# Azure DevOps MCP Server vs GitMCP (slim)

> Azure DevOps scores 63.4 (B) to GitMCP's 40.2 (E) for code repositories. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitmcp.md (~5,150 tokens) · this version ~3,280 tokens · JSON https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitmcp.json · canonical https://www.anchorterminal.com/compare/azure-devops-mcp-vs-gitmcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Azure DevOps MCP Server scores 63.4 (B) on agent readiness against GitMCP's 40.2 (E), and leads in 6 of 7 scored categories. GitMCP leads on payments & pricing. Both do code repositories.

- Azure DevOps MCP Server: B 63.4, rank #512 of 1486 · https://www.anchorterminal.com/tools/azure-devops-mcp.min.md
- GitMCP: E 40.2, rank #1308 of 1486 · https://www.anchorterminal.com/tools/gitmcp.min.md
- Azure DevOps MCP Server, good for Agents working in an Azure DevOps organisation on work items, pull requests, pipelines and test plans, most easily from Microsoft's own clients. Ahead on Reliability, 72 against 15; Schema & documentation, 64 against 56; Agent ergonomics, 70 against 58; Security & auth, 81 against 42; Maintenance & community, 80 against 8; Transparency & trust, 80 against 36. Also Runs on your own machine.
- GitMCP, good for Quick, keyless library docs for public GitHub projects in a coding agent. Ahead on Payments & pricing, 60 against 40. Also No key needed to call it; No incidents deducted, where Azure DevOps MCP Server loses 6 points for them.

| Category | Azure DevOps MCP Server | GitMCP |
| --- | --- | --- |
| Reliability (16%) | 72 | 15 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 64 | 56 |
| Agent ergonomics (13%) | 70 | 58 |
| Security & auth (14%) | 81 | 42 |
| Payments & pricing (10%) | 40 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 80 | 8 |
| Transparency & trust (7%) | 80 | 36 |

| Fact (where they differ) | Azure DevOps MCP Server | GitMCP |
| --- | --- | --- |
| Vendor | Microsoft | Ido Salomon (GitMCP open-source project) |
| Hosted endpoint | `https://mcp.dev.azure.com/{organization}` | `https://gitmcp.io/{owner}/{repo}` |
| Transports | Streamable HTTP, stdio | Streamable HTTP |
| Auth | OAuth or key | None |
| Pricing | Freemium | Free |
| Licence | MIT for the local server in the repository. The hosted remote server is a Microsoft online service under the customer's Azure DevOps terms | Apache-2.0 |
| Tools exposed | 48 | 4 |
| Last release | 2026-10-22 | 2026-05-08 |
| Terms last updated | no date given | no document linked |
| Privacy policy last updated | 2026-09-01 | no document linked |
| Customer content may train models | yes | not read yet |
| Terms restrict automated access | yes | not read yet |
| Terms restrict benchmarking | yes | not read yet |
| Terms or service can change without notice | not found in the text | not read yet |
| Arbitration or class-action waiver | not found in the text | not read yet |
| Popularity | 2k stars, 120k npm/wk | 8.5k stars |
| Agent reviews | 2.5/5 (4) | none |

Why the edge:
- Maintenance & community, Azure DevOps MCP Server +72: Azure DevOps MCP Server 80 (2.11.0 was published to npm on 22 October 2026, ten days before the check, adding repository file writes, organisation-wide pull request listing and work item attachment upload and linking (30). In the 90 days from 3 August, the remote server's general availability announcement (5 August) and two stable releases (2.10.0 on 9 September, 2.11.0 on 22 October). The nightly builds published to npm every day under the `nightly` and `next` tags aren't counted, since the default install doesn't get them, unlike azure-mcp's betas on `latest` (20). The issues page listed four open issues on 8 October, the oldest opened on 23 September, against issue numbers above 1,680, per the 8 October check, not re-read on 1 November. Pull requests merged up to 30 October (20). The official MCP registry, searched on 1 November, has no entry under a Microsoft namespace. The repository's server.json names `com.microsoft/azure-devops` at 2.4.0, but the registry returns only a third party's listing (io.github.PremierInc/azure-devops) for this repository (0). Dependabot runs, and build, test, CodeQL, dependency review and the nightly workflows run from the repository (10). 30 + 20 + 20 + 0 + 10 = 80.); GitMCP 8 (The last commit on main is 8 May 2026, 182 days before this check, and there are no tags or releases (0). Nothing in the last 90 days (0). Since May, outside issues and pull requests (#244 to #271, among them the security report #249 and fixes #256, #267 and #250) have gone without a maintainer reply or merge (3). Not found in the official MCP registry under any namespace (0). A run-tests workflow with vitest and a Playwright end-to-end workflow exist on push and pull request (5). 0 + 0 + 3 + 0 + 5 = 8.)
- Reliability, Azure DevOps MCP Server +57: Azure DevOps MCP Server 72 (Scored with the hosted lines, because the remote endpoint is the one Microsoft recommends. status.dev.azure.com is Azure DevOps' own status page with seven services across eight geographies (20). Re-read on 1 November, the history page as served lists no resolved events and its date filter is drawn by script, so we couldn't confirm it covers 90 days. Its active events list one, "Higher latency and intermittent failures for the organizations in Australia", on Core services in the Australia geography since 30 September, which the 19 October update puts at about 6 per cent of requests from South Africa to organisations hosted in Australia (undersea cable damage). That touches one geography, so it reads as minor. The MCP endpoint is not a named component, so the line reads Core services, which its calls go through. The 8 October award of 15 isn't a checklist value. An empty history list isn't a clean record, and the resolved incidents of the 90 days from 3 August can't be read, so the window isn't credited and the line takes the no-readable-history value (5). Azure DevOps publishes a limit of 200 TSTUs per user in a sliding five-minute window, with delays of up to 30 seconds before blocking, per the 8 October check (15). Blocked requests get 429 with `Retry-After` and `X-RateLimit-*` headers, and the docs say to honour them. No retry guidance for writes was found (12). The data protection page states a 99.9 per cent SLA with refunds for Azure DevOps, per the 8 October check. (10). Microsoft announced the remote server as generally available on 5 August 2026 on the Azure DevOps blog. The remote server page (dated 21 September 2026) marks only the Enterprise Live Migration tools as preview, though the README still mentions a preview period (10). 20 + 5 + 15 + 12 + 10 + 10 = 72.); GitMCP 15 (Scored as a hosted MCP server. No status page found (0) and so no readable incident history (5). The maintainer confirmed on issue #245 that gitmcp.io was throttled by Cloudflare for a few hours in May 2026, outside the 90-day window. No rate limits are documented (0) and nothing on 429 or retries (0). No SLA (0). The service is live with no beta or preview label (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.)
- Transparency & trust, Azure DevOps MCP Server +44: Azure DevOps MCP Server 80 (The local server is MIT, and the hosted service runs under Microsoft's online service terms (30). Azure DevOps documents encryption, replication, a 28-day recovery window for deleted organisations and its data locations. Nothing says what the remote MCP server logs or keeps, and the overview's privacy section says project information never leaves the customer's network, which doesn't fit a hosted endpoint (18). The README says the remote server will eventually replace the local one and asks users to plan migration, with no date. Dated notices exist for global PATs (1 December 2026) and Azure DevOps OAuth (10). Eight data geographies and the remote server's two outbound IP addresses are published. We didn't read a subprocessor list. The local source has no telemetry beyond a user agent string naming the MCP client (14). 30 + 18 + 10 + 14 = 72.); GitMCP 36 (Apache-2.0, with the whole service in the public repository (30). The README says the service stores no personal data or queries and keeps no repository content permanently, but there is no privacy policy or terms page (8). No deprecation policy or dated notices; SSE was removed on 8 May 2026 while the README still shows an SSE config for VS Code (0). The hosting stack (Cloudflare Workers, Workers AI, Vectorize, an Analytics Engine dataset) is visible in wrangler.jsonc but no processor is named for users, and invocation logs were turned off on 8 May (5). 30 + 8 + 0 + 5 = 43.)
- Security & auth, Azure DevOps MCP Server +39: Azure DevOps MCP Server 81 (The remote server accepts only Microsoft Entra OAuth with delegated Azure DevOps scopes, in the `Authorization` header, and a call needs both the app scope and the user's own permission. Conditional Access applies. The local package also takes PATs, which can be scoped and revoked (30). `X-MCP-Readonly`, toolset and per-tool headers, and guidance to grant read scopes only. No confirmation step for write tools was found. Since 2.10.0 (9 September) `repo_pull_request_write` bypasses branch policy on autocomplete only with an explicit `bypassPolicy: true` and a reason, where a reason alone used to be enough (14). Since 2.10.0 the local package wraps every tool response in random delimiters marked untrusted, with tests (commit a289161, which cites MSRC-135517), though the Learn docs don't describe this or say whether the remote server does the same (11). Azure DevOps auditing exists for Entra-backed organisations and is itself labelled preview. Its event list has no MCP-specific events (8). SECURITY.md routes reports to MSRC, Azure DevOps is in Microsoft's bounty programme, and the data protection page lists SOC 2 Type 2 and ISO 27001:2022. OSV and NVD list no advisory for the package on 1 November, and www.microsoft.com/.well-known/security.txt still had Expires 2026-09-23 on 1 November (18). 30 + 14 + 11 + 8 + 18 = 81.); GitMCP 42 (No credentials at all, so nothing to leak or scope (20). Every tool is a read of public content (15). Repository docs, code and fetched URLs reach the model unmarked, and fetch_generic_url_content fetches any absolute URL a document mentions, with no prompt-injection guidance in the README (2). No per-call visibility for the caller (0). SECURITY.md routes reports to a Google Form, but the server-side request forgery report in issue #249 (12 June 2026) and its proposed fix #256 have had no maintainer reply in almost five months. No certifications or bounty (5). 20 + 15 + 2 + 0 + 5 = 42.)
- Payments & pricing, GitMCP +20: Azure DevOps MCP Server 40 (No x402, MPP or L402 (0). The server is free and Azure DevOps prices are public, per the 8 October check, with Basic at $6 a user a month after five free users (20). The first five users are free and the pricing page states no card requirement for them (20). A person has to create the organisation and sign in through Entra, and outside Microsoft's clients an administrator has to register an app (0). 0 + 20 + 20 + 0 = 40.); GitMCP 60 (Nothing to buy, so no payment protocol (0). Free, stated in the README FAQ (20). No account or card (20). An agent connects with a URL and no signup or key (20). 0 + 20 + 20 + 20 = 60.)
- Agent ergonomics, Azure DevOps MCP Server +12: Azure DevOps MCP Server 70 (48 tools documented for the remote server (5), with `X-MCP-Toolsets`, `X-MCP-Tools` and `X-MCP-Readonly` adding back 10. `top`, `skip` and continuation tokens on list and search tools, and the source trims pull request threads and branch lists before returning them (16). Errors name the missing parameter or pass Azure DevOps' message through as an `isError` result. Local sign-in failures in headless environments surface as a generic `fetch failed` per the troubleshooting guide (13). All 45 local tools set `readOnlyHint`, `destructiveHint`, `idempotentHint` and `openWorldHint`, with a test that fails on a missing entry, and work item updates accept a revision test for concurrency. There are no idempotency keys (16). The organisation comes from the URL and project and team defaults can be set by environment variable, but most calls still need a project. We confirmed the Node client library the server is built on, and didn't confirm a second official SDK (10). 15 + 16 + 13 + 16 + 10 = 70.); GitMCP 58 (Four tools per repository endpoint and five on gitmcp.io/docs, each short (25). Code search pages 30 results with a page number, and documentation search returns matched chunks instead of the whole file, but there is no size control on the fetch tool (10). Errors come back as tool text with no documented codes (5). Every tool is a read and the source sets readOnlyHint, but issue #266 reports the annotations are passed in a position the MCP SDK ignores, and the fix #267 is unmerged (8). No parameters to set up and nothing to configure; there are no SDKs, which a keyless MCP endpoint doesn't need (10). 25 + 10 + 5 + 8 + 10 = 58.)