mcp-dotnetBLOCK
Two MCP stdio servers in .NET 10: Microsoft Teams (teams, channels, chats, messages, search) via Microsoft Graph, and Azure DevOps (work items, pull requests, pipelines, repos, search) via its REST API. Interactive Entra ID sign-in instead of PATs; read-only by default with opt-in write and send gat
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Two MCP stdio servers on .NET 10, built on the official ModelContextProtocol C# SDK, signing in to Entra ID through Azure.Identity.
- Teams (
teams-mcp): Microsoft Teams via Microsoft Graph. Read teams, channels, chats and
messages, search, wait for new messages, and send behind an opt-in gate.
- Azure DevOps (
ado-mcp): projects, repositories, pull requests, work items, pipelines and
search (code, work items, wiki) via the REST API, plus gated work item writes and pull request comments.
Each server works on its own, so install only the one you need. Design documentation is in docs/.
Quick start
You need the .NET 10 SDK and an Entra ID app registration in your own tenant, described under App registrations: the servers sign in as you against your own organization, so there is no shared id to hand out.
1. Install the servers from nuget.org. This puts teams-mcp and ado-mcp on your PATH.
dotnet tool install --global JasonBright.Mcp.Teams dotnet tool install --global JasonBright.Mcp.AzureDevOps
2. Point them at your tenant. Tenant and client ids are public OAuth identifiers, not secrets. Set them at user scope and every client picks them up: an MCP server is a child process of the client that launches it.
[Environment]::SetEnvironmentVariable('TEAMS_MCP_TENANT_ID', '', 'User')
[Environment]::SetEnvironmentVariable('TEAMS_MCP_CLIENT_ID', '', 'User')
[Environment]::SetEnvironmentVariable('ADO_MCP_TENANT_ID', '', 'User')
[Environment]::SetEnvironmentVariable('ADO_MCP_CLIENT_ID', '', 'User')
[Environment]::SetEnvironmentVariable('ADO_MCP_ORG_URL', 'https://dev.azure.com/contoso', 'User')
[Environment]::SetEnvironmentVariable('ADO_MCP_PROJECT', 'Fabrikam', 'User')On Linux
03c2d3f80722OBSERVED · 2026-10-11Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
drafts | read | Reopen the Teams drafts pane |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (4)
0. **Probe Teams MCP health before drafting.** Call a cheap read first — `list_chats` with `limit: 1` is one request and returns almost nothing. If it fails or the server is disconnected, tell the use
message, or to react to one with an emoji. Also use when the user says "send
If the user says "only to me", "just me", "don't send it to X", or equivalent, treat that as a hard constraint. It overrides any other inference. Send to the user's self-chat and nowhere else.
around a sentence like *"Access Denied: The Personal Access Token used has expired."*
Gates applied: critical_finding, no_behavioural_pass, undeclared_transfer.
03c2d3f80722full audit observations/trust-audit/mcp-server/jgbright__mcp-dotnet.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 03c2d3f80722 | BLOCK | D | 69 | first audit |
Questions
What is the mcp-dotnet MCP server?
Two MCP stdio servers in .NET 10: Microsoft Teams (teams, channels, chats, messages, search) via Microsoft Graph, and Azure DevOps (work items, pull requests, pipelines, repos, search) via its REST API. Interactive Entra ID sign-in instead of PATs; read-only by default with opt-in write and send gat
What tools does mcp-dotnet expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mcp-dotnet safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does mcp-dotnet need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (03c2d3f80722), read on 2026-10-11. The repository is watched and re-audited when it changes.