{ "data": { "similar": [ { "grade": "C", "json": "https://www.anchorterminal.com/tools/atlassian-rovo-mcp.json", "name": "Atlassian Rovo MCP Server", "score": 57.9, "shared": [ "work.issues", "work.docs", "code.repo" ], "slug": "atlassian-rovo-mcp" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/github-mcp-server.json", "name": "GitHub MCP Server", "score": 70.3, "shared": [ "code.repo", "work.issues" ], "slug": "github-mcp-server" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/youtrack.json", "name": "YouTrack", "score": 49.9, "shared": [ "work.issues", "work.docs" ], "slug": "youtrack" }, { "grade": "A", "json": "https://www.anchorterminal.com/tools/google-drive-api.json", "name": "Google Drive API + MCP", "score": 79.6, "shared": [ "work.docs" ], "slug": "google-drive-api" }, { "grade": "BB", "json": "https://www.anchorterminal.com/tools/monday.json", "name": "monday.com", "score": 76.4, "shared": [ "work.docs" ], "slug": "monday" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/box-api.json", "name": "Box API + MCP", "score": 69.4, "shared": [ "work.docs" ], "slug": "box-api" } ], "tool": { "slug": "azure-devops-mcp", "name": "Azure DevOps MCP Server", "vendor": "Microsoft", "vendorUrl": "https://azure.microsoft.com/en-us/products/devops", "kind": "mcp", "category": "code", "summary": "Microsoft's official MCP server for Azure DevOps Services. It gives agents work items, repositories, pull requests, pipelines, wikis, test plans and Advanced Security alerts, through a hosted endpoint with Microsoft Entra sign-in or a local npm package.", "url": "https://www.anchorterminal.com/tools/azure-devops-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/azure-devops-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/azure-devops-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/azure-devops-mcp.json", "repo": "https://github.com/microsoft/azure-devops-mcp", "license": "MIT for the local server in the repository. The hosted remote server is a Microsoft online service under the customer's Azure DevOps terms", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://mcp.dev.azure.com/{organization}", "packages": [ { "registry": "npm", "name": "@azure-devops/mcp" } ], "auth": "mixed", "authNotes": "Remote server: Microsoft Entra ID OAuth only, with the bearer token in the `Authorization` header. Personal access tokens aren't accepted, and the organisation must be backed by an Entra tenant. Visual Studio Code, Visual Studio, Microsoft Foundry, Copilot Studio and the GitHub Copilot clients sign in directly. Claude Code and Cursor need a custom Entra app registration with delegated Azure DevOps scopes and admin consent, because Entra has no dynamic client registration. Claude Desktop and Codex can't use the remote server. Local server: interactive Entra sign-in by default, or `azcli`, `env` (DefaultAzureCredential), `envvar` (bearer token in `ADO_MCP_AUTH_TOKEN`) or `pat` (base64 of email and PAT in `PERSONAL_ACCESS_TOKEN`). Personal Microsoft accounts aren't supported (checked 2026-10-08).", "pricing": "freemium", "pricingNotes": "The MCP server is free, and standard Azure DevOps pricing applies to the organisation behind it. The Basic plan is free for the first five users, then $6 a user a month. Basic + Test Plans is $52 a user a month with a 30-day trial. An agent can start on the five free users without a contract, but a person has to create the organisation and sign in (checked 2026-10-08).", "priceSummary": "$6 / seat-mo", "where": "both", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Learn docs, the repository or the pricing page (checked 2026-10-08).", "endpoints": [] }, "toolCount": 48, "popularity": { "githubStars": 2000, "npmWeekly": 120075, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://learn.microsoft.com/en-us/azure/devops/mcp-server/mcp-server-overview", "capabilities": [ "code.repo", "work.issues", "code.deploy", "work.docs" ], "tags": [ "official", "hosted", "mcp", "oauth", "entra-id", "read-only-mode", "toolsets", "open-source", "preview", "npm" ], "lastRelease": "2026-09-09", "graded": true, "anchor": { "graded": true, "score": 66.3, "grade": "B", "agentReady": false, "rank": 238, "ranked": true, "rankOf": 722, "categoryRank": 3, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 80, "payments": 40, "reliability": 72, "schema": 64, "security": 81, "transparency": 79 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 72, "points": 14.4, "reason": "Scored with the hosted lines, because the remote endpoint is the one Microsoft recommends. status.dev.azure.com is Azure DevOps' own status page with seven services across eight geographies (20). Its health API reported every service healthy on 8 October 2026 and the history page listed no events, but the page's filter is drawn by script and we couldn't confirm the view covers 90 days. The MCP endpoint is not a named component (15). Azure DevOps publishes a limit of 200 TSTUs per user in a sliding five-minute window, with delays of up to 30 seconds before blocking (15). Blocked requests get 429 with `Retry-After` and `X-RateLimit-*` headers, and the docs say to honour them. No retry guidance for writes was found (12). The data protection page states a 99.9 per cent SLA with refunds for Azure DevOps. Whether it covers the preview endpoint wasn't established (10). The remote server was announced as a public preview on 17 March 2026 and no general availability notice was found (0)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 64, "points": 10.4, "reason": "Every tool in the local package has a zod schema turned into JSON Schema. The remote server's own definitions sit behind Entra sign-in and weren't read, and the docs list its tools and actions only (20). learn.microsoft.com has no llms.txt (404) but returns Markdown when asked with `Accept: text/markdown` (10). Descriptions are short, with a median of 89 characters across 45 tools, and most say only to use the `action` parameter. A few, such as `repo_pull_request_org`, say when to choose them (8). Enums, bounds and required organisation fields are present and no tool takes a free-form object. The dispatcher design leaves most parameters optional with a note such as \"Used for update\", so the schema can't mark what each action needs (10). TOOLSET.md lists parameters per tool and EXAMPLES.md gives prompts. Errors are plain-text tool results, and the troubleshooting page covers Entra error codes (8). The local package has semver releases with notes. The remote server is updated separately with no changelog found, and its tool page warns that the list may lag (8)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 70, "points": 11.38, "reason": "48 tools documented for the remote server (5), with `X-MCP-Toolsets`, `X-MCP-Tools` and `X-MCP-Readonly` adding back 10. `top`, `skip` and continuation tokens on list and search tools, and the source trims pull request threads and branch lists before returning them (16). Errors name the missing parameter or pass Azure DevOps' message through as an `isError` result. Local sign-in failures in headless environments surface as a generic `fetch failed` per the troubleshooting guide (13). All 45 local tools set `readOnlyHint`, `destructiveHint`, `idempotentHint` and `openWorldHint`, with a test that fails on a missing entry, and work item updates accept a revision test for concurrency. There are no idempotency keys (16). The organisation comes from the URL and project and team defaults can be set by environment variable, but most calls still need a project. We confirmed the Node client library the server is built on, and didn't confirm a second official SDK (10)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 81, "points": 14.18, "reason": "The remote server accepts only Microsoft Entra OAuth with delegated Azure DevOps scopes, in the `Authorization` header, and a call needs both the app scope and the user's own permission. Conditional Access applies. The local package also takes PATs, which can be scoped and revoked (30). `X-MCP-Readonly`, toolset and per-tool headers, and guidance to grant read scopes only. No confirmation step for write tools was found, and `repo_pull_request_write` can set policy bypass on autocomplete when given a reason (14). The local source wraps returned content in random delimiters marked untrusted, with tests, though the Learn docs don't describe this or say whether the remote server does the same (11). Azure DevOps auditing exists for Entra-backed organisations and is itself labelled preview. Its event list has no MCP-specific events (8). SECURITY.md routes reports to MSRC, Azure DevOps is in Microsoft's bounty programme, and the data protection page lists SOC 2 Type 2 and ISO 27001:2022. The repository has no published advisories and microsoft.com's security.txt expired on 23 September 2026 (18)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 40, "points": 5, "reason": "No x402, MPP or L402 (0). The server is free and Azure DevOps prices are public, with Basic at $6 a user a month after five free users (20). The first five users are free and the pricing page states no card requirement for them (20). A person has to create the organisation and sign in through Entra, and outside Microsoft's clients an administrator has to register an app (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 80, "points": 7, "reason": "2.10.0 was published to npm on 9 September 2026, 29 days before the check (30). Three stable releases in the last 90 days (2.8.1 on 14 July, 2.9.0 on 29 July, 2.10.0 on 9 September), nightly builds on the `next` tag, and commits as recent as 7 October (20). The issues page listed four open issues on 8 October, the oldest opened on 23 September, against issue numbers above 1,680. We couldn't read reply times (20). The official MCP registry has no entry under a Microsoft namespace. The repository's server.json names `com.microsoft/azure-devops`, but the registry returns only a third party's listing for this repository (0). Dependabot runs daily, and build, test, tool-name validation, CodeQL and dependency review workflows run on pull requests (10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 79, "points": 6.91, "note": "editorial 72, provenance 86", "reason": "The local server is MIT, and the hosted service runs under Microsoft's online service terms (30). Azure DevOps documents encryption, replication, a 28-day recovery window for deleted organisations and its data locations. Nothing says what the remote MCP server logs or keeps, and the overview's privacy section says project information never leaves the customer's network, which doesn't fit a hosted endpoint (18). The README says the remote server will eventually replace the local one and asks users to plan migration, with no date. Dated notices exist for global PATs (1 December 2026) and Azure DevOps OAuth (10). Eight data geographies and the remote server's two outbound IP addresses are published. We didn't read a subprocessor list. The local source has no telemetry beyond a user agent string naming the MCP client (14)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "48 tools documented for the remote server (5), with `X-MCP-Toolsets`, `X-MCP-Tools` and `X-MCP-Readonly` adding back 10. `top`, `skip` and continuation tokens on list and search tools, and the source trims pull request threads and branch lists before returning them (16). Errors name the missing parameter or pass Azure DevOps' message through as an `isError` result. Local sign-in failures in headless environments surface as a generic `fetch failed` per the troubleshooting guide (13). All 45 local tools set `readOnlyHint`, `destructiveHint`, `idempotentHint` and `openWorldHint`, with a test that fails on a missing entry, and work item updates accept a revision test for concurrency. There are no idempotency keys (16). The organisation comes from the URL and project and team defaults can be set by environment variable, but most calls still need a project. We confirmed the Node client library the server is built on, and didn't confirm a second official SDK (10).", "maintenance": "2.10.0 was published to npm on 9 September 2026, 29 days before the check (30). Three stable releases in the last 90 days (2.8.1 on 14 July, 2.9.0 on 29 July, 2.10.0 on 9 September), nightly builds on the `next` tag, and commits as recent as 7 October (20). The issues page listed four open issues on 8 October, the oldest opened on 23 September, against issue numbers above 1,680. We couldn't read reply times (20). The official MCP registry has no entry under a Microsoft namespace. The repository's server.json names `com.microsoft/azure-devops`, but the registry returns only a third party's listing for this repository (0). Dependabot runs daily, and build, test, tool-name validation, CodeQL and dependency review workflows run on pull requests (10).", "payments": "No x402, MPP or L402 (0). The server is free and Azure DevOps prices are public, with Basic at $6 a user a month after five free users (20). The first five users are free and the pricing page states no card requirement for them (20). A person has to create the organisation and sign in through Entra, and outside Microsoft's clients an administrator has to register an app (0).", "reliability": "Scored with the hosted lines, because the remote endpoint is the one Microsoft recommends. status.dev.azure.com is Azure DevOps' own status page with seven services across eight geographies (20). Its health API reported every service healthy on 8 October 2026 and the history page listed no events, but the page's filter is drawn by script and we couldn't confirm the view covers 90 days. The MCP endpoint is not a named component (15). Azure DevOps publishes a limit of 200 TSTUs per user in a sliding five-minute window, with delays of up to 30 seconds before blocking (15). Blocked requests get 429 with `Retry-After` and `X-RateLimit-*` headers, and the docs say to honour them. No retry guidance for writes was found (12). The data protection page states a 99.9 per cent SLA with refunds for Azure DevOps. Whether it covers the preview endpoint wasn't established (10). The remote server was announced as a public preview on 17 March 2026 and no general availability notice was found (0).", "schema": "Every tool in the local package has a zod schema turned into JSON Schema. The remote server's own definitions sit behind Entra sign-in and weren't read, and the docs list its tools and actions only (20). learn.microsoft.com has no llms.txt (404) but returns Markdown when asked with `Accept: text/markdown` (10). Descriptions are short, with a median of 89 characters across 45 tools, and most say only to use the `action` parameter. A few, such as `repo_pull_request_org`, say when to choose them (8). Enums, bounds and required organisation fields are present and no tool takes a free-form object. The dispatcher design leaves most parameters optional with a note such as \"Used for update\", so the schema can't mark what each action needs (10). TOOLSET.md lists parameters per tool and EXAMPLES.md gives prompts. Errors are plain-text tool results, and the troubleshooting page covers Entra error codes (8). The local package has semver releases with notes. The remote server is updated separately with no changelog found, and its tool page warns that the list may lag (8).", "security": "The remote server accepts only Microsoft Entra OAuth with delegated Azure DevOps scopes, in the `Authorization` header, and a call needs both the app scope and the user's own permission. Conditional Access applies. The local package also takes PATs, which can be scoped and revoked (30). `X-MCP-Readonly`, toolset and per-tool headers, and guidance to grant read scopes only. No confirmation step for write tools was found, and `repo_pull_request_write` can set policy bypass on autocomplete when given a reason (14). The local source wraps returned content in random delimiters marked untrusted, with tests, though the Learn docs don't describe this or say whether the remote server does the same (11). Azure DevOps auditing exists for Entra-backed organisations and is itself labelled preview. Its event list has no MCP-specific events (8). SECURITY.md routes reports to MSRC, Azure DevOps is in Microsoft's bounty programme, and the data protection page lists SOC 2 Type 2 and ISO 27001:2022. The repository has no published advisories and microsoft.com's security.txt expired on 23 September 2026 (18).", "transparency": "The local server is MIT, and the hosted service runs under Microsoft's online service terms (30). Azure DevOps documents encryption, replication, a 28-day recovery window for deleted organisations and its data locations. Nothing says what the remote MCP server logs or keeps, and the overview's privacy section says project information never leaves the customer's network, which doesn't fit a hosted endpoint (18). The README says the remote server will eventually replace the local one and asks users to plan migration, with no date. Dated notices exist for global PATs (1 December 2026) and Azure DevOps OAuth (10). Eight data geographies and the remote server's two outbound IP addresses are published. We didn't read a subprocessor list. The local source has no telemetry beyond a user agent string naming the MCP client (14)." }, "sources": [ { "what": "remote server setup, headers, tool list and client support", "url": "https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops", "seen": "2026-10-08" }, { "what": "overview, pricing statement and privacy section", "url": "https://learn.microsoft.com/en-us/azure/devops/mcp-server/mcp-server-overview?view=azure-devops", "seen": "2026-10-08" }, { "what": "remote server troubleshooting, authentication and Conditional Access", "url": "https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server-troubleshooting?view=azure-devops", "seen": "2026-10-08" }, { "what": "repository source, README, tool annotations and release tags", "url": "https://github.com/microsoft/azure-devops-mcp", "seen": "2026-10-08" }, { "what": "public preview announcement", "url": "https://devblogs.microsoft.com/devops/azure-devops-remote-mcp-server-public-preview/", "seen": "2026-10-08" }, { "what": "roadmap entry for general availability", "url": "https://learn.microsoft.com/en-us/azure/devops/release-notes/features-timeline", "seen": "2026-10-08" }, { "what": "status page and health API", "url": "https://status.dev.azure.com/_history", "seen": "2026-10-08" }, { "what": "rate limits and retry headers", "url": "https://learn.microsoft.com/en-us/azure/devops/integrate/concepts/rate-limits?view=azure-devops", "seen": "2026-10-08" }, { "what": "data protection, SLA statement and certifications", "url": "https://learn.microsoft.com/en-us/azure/devops/organizations/security/data-protection?view=azure-devops", "seen": "2026-10-08" }, { "what": "auditing events list", "url": "https://learn.microsoft.com/en-us/azure/devops/organizations/audit/auditing-events?view=azure-devops", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://azure.microsoft.com/en-us/pricing/details/devops/azure-devops-services/", "seen": "2026-10-08" }, { "what": "npm package versions and dates", "url": "https://registry.npmjs.org/@azure-devops/mcp", "seen": "2026-10-08" }, { "what": "official MCP registry search", "url": "https://registry.modelcontextprotocol.io/v0/servers?search=azure-devops\u0026limit=100", "seen": "2026-10-08" }, { "what": "open issues", "url": "https://github.com/microsoft/azure-devops-mcp/issues", "seen": "2026-10-08" }, { "what": "security advisories", "url": "https://github.com/microsoft/azure-devops-mcp/security/advisories", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://www.microsoft.com/.well-known/security.txt", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: whether the remote server reached general availability. The roadmap lists it under 2026 Q3, and we found only the preview announcement and a README that still mentions the preview period", "unchecked: the 90-day incident record. The status history page listed no events but its date filter is drawn by script", "unchecked: the remote server's own tool definitions and annotations, which need an Entra sign-in to list", "unchecked: the Azure DevOps entry in the Product Terms and the SLA text, both on pages drawn by script, and whether the SLA covers a preview endpoint", "unchecked: reply times on GitHub issues and the exact star count (the page shows 2.0k)", "unchecked: whether creating an Azure DevOps organisation asks for a payment card", "What the remote server logs and how long it keeps it, which no page we read states", "The overview page (12 August 2026) says Claude Code and Cursor must use the local server, while the remote page (21 September 2026) gives them a route through a custom Entra app registration" ] }, "negative": -3, "negativeNotes": [ "2026-07-29: version 2.9.0 of the local package renamed its tools in a minor release while consolidating them to match the remote server. The README warning and the advice to pin 2.8.1 were added on 31 July, and no aliases were kept. Documented since, so the deduction is small (https://github.com/microsoft/azure-devops-mcp/pull/1476)." ], "verdict": "The hosted endpoint takes Entra OAuth with Azure DevOps scopes, an `X-MCP-Readonly` header and toolset or per-tool filters, and the MIT local package annotates every tool. The remote server is still labelled public preview, and Claude Code and Cursor need a custom Entra app registration with admin consent before they can use it.", "bestFor": "Agents working in an Azure DevOps organisation on work items, pull requests, pipelines and test plans, most easily from Microsoft's own clients.", "strengths": [ "`X-MCP-Readonly`, `X-MCP-Toolsets` and `X-MCP-Tools` headers trim the remote server to read tools, eight toolsets or named tools", "Remote access uses Microsoft Entra OAuth with Azure DevOps scopes, and a call needs both the app scope and the user's own permission", "All 45 tools in the local package carry read-only, destructive, idempotent and open-world hints, checked by a test", "The local package wraps Azure DevOps content in random delimiters marked untrusted before it reaches the model", "Three stable npm releases between 14 July and 9 September 2026, nightly builds, and 81 commits since 10 July" ], "weaknesses": [ "The remote server was announced as a public preview on 17 March 2026 and no general availability notice was found", "Claude Code and Cursor need a custom Entra app registration with admin consent, and Claude Desktop and Codex can't use the remote server", "Version 2.9.0 renamed the local tools in a minor release on 29 July 2026, with the README warning added two days later", "No entry under a Microsoft namespace in the official MCP registry. The only listing naming this repository is a third party's", "Most tool descriptions are one line ending in an instruction to use the `action` parameter, with a median of 89 characters" ], "agentNotes": [ "Put the organisation in the URL (`https://mcp.dev.azure.com/{organization}`). Without it every call must name the organisation, and guest users can't connect at all", "Send `X-MCP-Readonly: true` for read tasks and `X-MCP-Toolsets: repos,wit` to cut the tool list. Don't combine `X-MCP-Toolsets` with `X-MCP-Tools`", "Name the project in each call. A missing project is the error the vendor reports most often", "For headless runs use the local package with `--authentication envvar` and a token in `ADO_MCP_AUTH_TOKEN`. The default interactive sign-in fails without a browser", "On HTTP 429 wait for `Retry-After`. Azure DevOps delays or blocks a user above 200 TSTUs in a sliding five-minute window" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 66.3 } ], "editorialScores": { "ergonomics": 70, "maintenance": 80, "payments": 40, "reliability": 72, "schema": 64, "security": 81, "transparency": 72 }, "provenanceScore": 86 }, "connect": { "install": "npx -y @azure-devops/mcp \u003corganization\u003e", "claudeCode": "claude mcp add --transport http ado https://mcp.dev.azure.com/{organization} --client-id {client-id} --callback-port 3118", "config": { "inputs": [], "servers": { "ado-remote-mcp": { "headers": { "X-MCP-Readonly": "true", "X-MCP-Toolsets": "repos,wiki,wit" }, "type": "http", "url": "https://mcp.dev.azure.com/{organization}" } } }, "headless": { "mcpServers": { "ado": { "args": [ "-y", "@azure-devops/mcp", "\u003corganization\u003e", "--authentication", "envvar" ], "command": "npx", "env": { "ADO_MCP_AUTH_TOKEN": "${ADO_MCP_AUTH_TOKEN}" } } } } }, "letme": { "capability": "https://letme.dev/code.repo", "tool": "https://letme.dev/azure-devops-mcp" }, "sameCompany": [ "azure-foundry-fine-tuning", "azure-ai-content-safety", "azure-speech-to-text", "azure-text-to-speech", "microsoft-agent-framework", "microsoft-execution-containers", "microsoft-entra-agent-id", "azure-key-vault", "microsoft-learn-mcp", "playwright-mcp", "azure-mcp", "azure-maps", "azure-translator", "microsoft-graph-calendar", "microsoft-teams", "dynamics-365-sales", "power-automate", "microsoft-advertising-api", "microsoft-excel-graph", "outlook-mail-graph" ], "notable": [ "The remote server is a hosted streamable HTTP endpoint at https://mcp.dev.azure.com/{organization}, recommended over the local package, which the README says it will eventually replace (https://github.com/microsoft/azure-devops-mcp)", "48 tools documented for the remote server in nine groups (core, work, repos, work items, pipelines, wiki, test plans, Advanced Security, Enterprise Live Migration), most of them dispatchers that take an `action` parameter. Two are Insiders-only (https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops)", "Headers on the remote server: `X-MCP-Toolsets` (repos, advsec, wit, pipelines, wiki, work, testplan, elm), `X-MCP-Tools` for named tools, `X-MCP-Readonly` and `X-MCP-Insiders` (https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops)", "Announced as a public preview on 17 March 2026. The roadmap page dated 5 August 2026 lists general availability under 2026 Q3, but its link leads to the preview note and the README still speaks of the preview period (https://devblogs.microsoft.com/devops/azure-devops-remote-mcp-server-public-preview/)", "The local package registers 45 tools in ten domains selectable with `-d`, each with four MCP annotation hints, and wraps returned Azure DevOps content in nonce delimiters marked untrusted (https://github.com/microsoft/azure-devops-mcp/blob/main/src/shared/content-safety.ts)", "Version 2.9.0 of 29 July 2026 consolidated and renamed the local tools to match the remote server. The README told users they could pin 2.8.1 (https://github.com/microsoft/azure-devops-mcp/pull/1476)", "Azure DevOps Services only. Neither server works with Azure DevOps Server on premises (https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server-troubleshooting?view=azure-devops)", "The official MCP registry has no entry under a Microsoft namespace. `io.github.PremierInc/azure-devops` points at this repository from a third-party namespace (https://registry.modelcontextprotocol.io/v0/servers?search=azure-devops)" ], "area": "developer", "details": [ { "label": "Surface graded", "value": "The hosted remote server at mcp.dev.azure.com, which Microsoft recommends. Tool definitions were read from the local package's source, which Microsoft is aligning with the remote server" }, { "label": "Status", "value": "Remote server in public preview since 17 March 2026. Local package at 2.10.0 (9 September 2026), Node.js 20 or later" }, { "label": "Read vs write", "value": "Reads projects, teams, iterations, work items, queries, repositories, branches, files, commits, pull requests, builds, logs, artifacts, wikis, test plans and security alerts. Writes work items, comments, links, attachments, pull requests, review threads, branches, pipeline runs and definitions, wiki pages and test plans. The local package also commits files" }, { "label": "Tool filtering", "value": "Remote: `X-MCP-Toolsets`, `X-MCP-Tools`, `X-MCP-Readonly`, `X-MCP-Insiders`. Local: `-d` with core, work, work-items, search, test-plans, repositories, wiki, pipelines, advanced-security" }, { "label": "Clients", "value": "Remote works directly in Visual Studio Code, Visual Studio, Microsoft Foundry, Copilot Studio, GitHub Copilot CLI and the GitHub Copilot app. Cursor and Claude Code need a custom Entra app registration. Claude Desktop and Codex use the local package" }, { "label": "Rate limits", "value": "Azure DevOps limits a user to 200 TSTUs in a sliding five-minute window, delays requests above it and answers 429 with `Retry-After` when blocking" }, { "label": "Data location", "value": "Eight Azure DevOps geographies (United States, Canada, Europe, United Kingdom, India, Australia, Asia Pacific, Brazil), chosen when the organisation is created" } ], "unitPrices": [ { "item": "Azure DevOps Basic plan", "unit": "seat-month", "usd": 6, "note": "first five users free. The MCP server adds no charge" }, { "item": "Azure DevOps Basic + Test Plans", "unit": "seat-month", "usd": 52, "note": "30-day trial" } ], "provenance": { "legalEntity": "Microsoft Corporation", "domain": "microsoft.com", "domainRegistered": "1991-05-02", "domainNote": "The hosted server answers at mcp.dev.azure.com, a Microsoft domain. microsoft.com publishes a security.txt, but it passed its Expires date on 2026-09-23.", "endpointOnVendorDomain": true, "terms": "https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all", "privacy": "https://www.microsoft.com/en-us/privacy/privacystatement", "statusPage": "https://status.dev.azure.com", "changelog": "https://github.com/microsoft/azure-devops-mcp/releases", "securityTxt": "expired", "checked": "2026-10-08", "notes": [ "The remote endpoint is on mcp.dev.azure.com and the status page on status.dev.azure.com. azure.com and microsoft.com are Microsoft domains, and the docs are on learn.microsoft.com.", "The Product Terms page loaded on 8 October 2026 but draws its content by script, so the Azure DevOps entry and the SLA reference were not read. Self-serve Azure accounts also accept the Microsoft Online Subscription Agreement at https://azure.microsoft.com/en-us/support/legal/subscription-agreement/.", "The local package's own terms are the MIT licence in the repository.", "https://www.microsoft.com/.well-known/security.txt shows Expires 2026-09-23T16:00:00.000Z, so it had expired when read on 8 October 2026. It points to the MSRC researcher portal, the bounty policy and the coordinated disclosure policy.", "The remote server has no changelog of its own. The repository's releases cover the local package, and the Azure DevOps sprint release notes carried the preview announcement.", "Domain registration date carried from our other Microsoft listings (RDAP, 1991-05-02), not looked up again today." ], "score": 86, "checks": [ { "check": "Legal entity named", "value": "Microsoft Corporation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "microsoft.com, registered 1991-05-02 (35 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "mcp.dev.azure.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 4 of the 7 things a reader expects, and has 2 clauses that cost points", "points": 3.4, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects, and has 1 clause that costs points", "points": 8, "max": 10, "state": "part" }, { "check": "Status page", "value": "status.dev.azure.com", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "published but past its Expires date", "points": 5, "max": 10, "state": "part" } ], "policies": [ { "kind": "terms", "url": "https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all", "state": "read", "readAt": "2026-10-08", "words": 5677, "points": 3.4, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": false }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…no responsibility or liability for any losses or damages due to performance issues (including but not limited to security vulnerabilities, data loss, or service interruptions) of a Product that customer uses after the end of the applicable support period as provided in the Product Support Lifecycle [https://learn.micr…" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "If Microsoft suspends the Online Service, Microsoft will suspend only to the extent reasonably necessary." }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Except as permitted in this paragraph or in the Online Service-specific Terms, Customer may not reassign an SL on a short-term basis (i.e., within 90 days of the last assignment)." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "Many Online Services offer a Service Level Agreement (SLA)." } ], "toKnow": [ { "key": "terms.automated", "label": "Restricts automated access", "found": true, "quote": "Customer may not use web scraping, web harvesting, or other data extraction methods to extract data from a Microsoft Generative AI Service.", "costsPoints": true }, { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "If Customer offers a product or service competitive to an Online Service, by using the Online Service, Customer waives any restrictions on competitive use and benchmark testing in the terms governing its competitive products and services.", "costsPoints": true } ], "notes": [ { "date": "2026-10-08", "text": "A subscription that is not renewed can continue month by month, and Microsoft may invoice that period at the monthly price plus a three per cent uplift for certain Products.", "quote": "Microsoft reserves the right to invoice Customer for the Extended Term at the then-current published price for a monthly subscription plus a three (3) percent uplift for certain Products." }, { "date": "2026-10-08", "text": "After an account is disabled, the customer has 90 days to extract Customer Data and the subscription cannot be reactivated.", "quote": "Customer will have 90 days to extract Customer Data from a disabled account, but the Subscription cannot be reactivated." }, { "date": "2026-10-08", "text": "The customer is responsible for any application or AI agent it creates with Microsoft AI Services, including legal, regulatory and licensing compliance.", "quote": "Customer is responsible for the design, development and use of any application or AI agent it creates using or for use with Microsoft AI Services, including complying with any legal, regulatory, or licensing requirements applicable to the resulting application or AI agent or its use." } ] }, { "kind": "privacy", "url": "https://www.microsoft.com/en-us/privacy/privacystatement", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-09-01", "words": 33580, "points": 8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: September 2026", "says": "Last updated 2026-09-01" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The data we collect depends on the context of your interactions with Microsoft and the choices you make, including your privacy settings and the products and features you use." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "When you delete an email or item from a mailbox in Outlook.com, the item generally goes into your Deleted Items folder where it remains for approximately 7 days unless you move it back to your inbox, you empty the folder, or the service empties the folder automatically, whichever comes first.", "says": "Names a period of 7 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Service providers that help us determine your device’s location." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "not use or share student personal data for advertising or similar commercial purposes, such as providing personalized advertising to students;" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "State Data Privacy Notice (including notice at collection details) and the Consumer Health Data Privacy Policy for additional information about your rights and the processing of your personal data." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have a privacy concern, complaint, or question for the Microsoft privacy team or Data Protection Officer, please visit our privacy support and requests page and click on “Contact the Microsoft privacy team or the Microsoft Data Protection Officer” menu.", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "In such cases, we implement legal safeguards-such as standard contractual clauses approved by the European Commission – to help protect your rights and ensure your data remains protected.", "says": "Relies on standard contractual clauses" } ], "toKnow": [ { "key": "training", "label": "Says it may use customer content to train or improve models, and no opt-out was found", "found": true, "quote": "As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models.", "costsPoints": true }, { "key": "privacy.sells", "label": "Says it sells personal data or shares it for advertising", "found": true, "quote": "We also disclose personal data for digital advertising purposes." } ], "notes": [ { "date": "2026-10-08", "text": "For enterprise and developer products, the customer's agreement with Microsoft takes precedence over this privacy statement where the two conflict.", "quote": "In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control." }, { "date": "2026-10-08", "text": "Prompts and related data sent to the consumer Microsoft Copilot are used to improve services and for relevant advertising.", "quote": "Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising." }, { "date": "2026-10-08", "text": "Microsoft staff manually review some results of its automated systems, including AI, against the source data.", "quote": "For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/azure-devops-mcp.json", "live": { "slug": "azure-devops-mcp", "probe": { "target": "https://mcp.dev.azure.com/{organization}", "method": "mcp-initialize", "lastAt": "2026-10-08T19:52:45.296299708Z", "lastOk": true, "lastStatus": 400, "lastMs": 62, "authRequired": false, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 73, "p95ms24h": 118, "samples24h": 27, "samples30d": 27, "days": [ { "date": "2026-10-08", "probes": 27, "ok": 27 } ] }, "vendorStatus": { "page": "https://status.dev.azure.com", "indicator": "unknown", "summary": "no machine-readable status found", "checkedAt": "2026-10-08T19:38:15.819572841Z" }, "pages": [ { "url": "https://www.microsoft.com/en-us/privacy/privacystatement", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:29:10.811041134Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "a053fc7ce233" }, { "url": "https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all", "kind": "terms", "status": 502, "checkedAt": "2026-10-08T18:29:15.375311486Z", "changedAt": "0001-01-01T00:00:00Z" } ], "updatedAt": "2026-10-08T19:52:45.296299708Z" } }, "verify": { "accepts": "a page on microsoft.com or one of its subdomains, or the README of github.com/microsoft/azure-devops-mcp", "badgeUrl": "https://www.anchorterminal.com/badges/azure-devops-mcp.svg", "body": { "slug": "azure-devops-mcp", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/azure-devops-mcp", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/azure-devops-mcp\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/azure-devops-mcp.svg\" alt=\"Azure DevOps MCP Server on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![Azure DevOps MCP Server on Anchor Terminal](https://www.anchorterminal.com/badges/azure-devops-mcp.svg)](https://www.anchorterminal.com/tools/azure-devops-mcp)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/azure-devops-mcp\"\u003eAzure DevOps MCP Server on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/azure-devops-mcp", "json": "https://www.anchorterminal.com/tools/azure-devops-mcp.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/azure-devops-mcp.md", "slim": "https://www.anchorterminal.com/tools/azure-devops-mcp.min.md" }, "markdown": "## Overview\n\n**Grade B · 66.3/100 · rank #238 of 722 · #3 in Code \u0026 developer platforms · not agent-ready · confidence medium**\n\n\nMore from Microsoft, listed separately because each is its own product: [Microsoft Foundry fine-tuning (Azure OpenAI)](https://www.anchorterminal.com/tools/azure-foundry-fine-tuning.md) (Fine-tuning), [Azure AI Content Safety (Prompt Shields)](https://www.anchorterminal.com/tools/azure-ai-content-safety.md) (Guardrails \u0026 safety filters), [Azure AI Speech speech-to-text](https://www.anchorterminal.com/tools/azure-speech-to-text.md) (Speech-to-text), [Azure AI Speech text-to-speech](https://www.anchorterminal.com/tools/azure-text-to-speech.md) (Text-to-speech), [Microsoft Agent Framework](https://www.anchorterminal.com/tools/microsoft-agent-framework.md) (Agent frameworks \u0026 SDKs), [Microsoft Execution Containers](https://www.anchorterminal.com/tools/microsoft-execution-containers.md) (Code execution sandboxes), [Microsoft Entra Agent ID](https://www.anchorterminal.com/tools/microsoft-entra-agent-id.md) (Agent auth \u0026 delegated access), [Azure Key Vault](https://www.anchorterminal.com/tools/azure-key-vault.md) (Secrets \u0026 credential vaults), [Microsoft Learn MCP Server](https://www.anchorterminal.com/tools/microsoft-learn-mcp.md) (Code \u0026 developer platforms), [Playwright MCP](https://www.anchorterminal.com/tools/playwright-mcp.md) (Browser automation), [Azure MCP Server](https://www.anchorterminal.com/tools/azure-mcp.md) (Cloud \u0026 infrastructure), [Azure Maps](https://www.anchorterminal.com/tools/azure-maps.md) (Maps, geocoding \u0026 places), [Azure Translator](https://www.anchorterminal.com/tools/azure-translator.md) (Translation), [Microsoft Graph Calendar API](https://www.anchorterminal.com/tools/microsoft-graph-calendar.md) (Calendars \u0026 scheduling), [Microsoft Teams (Microsoft Graph)](https://www.anchorterminal.com/tools/microsoft-teams.md) (Work \u0026 productivity), [Microsoft Dynamics 365 Sales](https://www.anchorterminal.com/tools/dynamics-365-sales.md) (CRM \u0026 customer platforms), [Microsoft Power Automate](https://www.anchorterminal.com/tools/power-automate.md) (Workflow automation), [Microsoft Advertising API](https://www.anchorterminal.com/tools/microsoft-advertising-api.md) (Advertising \u0026 campaign operations), [Microsoft Excel (Microsoft Graph workbook API)](https://www.anchorterminal.com/tools/microsoft-excel-graph.md) (Spreadsheets \u0026 operational tables), [Outlook Mail (Microsoft Graph)](https://www.anchorterminal.com/tools/outlook-mail-graph.md) (Mailbox access).\n\n## Assessment\n\nThe hosted endpoint takes Entra OAuth with Azure DevOps scopes, an `X-MCP-Readonly` header and toolset or per-tool filters, and the MIT local package annotates every tool. The remote server is still labelled public preview, and Claude Code and Cursor need a custom Entra app registration with admin consent before they can use it.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | Microsoft (https://azure.microsoft.com/en-us/products/devops) |\n| Kind | MCP server |\n| Category | Code \u0026 developer platforms (https://www.anchorterminal.com/categories/code) |\n| Transport | Streamable HTTP, stdio |\n| Endpoint | `https://mcp.dev.azure.com/{organization}` |\n| Auth | OAuth or key · Remote server: Microsoft Entra ID OAuth only, with the bearer token in the `Authorization` header. Personal access tokens aren't accepted, and the organisation must be backed by an Entra tenant. Visual Studio Code, Visual Studio, Microsoft Foundry, Copilot Studio and the GitHub Copilot clients sign in directly. Claude Code and Cursor need a custom Entra app registration with delegated Azure DevOps scopes and admin consent, because Entra has no dynamic client registration. Claude Desktop and Codex can't use the remote server. Local server: interactive Entra sign-in by default, or `azcli`, `env` (DefaultAzureCredential), `envvar` (bearer token in `ADO_MCP_AUTH_TOKEN`) or `pat` (base64 of email and PAT in `PERSONAL_ACCESS_TOKEN`). Personal Microsoft accounts aren't supported (checked 2026-10-08). |\n| Pricing | Freemium ($6 / seat-mo) · The MCP server is free, and standard Azure DevOps pricing applies to the organisation behind it. The Basic plan is free for the first five users, then $6 a user a month. Basic + Test Plans is $52 a user a month with a 30-day trial. An agent can start on the five free users without a contract, but a person has to create the organisation and sign in (checked 2026-10-08). |\n| x402 | No · No x402, MPP or L402 in the Learn docs, the repository or the pricing page (checked 2026-10-08). |\n| Licence | MIT for the local server in the repository. The hosted remote server is a Microsoft online service under the customer's Azure DevOps terms |\n| Tools exposed | 48 |\n| Packages | npm: `@azure-devops/mcp` |\n| Source | https://github.com/microsoft/azure-devops-mcp |\n| Docs | https://learn.microsoft.com/en-us/azure/devops/mcp-server/mcp-server-overview |\n| llms.txt | not found |\n| Last release | 2026-09-09 |\n| GitHub stars | 2,000 (as of 2026-10-08) |\n| npm downloads / week | 120,075 |\n| Surface graded | The hosted remote server at mcp.dev.azure.com, which Microsoft recommends. Tool definitions were read from the local package's source, which Microsoft is aligning with the remote server |\n| Status | Remote server in public preview since 17 March 2026. Local package at 2.10.0 (9 September 2026), Node.js 20 or later |\n| Read vs write | Reads projects, teams, iterations, work items, queries, repositories, branches, files, commits, pull requests, builds, logs, artifacts, wikis, test plans and security alerts. Writes work items, comments, links, attachments, pull requests, review threads, branches, pipeline runs and definitions, wiki pages and test plans. The local package also commits files |\n| Tool filtering | Remote: `X-MCP-Toolsets`, `X-MCP-Tools`, `X-MCP-Readonly`, `X-MCP-Insiders`. Local: `-d` with core, work, work-items, search, test-plans, repositories, wiki, pipelines, advanced-security |\n| Clients | Remote works directly in Visual Studio Code, Visual Studio, Microsoft Foundry, Copilot Studio, GitHub Copilot CLI and the GitHub Copilot app. Cursor and Claude Code need a custom Entra app registration. Claude Desktop and Codex use the local package |\n| Rate limits | Azure DevOps limits a user to 200 TSTUs in a sliding five-minute window, delays requests above it and answers 429 with `Retry-After` when blocking |\n| Data location | Eight Azure DevOps geographies (United States, Canada, Europe, United Kingdom, India, Australia, Asia Pacific, Brazil), chosen when the organisation is created |\n| Capabilities | code.repo, work.issues, code.deploy, work.docs |\n| Tags | official, hosted, mcp, oauth, entra-id, read-only-mode, toolsets, open-source, preview, npm |\n| JSON | https://www.anchorterminal.com/api/v1/tools/azure-devops-mcp.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 72 | 14.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 64 | 10.4 |\n| Agent ergonomics | 13% | 16.2 | 70 | 11.4 |\n| Security \u0026 auth | 14% | 17.5 | 81 | 14.2 |\n| Payments \u0026 pricing | 10% | 12.5 | 40 | 5.0 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 80 | 7.0 |\n| Transparency \u0026 trust (editorial 72, provenance 86) | 7% | 8.8 | 79 | 6.9 |\n| Negative events | up to −15 | up to −15 | 2026-07-29: version 2.9.0 of the local package renamed its tools in a minor release while consolidating them to match the remote server. The README warning and the advice to pin 2.8.1 were added on 31 July, and no aliases were kept. Documented since, so the deduction is small (https://github.com/microsoft/azure-devops-mcp/pull/1476). | -3 |\n| **Total** | | | | **66.3 → B** |\n\n### Why each score\n\n- Reliability 72: Scored with the hosted lines, because the remote endpoint is the one Microsoft recommends. status.dev.azure.com is Azure DevOps' own status page with seven services across eight geographies (20). Its health API reported every service healthy on 8 October 2026 and the history page listed no events, but the page's filter is drawn by script and we couldn't confirm the view covers 90 days. The MCP endpoint is not a named component (15). Azure DevOps publishes a limit of 200 TSTUs per user in a sliding five-minute window, with delays of up to 30 seconds before blocking (15). Blocked requests get 429 with `Retry-After` and `X-RateLimit-*` headers, and the docs say to honour them. No retry guidance for writes was found (12). The data protection page states a 99.9 per cent SLA with refunds for Azure DevOps. Whether it covers the preview endpoint wasn't established (10). The remote server was announced as a public preview on 17 March 2026 and no general availability notice was found (0).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 64: Every tool in the local package has a zod schema turned into JSON Schema. The remote server's own definitions sit behind Entra sign-in and weren't read, and the docs list its tools and actions only (20). learn.microsoft.com has no llms.txt (404) but returns Markdown when asked with `Accept: text/markdown` (10). Descriptions are short, with a median of 89 characters across 45 tools, and most say only to use the `action` parameter. A few, such as `repo_pull_request_org`, say when to choose them (8). Enums, bounds and required organisation fields are present and no tool takes a free-form object. The dispatcher design leaves most parameters optional with a note such as \"Used for update\", so the schema can't mark what each action needs (10). TOOLSET.md lists parameters per tool and EXAMPLES.md gives prompts. Errors are plain-text tool results, and the troubleshooting page covers Entra error codes (8). The local package has semver releases with notes. The remote server is updated separately with no changelog found, and its tool page warns that the list may lag (8).\n- Agent ergonomics 70: 48 tools documented for the remote server (5), with `X-MCP-Toolsets`, `X-MCP-Tools` and `X-MCP-Readonly` adding back 10. `top`, `skip` and continuation tokens on list and search tools, and the source trims pull request threads and branch lists before returning them (16). Errors name the missing parameter or pass Azure DevOps' message through as an `isError` result. Local sign-in failures in headless environments surface as a generic `fetch failed` per the troubleshooting guide (13). All 45 local tools set `readOnlyHint`, `destructiveHint`, `idempotentHint` and `openWorldHint`, with a test that fails on a missing entry, and work item updates accept a revision test for concurrency. There are no idempotency keys (16). The organisation comes from the URL and project and team defaults can be set by environment variable, but most calls still need a project. We confirmed the Node client library the server is built on, and didn't confirm a second official SDK (10).\n- Security \u0026 auth 81: The remote server accepts only Microsoft Entra OAuth with delegated Azure DevOps scopes, in the `Authorization` header, and a call needs both the app scope and the user's own permission. Conditional Access applies. The local package also takes PATs, which can be scoped and revoked (30). `X-MCP-Readonly`, toolset and per-tool headers, and guidance to grant read scopes only. No confirmation step for write tools was found, and `repo_pull_request_write` can set policy bypass on autocomplete when given a reason (14). The local source wraps returned content in random delimiters marked untrusted, with tests, though the Learn docs don't describe this or say whether the remote server does the same (11). Azure DevOps auditing exists for Entra-backed organisations and is itself labelled preview. Its event list has no MCP-specific events (8). SECURITY.md routes reports to MSRC, Azure DevOps is in Microsoft's bounty programme, and the data protection page lists SOC 2 Type 2 and ISO 27001:2022. The repository has no published advisories and microsoft.com's security.txt expired on 23 September 2026 (18).\n- Payments \u0026 pricing 40: No x402, MPP or L402 (0). The server is free and Azure DevOps prices are public, with Basic at $6 a user a month after five free users (20). The first five users are free and the pricing page states no card requirement for them (20). A person has to create the organisation and sign in through Entra, and outside Microsoft's clients an administrator has to register an app (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 80: 2.10.0 was published to npm on 9 September 2026, 29 days before the check (30). Three stable releases in the last 90 days (2.8.1 on 14 July, 2.9.0 on 29 July, 2.10.0 on 9 September), nightly builds on the `next` tag, and commits as recent as 7 October (20). The issues page listed four open issues on 8 October, the oldest opened on 23 September, against issue numbers above 1,680. We couldn't read reply times (20). The official MCP registry has no entry under a Microsoft namespace. The repository's server.json names `com.microsoft/azure-devops`, but the registry returns only a third party's listing for this repository (0). Dependabot runs daily, and build, test, tool-name validation, CodeQL and dependency review workflows run on pull requests (10).\n- Transparency \u0026 trust 79: The local server is MIT, and the hosted service runs under Microsoft's online service terms (30). Azure DevOps documents encryption, replication, a 28-day recovery window for deleted organisations and its data locations. Nothing says what the remote MCP server logs or keeps, and the overview's privacy section says project information never leaves the customer's network, which doesn't fit a hosted endpoint (18). The README says the remote server will eventually replace the local one and asks users to plan migration, with no date. Dated notices exist for global PATs (1 December 2026) and Azure DevOps OAuth (10). Eight data geographies and the remote server's two outbound IP addresses are published. We didn't read a subprocessor list. The local source has no telemetry beyond a user agent string naming the MCP client (14).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (19 items): https://www.anchorterminal.com/fixes/azure-devops-mcp.md (JSON https://www.anchorterminal.com/fixes/azure-devops-mcp.json)\n\n### What we couldn't check\n\n- unchecked: whether the remote server reached general availability. The roadmap lists it under 2026 Q3, and we found only the preview announcement and a README that still mentions the preview period\n- unchecked: the 90-day incident record. The status history page listed no events but its date filter is drawn by script\n- unchecked: the remote server's own tool definitions and annotations, which need an Entra sign-in to list\n- unchecked: the Azure DevOps entry in the Product Terms and the SLA text, both on pages drawn by script, and whether the SLA covers a preview endpoint\n- unchecked: reply times on GitHub issues and the exact star count (the page shows 2.0k)\n- unchecked: whether creating an Azure DevOps organisation asks for a payment card\n- What the remote server logs and how long it keeps it, which no page we read states\n- The overview page (12 August 2026) says Claude Code and Cursor must use the local server, while the remote page (21 September 2026) gives them a route through a custom Entra app registration\n\n### Sources\n\n- remote server setup, headers, tool list and client support: \u003chttps://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops\u003e (seen 2026-10-08)\n- overview, pricing statement and privacy section: \u003chttps://learn.microsoft.com/en-us/azure/devops/mcp-server/mcp-server-overview?view=azure-devops\u003e (seen 2026-10-08)\n- remote server troubleshooting, authentication and Conditional Access: \u003chttps://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server-troubleshooting?view=azure-devops\u003e (seen 2026-10-08)\n- repository source, README, tool annotations and release tags: \u003chttps://github.com/microsoft/azure-devops-mcp\u003e (seen 2026-10-08)\n- public preview announcement: \u003chttps://devblogs.microsoft.com/devops/azure-devops-remote-mcp-server-public-preview/\u003e (seen 2026-10-08)\n- roadmap entry for general availability: \u003chttps://learn.microsoft.com/en-us/azure/devops/release-notes/features-timeline\u003e (seen 2026-10-08)\n- status page and health API: \u003chttps://status.dev.azure.com/_history\u003e (seen 2026-10-08)\n- rate limits and retry headers: \u003chttps://learn.microsoft.com/en-us/azure/devops/integrate/concepts/rate-limits?view=azure-devops\u003e (seen 2026-10-08)\n- data protection, SLA statement and certifications: \u003chttps://learn.microsoft.com/en-us/azure/devops/organizations/security/data-protection?view=azure-devops\u003e (seen 2026-10-08)\n- auditing events list: \u003chttps://learn.microsoft.com/en-us/azure/devops/organizations/audit/auditing-events?view=azure-devops\u003e (seen 2026-10-08)\n- pricing: \u003chttps://azure.microsoft.com/en-us/pricing/details/devops/azure-devops-services/\u003e (seen 2026-10-08)\n- npm package versions and dates: \u003chttps://registry.npmjs.org/@azure-devops/mcp\u003e (seen 2026-10-08)\n- official MCP registry search: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=azure-devops\u0026limit=100\u003e (seen 2026-10-08)\n- open issues: \u003chttps://github.com/microsoft/azure-devops-mcp/issues\u003e (seen 2026-10-08)\n- security advisories: \u003chttps://github.com/microsoft/azure-devops-mcp/security/advisories\u003e (seen 2026-10-08)\n- security.txt: \u003chttps://www.microsoft.com/.well-known/security.txt\u003e (seen 2026-10-08)\n\n## Who's behind it (provenance 86/100, checked 2026-10-08)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | Microsoft Corporation | 20/20 |\n| Domain age | microsoft.com, registered 1991-05-02 (35 years) | 15/15 |\n| Endpoint on the vendor's domain | mcp.dev.azure.com | 15/15 |\n| Terms of service | read, states 4 of the 7 things a reader expects, and has 2 clauses that cost points | 3.4/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects, and has 1 clause that costs points | 8/10 |\n| Status page | status.dev.azure.com | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | published but past its Expires date | 5/10 |\n\nThe hosted server answers at mcp.dev.azure.com, a Microsoft domain. microsoft.com publishes a security.txt, but it passed its Expires date on 2026-09-23.\n\nThe remote endpoint is on mcp.dev.azure.com and the status page on status.dev.azure.com. azure.com and microsoft.com are Microsoft domains, and the docs are on learn.microsoft.com.\n\nThe Product Terms page loaded on 8 October 2026 but draws its content by script, so the Azure DevOps entry and the SLA reference were not read. Self-serve Azure accounts also accept the Microsoft Online Subscription Agreement at https://azure.microsoft.com/en-us/support/legal/subscription-agreement/.\n\nThe local package's own terms are the MIT licence in the repository.\n\nhttps://www.microsoft.com/.well-known/security.txt shows Expires 2026-09-23T16:00:00.000Z, so it had expired when read on 8 October 2026. It points to the MSRC researcher portal, the bounty policy and the coordinated disclosure policy.\n\nThe remote server has no changelog of its own. The repository's releases cover the local package, and the Azure DevOps sprint release notes carried the preview announcement.\n\nDomain registration date carried from our other Microsoft listings (RDAP, 1991-05-02), not looked up again today.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all), read 2026-10-08, gives no date, states 4 of the 7 things a reader expects.\n\n- To know. Restricts automated access (costs points). \"Customer may not use web scraping, web harvesting, or other data extraction methods to extract data from a Microsoft Generative AI Service.\"\n- To know. Restricts benchmarking or competitive use (costs points). \"If Customer offers a product or service competitive to an Online Service, by using the Online Service, Customer waives any restrictions on competitive use and benchmark testing in the terms governing its competitive products and services.\"\n- Not found in the text. Gives the date it was last updated.\n- Not found in the text. Names the governing law or courts.\n- Not found in the text. Says how changes to the terms are announced.\n- Also in the text (2026-10-08). A subscription that is not renewed can continue month by month, and Microsoft may invoice that period at the monthly price plus a three per cent uplift for certain Products. \"Microsoft reserves the right to invoice Customer for the Extended Term at the then-current published price for a monthly subscription plus a three (3) percent uplift for certain Products.\"\n- Also in the text (2026-10-08). After an account is disabled, the customer has 90 days to extract Customer Data and the subscription cannot be reactivated. \"Customer will have 90 days to extract Customer Data from a disabled account, but the Subscription cannot be reactivated.\"\n- Also in the text (2026-10-08). The customer is responsible for any application or AI agent it creates with Microsoft AI Services, including legal, regulatory and licensing compliance. \"Customer is responsible for the design, development and use of any application or AI agent it creates using or for use with Microsoft AI Services, including complying with any legal, regulatory, or licensing requirements applicable to the resulting application or AI agent or its use.\"\n\n**Privacy policy** (https://www.microsoft.com/en-us/privacy/privacystatement), read 2026-10-08, dated 2026-09-01, states 8 of the 8 things a reader expects.\n\n- To know. Says it may use customer content to train or improve models, and no opt-out was found (costs points). \"As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models.\"\n- To know. Says it sells personal data or shares it for advertising. \"We also disclose personal data for digital advertising purposes.\"\n- Gives the date it was last updated. Last updated 2026-09-01.\n- Says how long data is kept. Names a period of 7 days.\n- Gives a privacy contact. Names a data protection officer.\n- Says where data is transferred or stored. Relies on standard contractual clauses.\n- Also in the text (2026-10-08). For enterprise and developer products, the customer's agreement with Microsoft takes precedence over this privacy statement where the two conflict. \"In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control.\"\n- Also in the text (2026-10-08). Prompts and related data sent to the consumer Microsoft Copilot are used to improve services and for relevant advertising. \"Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising.\"\n- Also in the text (2026-10-08). Microsoft staff manually review some results of its automated systems, including AI, against the source data. \"For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data.\"\n\n## Live (updated 2026-10-08 19:52 UTC)\n\n- Right now: up, HTTP 400, 62 ms, checked 2026-10-08 19:52 UTC (mcp-initialize on `https://mcp.dev.azure.com/{organization}`)\n- Uptime 24h 100.0% (27 probes) · 30 days 100.0% (27 probes) · p50 73 ms · p95 118 ms\n- Vendor status page: unknown, no machine-readable status found\n- Watching privacy \u003chttps://www.microsoft.com/en-us/privacy/privacystatement\u003e\n- Watching terms \u003chttps://www.microsoft.com/licensing/terms/product/ForOnlineServices/all\u003e\n- Always current: https://www.anchorterminal.com/api/v1/live/azure-devops-mcp.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Prices\n\n| Item | Price | Unit | Note |\n| --- | --- | --- | --- |\n| Azure DevOps Basic plan | $6 | per seat per month | first five users free. The MCP server adds no charge |\n| Azure DevOps Basic + Test Plans | $52 | per seat per month | 30-day trial |\n\nAcross all listings: https://www.anchorterminal.com/prices/index.md\n\n## Strengths\n\n- `X-MCP-Readonly`, `X-MCP-Toolsets` and `X-MCP-Tools` headers trim the remote server to read tools, eight toolsets or named tools\n- Remote access uses Microsoft Entra OAuth with Azure DevOps scopes, and a call needs both the app scope and the user's own permission\n- All 45 tools in the local package carry read-only, destructive, idempotent and open-world hints, checked by a test\n- The local package wraps Azure DevOps content in random delimiters marked untrusted before it reaches the model\n- Three stable npm releases between 14 July and 9 September 2026, nightly builds, and 81 commits since 10 July\n\n## Weaknesses\n\n- The remote server was announced as a public preview on 17 March 2026 and no general availability notice was found\n- Claude Code and Cursor need a custom Entra app registration with admin consent, and Claude Desktop and Codex can't use the remote server\n- Version 2.9.0 renamed the local tools in a minor release on 29 July 2026, with the README warning added two days later\n- No entry under a Microsoft namespace in the official MCP registry. The only listing naming this repository is a third party's\n- Most tool descriptions are one line ending in an instruction to use the `action` parameter, with a median of 89 characters\n\n## Before you call it (notes for agents)\n\n1. Put the organisation in the URL (`https://mcp.dev.azure.com/{organization}`). Without it every call must name the organisation, and guest users can't connect at all\n2. Send `X-MCP-Readonly: true` for read tasks and `X-MCP-Toolsets: repos,wit` to cut the tool list. Don't combine `X-MCP-Toolsets` with `X-MCP-Tools`\n3. Name the project in each call. A missing project is the error the vendor reports most often\n4. For headless runs use the local package with `--authentication envvar` and a token in `ADO_MCP_AUTH_TOKEN`. The default interactive sign-in fails without a browser\n5. On HTTP 429 wait for `Retry-After`. Azure DevOps delays or blocks a user above 200 TSTUs in a sliding five-minute window\n\n## Connect\n\nInstall:\n\n```bash\nnpx -y @azure-devops/mcp \u003corganization\u003e\n```\n\nClaude Code:\n\n```bash\nclaude mcp add --transport http ado https://mcp.dev.azure.com/{organization} --client-id {client-id} --callback-port 3118\n```\n\nMCP client configuration:\n\n```json\n{\n \"inputs\": [],\n \"servers\": {\n \"ado-remote-mcp\": {\n \"headers\": {\n \"X-MCP-Readonly\": \"true\",\n \"X-MCP-Toolsets\": \"repos,wiki,wit\"\n },\n \"type\": \"http\",\n \"url\": \"https://mcp.dev.azure.com/{organization}\"\n }\n }\n}\n```\n\nHeadless / CI:\n\n```json\n{\n \"mcpServers\": {\n \"ado\": {\n \"args\": [\n \"-y\",\n \"@azure-devops/mcp\",\n \"\\u003corganization\\u003e\",\n \"--authentication\",\n \"envvar\"\n ],\n \"command\": \"npx\",\n \"env\": {\n \"ADO_MCP_AUTH_TOKEN\": \"${ADO_MCP_AUTH_TOKEN}\"\n }\n }\n }\n}\n```\n\nThrough letme (picks today, calling later): https://letme.dev/azure-devops-mcp (letme picks it for code.deploy, the top-graded tool for the job). letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Atlassian Rovo MCP Server | C | 57.9 | 461 | work.issues, work.docs, code.repo | no | https://www.anchorterminal.com/tools/atlassian-rovo-mcp.md |\n| GitHub MCP Server | BB | 70.3 | 138 | code.repo, work.issues | no | https://www.anchorterminal.com/tools/github-mcp-server.md |\n| YouTrack | D | 49.9 | 601 | work.issues, work.docs | no | https://www.anchorterminal.com/tools/youtrack.md |\n| Google Drive API + MCP | A | 79.6 | 11 | work.docs | no | https://www.anchorterminal.com/tools/google-drive-api.md |\n| monday.com | BB | 76.4 | 32 | work.docs | no | https://www.anchorterminal.com/tools/monday.md |\n| Box API + MCP | B | 69.4 | 158 | work.docs | no | https://www.anchorterminal.com/tools/box-api.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- The remote server is a hosted streamable HTTP endpoint at https://mcp.dev.azure.com/{organization}, recommended over the local package, which the README says it will eventually replace (source: \u003chttps://github.com/microsoft/azure-devops-mcp\u003e)\n- 48 tools documented for the remote server in nine groups (core, work, repos, work items, pipelines, wiki, test plans, Advanced Security, Enterprise Live Migration), most of them dispatchers that take an `action` parameter. Two are Insiders-only (source: \u003chttps://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops\u003e)\n- Headers on the remote server: `X-MCP-Toolsets` (repos, advsec, wit, pipelines, wiki, work, testplan, elm), `X-MCP-Tools` for named tools, `X-MCP-Readonly` and `X-MCP-Insiders` (source: \u003chttps://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops\u003e)\n- Announced as a public preview on 17 March 2026. The roadmap page dated 5 August 2026 lists general availability under 2026 Q3, but its link leads to the preview note and the README still speaks of the preview period (source: \u003chttps://devblogs.microsoft.com/devops/azure-devops-remote-mcp-server-public-preview/\u003e)\n- The local package registers 45 tools in ten domains selectable with `-d`, each with four MCP annotation hints, and wraps returned Azure DevOps content in nonce delimiters marked untrusted (source: \u003chttps://github.com/microsoft/azure-devops-mcp/blob/main/src/shared/content-safety.ts\u003e)\n- Version 2.9.0 of 29 July 2026 consolidated and renamed the local tools to match the remote server. The README told users they could pin 2.8.1 (source: \u003chttps://github.com/microsoft/azure-devops-mcp/pull/1476\u003e)\n- Azure DevOps Services only. Neither server works with Azure DevOps Server on premises (source: \u003chttps://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server-troubleshooting?view=azure-devops\u003e)\n- The official MCP registry has no entry under a Microsoft namespace. `io.github.PremierInc/azure-devops` points at this repository from a third-party namespace (source: \u003chttps://registry.modelcontextprotocol.io/v0/servers?search=azure-devops\u003e)\n\n## Compare\n\n- [Azure DevOps MCP Server vs GitHub MCP Server](https://www.anchorterminal.com/compare/azure-devops-mcp-vs-github-mcp-server.md): B 66.3 vs BB 70.3\n- [Azure DevOps MCP Server vs Sourcegraph MCP Server](https://www.anchorterminal.com/compare/azure-devops-mcp-vs-sourcegraph-mcp.md): B 66.3 vs C 57.5\n- [Azure DevOps MCP Server vs Salesforce DX MCP Server](https://www.anchorterminal.com/compare/azure-devops-mcp-vs-salesforce-dx-mcp.md): B 66.3 vs C 59.5\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on microsoft.com or one of its subdomains, or the README of github.com/microsoft/azure-devops-mcp. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"azure-devops-mcp\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/azure-devops-mcp\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/azure-devops-mcp.svg\" alt=\"Azure DevOps MCP Server on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![Azure DevOps MCP Server on Anchor Terminal](https://www.anchorterminal.com/badges/azure-devops-mcp.svg)](https://www.anchorterminal.com/tools/azure-devops-mcp)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/azure-devops-mcp\"\u003eAzure DevOps MCP Server on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say Azure DevOps MCP Server is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/azure-devops-mcp-dark.png\n- Light: https://www.anchorterminal.com/assets/share/azure-devops-mcp-light.png\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Code \u0026 developer platforms", "url": "https://www.anchorterminal.com/categories/code" }, { "name": "Azure DevOps MCP Server", "url": "" } ], "description": "Microsoft's official MCP server for Azure DevOps Services. It gives agents work items, repositories, pull requests, pipelines, wikis, test plans and Advanced Security alerts, through a hosted endpoint with Microsoft Entra sign-in or a local npm package.", "facts": [ "rank #238 of 722", "OAuth or key auth", "0 desk reviews" ], "h1": "Azure DevOps MCP Server", "image": "https://www.anchorterminal.com/assets/og/tools-azure-devops-mcp.png", "path": "/tools/azure-devops-mcp", "published": "2026-10-01", "section": "tools", "title": "Azure DevOps MCP Server review for AI agents, grade B (66.3/100)", "toc": null, "updated": "2026-10-08", "url": "https://www.anchorterminal.com/tools/azure-devops-mcp" }, "tokens": { "markdown": 8800, "slim": 1630 }, "version": 1 }