AzureMCPSAFE
MCP server for Azure DevOps Server (on-premises) - .NET 10, official ModelContextProtocol SDK, PAT auth, shipped as NuGet package
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/eXoz00rd/AzureMCP/actions/workflows/ci.yml) [](https://www.nuget.org/packages/AzureDevOpsServer.Mcp) [](https://www.nuget.org/packages/AzureDevOpsServer.Mcp) [](LICENSE)
MCP (Model Context Protocol) server for Azure DevOps Server (on-premises), built with .NET 10 / C# on top of the official ModelContextProtocol C# SDK and distributed as a NuGet package.
Status: preview — available on NuGet.org as AzureDevOpsServer.Mcp.
Why
Most existing MCP integrations for Azure DevOps target Azure DevOps Services (cloud). This project focuses on on-premises Azure DevOps Server installations (2019 / 2020 / 2022+): collection URLs, REST API versions supported by on-prem servers, and Personal Access Token (PAT) authentication — including classic TFS behaviors such as sign-in page responses on failed authentication.
Tools
62 tools across 9 areas:
877b7aa66232OBSERVED · 2026-10-11Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (9)
curl --fail --silent --output /dev/null http://127.0.0.1:8080/healthz && break
curl --fail --silent --output served_plugin.py http://127.0.0.1:8080/openwebui/azure_devops.py
run: .venv/bin/python .github/scripts/mcp_check.py --url http://127.0.0.1:8080/mcp --token ci-token-5c1f0e7b9a2d4e68b3a7c0d9f1e2a4b6
.venv/bin/python .github/scripts/mcp_check.py --url http://127.0.0.1:8081/mcp --token ci-token-5c1f0e7b9a2d4e68b3a7c0d9f1e2a4b6 --tool list_projects --expect Alpha
.venv/bin/python .github/scripts/mcp_check.py --url http://127.0.0.1:8082/mcp --token ci-token-5c1f0e7b9a2d4e68b3a7c0d9f1e2a4b6 --tool list_projects --expect-error --expect "TLS connection"
pat = base64.b64decode(credentials[6:]).decode().split(":", 1)[-1] if credentials.startswith("Basic ") else ""- PAT authentication read only from environment variables, validated at startup; TFS sign-in-page responses (HTTP 203) reported as authentication failures instead of parse errors
- Over stdio, the PAT is read **only** from environment variables — never from command-line arguments, committed configuration files, or source code
Gates applied: no_behavioural_pass.
877b7aa66232full audit observations/trust-audit/mcp-server/exoz00rd__azuremcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 877b7aa66232 | SAFE | B | 89 | first audit |
Questions
What is the AzureMCP MCP server?
MCP server for Azure DevOps Server (on-premises) - .NET 10, official ModelContextProtocol SDK, PAT auth, shipped as NuGet package
Is AzureMCP safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does AzureMCP need?
It reads ADOS_PAT from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does AzureMCP run?
It speaks stdio and streamable-http, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (877b7aa66232), read on 2026-10-11. The repository is watched and re-audited when it changes.