Many tools write work items, pull requests, branches and wiki pages; none were called.
Tool-call test (2026-11-11, direct MCP stdio client, no LLM): fail. 0 of 1 call passed; every tool needs an Azure DevOps sign-in or token. Core tools not tested. Evidence: local test run, Nov 11, 2026.

Transport (tested 2026-11-11): stdio

Token cost (estimate): approx. 16641 tokens, cl100k estimate (44 tools, measured 2026-11-11, version 2.11.0). This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k_base.

Permissions: 26 read, 18 write (state-changing), 0 unclassified · Auth: API key · Rate limit: unknown · Pricing unit: unknown

Auth: API key. Rate limit: unknown. Pricing unit: unknown.

  • advsec_get_alert_details — read
  • advsec_get_alerts — read
  • core_get_identity_ids — read
  • core_list_project_teams — read
  • core_list_projects — read
  • pipelines_artifact — write (state-changing)
  • pipelines_build — read
  • pipelines_build_log — read
  • pipelines_definition — read
  • pipelines_run — read
  • pipelines_write — write (state-changing)
  • repo_branch — read
  • repo_create_branch — write (state-changing)
  • repo_file — read
  • repo_file_write — write (state-changing)
  • repo_pull_request — read
  • repo_pull_request_org — read
  • repo_pull_request_thread — read
  • repo_pull_request_thread_write — write (state-changing)
  • repo_pull_request_write — write (state-changing)
  • repo_repository — read
  • repo_search_commits — read
  • search_code — read
  • search_wiki — read
  • search_workitem — read
  • testplan — read
  • testplan_show_test_results_from_build_id — read
  • testplan_test_case_write — write (state-changing)
  • testplan_test_plan_write — write (state-changing)
  • testplan_test_suite_write — write (state-changing)
  • wiki — read
  • wiki_upsert_page — write (state-changing)
  • wit_backlog — write (state-changing)
  • wit_query — read
  • wit_work_item — read
  • wit_work_item_attachment — read
  • wit_work_item_attachment_link — write (state-changing)
  • wit_work_item_attachment_upload — write (state-changing)
  • wit_work_item_comment_write — write (state-changing)
  • wit_work_item_link_write — write (state-changing)
  • wit_work_item_write — write (state-changing)
  • work — read
  • work_capacity_write — write (state-changing)
  • work_iteration_write — write (state-changing)

listing-flags calls_need_key or auth_kind

Score 70/100 · Tools 44 · Token cost approx. 16,641 tokens · Compare · Last tested 2026-11-11 · Version tested 2.11.0 · Package @azure-devops/mcp · Repo microsoft/azure-devops-mcp

Summary: Azure DevOps MCP (official) completed an MCP handshake without credentials and exposed 44 tools.

Evidence summary

Handshake
pass
Tools listed
44
Context cost
approx. 16641 tokens, cl100k estimate (44 tools, measured 2026-11-11, version 2.11.0; an estimate) ranking · add up your servers' context cost
API key
Connects without a key; tool calls need one
Tested
2026-11-11

Test results

TestResultPointsEvidence
installpass20npm install @azure-devops/mcp (Node 20, Linux) succeeded in 4s.
handshakepass30MCP initialize + tools/list over stdio succeeded with no credentials; 44 tools listed in 15.3s.
maintenancepass25Repo pushed 4 days before test; 2,085 GitHub stars.
docspartial10README over 3,000 chars; install instructions present. Check of the package's own README (README shipped in npm package).
licensepass10MIT (OSI-approved).

Local-model readiness

Token cost (estimate): approx. 16641 tokens, cl100k estimate for 44 tools · about 203% of an 8k context. This is an estimate from our testing (counted with cl100k_base).

Small-model friendly (schema heuristic, not a model result): unknown.

Not tested

Small-model task runs: Not yet tested.

What we tested and what we didn't

Tested on 2026-11-11

  • Install from the registry
  • We connected with no credentials and asked for its tool list: it listed 44 tools (Method details: MCP initialize then tools/list)
  • Maintenance signals (last push, archived/deprecated status)
  • Docs (README length, install and config example)
  • License (OSI-approved or not)
  • Token cost (estimate)

Not tested

  • Security: not audited (no code review, no permission or data-flow analysis)
  • Real tasks (no functional task runs yet)
  • Behaviour with real credentials or a real account
  • Performance, rate limits or load
  • Correctness of results beyond the listed tasks

Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.

Known security issues

Checked on 2026-11-11 for version 2.11.0 against OSV, GitHub advisories, GitHub repository advisories. Scope: the package itself; dependencies not scanned.

No published advisories found in OSV and GitHub advisories for @azure-devops/mcp 2.11.0 as of 2026-11-11. This is not a security audit.

Monthly roundup: MCP security issues, October 2026.

Tool list changes

Baseline recorded from the 2026-11-11 test run; changes appear after the next test.

Snapshot hash (fingerprint of the tool list)

fc81f0c2cabf: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.

Feeds: RSS · JSON.

Raw test record (JSON)
{
  "name": "@azure-devops/mcp",
  "version": "2.11.0",
  "registry": "npm",
  "status": "working",
  "tested": "2026-11-11",
  "tools_count": 44,
  "deprecated": false,
  "archived": false,
  "tests": {
    "install": [
      "pass",
      20,
      "`npm install @azure-devops/mcp` (Node 20, Linux) succeeded in 4s."
    ],
    "handshake": [
      "pass",
      30,
      "MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 44 tools listed in 15.3s."
    ],
    "maintenance": [
      "pass",
      25,
      "Repo pushed 4 days before test; 2,085 GitHub stars."
    ],
    "docs": [
      "partial",
      10,
      "README over 3,000 chars; install instructions present. Check of the package's own README (README shipped in npm package)."
    ],
    "license": [
      "pass",
      10,
      "MIT (OSI-approved)."
    ]
  }
}

Install

npx -y @azure-devops/mcp testedmcp-sample-org

Pin the version we tested

npx -y @azure-devops/mcp@2.11.0 testedmcp-sample-org

tested 2026-11-11. Newer versions may differ and were not tested by us.

{
  "mcpServers": {
    "azure-devops-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@azure-devops/mcp@2.11.0",
        "testedmcp-sample-org"
      ]
    }
  }
}

Tools listed

advsec_get_alert_details, advsec_get_alerts, core_get_identity_ids, core_list_project_teams, core_list_projects, pipelines_artifact, pipelines_build, pipelines_build_log, pipelines_definition, pipelines_run, pipelines_write, repo_branch, repo_create_branch, repo_file, repo_file_write, repo_pull_request, repo_pull_request_org, repo_pull_request_thread, repo_pull_request_thread_write, repo_pull_request_write, repo_repository, repo_search_commits, search_code, search_wiki, search_workitem, testplan, testplan_show_test_results_from_build_id, testplan_test_case_write, testplan_test_plan_write, testplan_test_suite_write, wiki, wiki_upsert_page, wit_backlog, wit_query, wit_work_item, wit_work_item_attachment, wit_work_item_attachment_link, wit_work_item_attachment_upload, wit_work_item_comment_write, wit_work_item_link_write

Tool history: captured Nov 11, 2026. All tool history.

Quick config

{
  "mcpServers": {
    "azure-devops-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@azure-devops/mcp",
        "testedmcp-sample-org"
      ]
    }
  }
}

Add to config Opens the config generator with this server selected.

Setup

  1. Install. Run npm install @azure-devops/mcp (Node 20). This is the exact command we ran on 2026-11-11.
  2. Configure. Add the mcpServers entry below to your MCP client config.
  3. Verify. Restart the client and check that tools/list returns tools (44 in our test).
{
  "mcpServers": {
    "azure-devops-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@azure-devops/mcp",
        "testedmcp-sample-org"
      ]
    }
  }
}

Test history

Follow this server (RSS) · Monthly changelog

Related: Best DevOps MCP servers

FAQ

Is Azure DevOps MCP deprecated?

No. @azure-devops/mcp was not deprecated or archived when we last tested it on 2026-11-11.

What replaces Azure DevOps MCP?

Nothing; Azure DevOps MCP (official) is not deprecated as of 2026-11-11.

Does Azure DevOps MCP need an API key?

It connects and lists 44 tools without a key, but its tool calls need one.

Embed the badge

TestedMCP: 70/100, tested 2026-11-11

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Claim this listing · Report an issue