Azure DevOps MCP Server

Azure DevOps MCP Server is Microsoft's official connector for exposing Azure DevOps Services projects, work items, Git repositories, pipelines, test plans, wikis, and security alerts to MCP-capable agents. New users can connect to Microsoft's hosted Remote MCP, while a local npm server remains available for stdio clients and alternative authentication methods. This is not a read-only search connector: several enabled domains contain state-changing tools, so deployment should begin with a narrow project scope, selected domains, and least-privilege identity.

Evaluate hosted Remote MCP first. Use the local npm package when the client only supports stdio or requires Azure CLI or non-interactive authentication. Choose one organization and a least-privilege identity, then use -d to load only required domains. The first check should only list projects or read a test work item, never create, update, or run anything.

Help me safely connect Azure DevOps MCP Server from https://github.com/microsoft/azure-devops-mcp. First read README.md, docs/GETTINGSTARTED.md, docs/TOOLSET.md, LICENSE.md, SECURITY.md, and the latest v2.9.0 release. Confirm that the target is Azure DevOps Services, the account is backed by Entra ID, and explain whether Remote MCP or local Node.js 20+ stdio is appropriate. Do not overwrite existing MCP configuration or put tokens or PATs in chat, logs, a tracked config file, or shell history. Load only domains required for the task and start with a least-privilege identity and test project. Stop for confirmation before interactive sign-in, using Azure CLI credentials, reading an environment token or PAT, choosing a tenant, broadening project permissions, enabling write tools, or changing work items, PRs, pipelines, test plans, or wikis. Verify only by listing projects and reading one non-sensitive test work item, then report added configuration and results.

{
  "servers": {
    "ado-remote-mcp": {
      "url": "https://mcp.dev.azure.com/{organization}",
      "type": "http"
    }
  },
  "inputs": []
}

1. 1
   Define the organization, project, and read-only goal

   Choose one Azure DevOps Services organization and a non-sensitive test project. List exactly what the agent needs to read and leave create, update, and run actions unapproved by default.

2. 2
   Choose Remote MCP or local stdio

   Use the README-recommended Remote MCP when Streamable HTTP and interactive sign-in are available. Choose the Node.js 20+ npm package for a local process or Azure CLI and environment-token authentication.

3. 3
   Narrow domains and identity permissions

   For local startup, use -d to load only required domains and ensure the identity can access only the intended organization and projects. Core is always loaded; omitting -d loads all regular domains.

4. 4
   Complete a minimal read-only check

   List projects, then read one test work item or repository metadata. Confirm organization, project, and returned content before reviewing write tools individually.

Azure DevOps MCP Server stands out for official maintenance, broad Azure DevOps coverage, and both hosted and local connection paths. Its README, getting-started guide, and tool catalog document setup, authentication, client compatibility, and read/write capabilities in useful detail. Recent commits continue strengthening external-content safety and PAT request boundaries. The main costs are a wide permission surface, potentially breaking tool consolidation, and uneven update timing between local and Remote documentation. This assessment is based on public GitHub evidence without installation or a live organization connection.