mcp-ado-browser
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-ado-browserlist my active pull requests"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-ado-browser
Azure DevOps for MCP — via your browser, not a PAT.
An MCP (stdio) server that gives read-only access to Azure DevOps using only your existing browser session — no PAT, no Azure CLI, no official ADO MCP, no credential provider. The only source of authentication is the session of a real browser, driven by Playwright on an isolated, dedicated profile.
It is org-wide by default: only the organization is required, and it browses every project, repo and feed you can access.
Requests reuse whatever credential your signed-in browser session already carries.
Where Azure DevOps authenticates the web app with a bearer token rather than cookies,
the server loads the app shell once, observes the Authorization: Bearer header on
the app's own API traffic, and replays that token for every host (dev.azure.com,
feeds, pkgs, almsearch). You get JSON back — never DOM scraping for data the
REST API provides. No PAT is ever created, and no token is written to disk.
Why these choices (restricted-environment friendly)
Concern | Decision |
No Playwright browser download |
|
SQLite without a native build |
|
One package, one binary | The MCP server and the |
No hardcoded values | org/project/ids come from flags/env or discovery; api-versions live only in |
Related MCP server: MCP Server for Azure DevOps
How it works
flowchart TD
A["authenticate<br/>(visible, chromeless window)"] -->|"sign in once · MFA"| P[("browser session<br/>persisted on an isolated profile")]
P -. restored .-> W["headless work session"]
W -->|"loads the app shell once"| T{{"session access token<br/>(observed, in memory only)"}}
MC["MCP client<br/>(Claude / Cursor / …)"] -->|"tools/call"| SRV["mcp-ado-browser<br/>(stdio MCP server)"]
SRV --> W
T --> ADO["dev.azure.com · feeds · pkgs · almsearch<br/>(your real session)"]
ADO -->|"JSON"| W
W --> SRV
SRV <-->|"TTL + Rev freshness"| DB[("SQLite cache")]Authentication is your browser, not a PAT.
authenticateopens a real, visible browser window on a dedicated, isolated profile (never your daily browser). You sign in normally (MFA included). The tool detects success by polling an authenticated endpoint, then snapshots the browser session to disk. No PAT is ever created.Work runs headless. Subsequent runs launch the same profile headless and restore that snapshot — no window, no re-login until the session expires. The snapshot is needed because the cookie that keeps the Azure DevOps app shell loaded is a session cookie, which Chrome drops when it exits.
Requests reuse the web app's own credential. On the tenants this was tested against, the Azure DevOps web app authenticates its API with
Authorization: Bearer(MSAL) and a cookie-only request gets401on every host — the sign-in URL even carriesprotocol=cookieless. (This is observed behaviour; we found no Microsoft announcement of such a change, so treat it as something that varies rather than a rule.) The server therefore loads the app shell once, observes the token on the app's own API calls, and replays it. One token coversdev.azure.com,feeds,pkgsandalmsearchalike.The token is held in memory only and refreshed automatically on a
401. It is deliberately never written to disk: a bearer token reachable from JS is more exposed than anhttpOnlycookie — Microsoft's own MSAL guidance states browser storage is only safe absent XSS, and that its cache encryption "reduce[s] the persistence of auth artifacts, not to provide additional security". This server does not widen that exposure.401and403are kept distinct.401means the session is dead →AUTH_REQUIRED, re-runauthenticate.403means you are signed in but lack permission on that resource (a private feed, say) → a403error saying so. Re-authenticating cannot fix a permission problem.Responses are cached in a local SQLite DB (
node:sqlite) with a configurable TTL. On a stale hit, a cheap freshness check (System.Revfor work items) avoids re-downloading unchanged data.When the session dies, tools fail fast with
AUTH_REQUIRED— just re-runauthenticateand continue.
Getting started
Prerequisites: Node ≥ 22.5 and Google Chrome (or Microsoft Edge) installed. You do not need a PAT, the Azure CLI, or any admin setup.
Setup is two steps:
Register the server in your MCP client (one config entry — see your client below).
Sign in once — just ask your assistant: “authenticate to Azure DevOps”. The built-in
authenticatetool opens a visible browser window; you log in (MFA), and the session is persisted. (No separate terminal command needed.) From then on everything runs headless until the session expires — then just ask it to authenticate again.
The command every client runs is the same:
npx -y mcp-ado-browser --org <your-org>Config is passed as CLI flags (--org, --project, …) or env vars (ADO_ORG, …);
flags win. Then ask things like “list my active pull requests”, “show work item 1234
and its linked PR”, or “what feeds and packages are in this org?”.
Tip: prefer per-user/local config (not committed) so your org name doesn't land in a shared repo. Or omit
--orgfrom a committed config and setADO_ORGin your env.
Use it from your MCP client
claude mcp add ado --scope local -- npx -y mcp-ado-browser --org <your-org>Then ask Claude to “authenticate to Azure DevOps”.
{
"mcpServers": {
"ado": {
"command": "npx",
"args": ["-y", "mcp-ado-browser", "--org", "<your-org>"]
}
}
}{
"servers": {
"ado": {
"type": "stdio",
"command": "npx",
"args": ["-y", "mcp-ado-browser", "--org", "<your-org>"]
}
}
}Open Copilot Chat in Agent mode and pick the ado tools. (Avoid committing your org —
use ${env:ADO_ORG} or a personal config.)
{
"mcpServers": {
"ado": {
"command": "npx",
"args": ["-y", "mcp-ado-browser", "--org", "<your-org>"]
}
}
}[mcp_servers.ado]
command = "npx"
args = ["-y", "mcp-ado-browser", "--org", "<your-org>"]After registering, trigger sign-in from the chat (“authenticate to Azure DevOps”),
which runs the authenticate tool. Prefer a terminal instead? npx -y mcp-ado-browser authenticate --org <your-org> does the same thing. Tools return a structured
AUTH_REQUIRED error when the session expires — re-authenticate and continue.
Tools (tools/list)
Tool | What it does |
| All projects you can access (org-wide). |
| All Git repos across the org (or one project). |
| WIQL (org-wide by default) or full-text (almsearch); |
| Work item with |
| The separate comments endpoint (project derived automatically). |
| A comment plus its downloaded attachments (size, sha256). |
| PRs org-wide, by repo, or by project; filter by status/author/target. |
| Metadata, branches, reviewers, linked work items (repo by id or name). |
| Threads, distinguishing system vs human. |
| Artifacts feeds → packages → versions. |
|
|
| Opens a visible browser for interactive sign-in (MFA); persists the session. Run it once, or whenever a tool returns |
Commands
The single npx mcp-ado-browser binary has a few subcommands:
Command | What it does |
| Start the MCP stdio server (default). |
| Interactive sign-in (visible browser). Same as the |
| Show the profile/cache paths, the org, and whether the session is signed in (and as who). |
| Clear the persisted session and the cache (a local sign-out). No org needed. |
Switching org with the same account needs nothing special — just change
--org; one sign-in covers every org that account can access. A different account →logoutfirst, thenauthenticateagainst the other org.
Where it stores things
Everything is local to your machine, under a single dedicated folder (mode 700, never
committed). Nothing is hosted remotely — the server is a local process spawned by your MCP
client over stdio.
What | Path (default) |
Browser session (profile) | macOS/Linux: |
Session snapshot (mode |
|
SQLite cache |
|
Package code (npx cache) | macOS/Linux: |
Reset everything (forces re-login): logout, or rm -rf ~/.mcp-ado-browser.
Configuration
Flag | Env | Default | Meaning |
|
| — | Organization (required). |
|
| — | Default project scope (optional; org-wide otherwise). |
|
|
| Isolated persistent browser profile. |
— |
|
| Session snapshot (mode |
|
|
|
|
|
|
| Global cache TTL. Per-resource: |
|
| discovery/defaults | Force an api-version for all areas. |
|
| app mode | Use a normal browser window for sign-in. |
|
| headless | Run work with a visible window. |
Development & verification
npm install
npm run build
npm run verify # all offline gates (browser stack, MCP, tools, cache, artifacts, no-hardcoding)
npm run verify:live # adds the live acceptance pass against real Azure DevOps
npm run scan:secrets # pre-push secret / sensitive-data scan
npm run demo:live # drive the real stdio server as an MCP client (env-driven)npm run verify prints a detailed report, gate by gate, assertion by assertion.
BLOCKED_ON_AUTH is transitory: the run is not done until the live pass is green; the
only tolerated terminal exclusion is EMPIRICALLY_BLOCKED (with evidence), for the
cross-host artifact download only.
Security & privacy
Authentication is only your real browser session on a dedicated, isolated profile — no PAT or token is ever created, stored, or transmitted by this tool.
The session lives in
~/.mcp-ado-browser/profile(machine-local, gitignored).Fixtures and reports are anonymized;
npm run scan:secretsblocks pushes that would leak personal/org data or secrets (also enforced in CI).
License
MIT © VMargan
Available Tools
12 toolsauthenticateA
Sign in to Azure DevOps by opening a VISIBLE browser window for interactive login (MFA included). Run this once (or whenever a tool returns AUTH_REQUIRED). The session is persisted on an isolated profile and reused headless afterward — no PAT or token is ever stored.
| Name | Required | Description | Default |
|---|---|---|---|
| timeoutSeconds | No | How long to wait for sign-in (default 240s). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden of behavioral disclosure. It explains the interactive browser window, MFA inclusion, session persistence on an isolated profile, headless reuse, and explicitly states that no PAT or token is stored. This fully discloses the tool's side effects and security posture, going well beyond what the schema or name alone would convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the core action and followed by concise usage guidance and behavioral notes. Every sentence earns its place: the first defines the action, the second covers usage frequency and session behavior. No redundant or filler content is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, with one optional parameter and no output schema. The description covers the full context: what it does, when to run it, how authentication persists, and the absence of stored tokens. For an authentication tool, this is complete and leaves no ambiguity about the agent's next steps or the tool's effects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage for the single parameter (timeoutSeconds) is 100%, with a clear description already in the schema: 'How long to wait for sign-in (default 240s).' The tool description does not add additional meaning about this parameter, so the baseline score of 3 applies. No compensation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Sign in to Azure DevOps by opening a VISIBLE browser window for interactive login (MFA included).' This uses a specific verb ('Sign in') and resource ('Azure DevOps'), and it is unambiguously distinct from the sibling tools, all of which are read-oriented data retrieval tools. The first sentence fully defines what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use it: 'Run this once (or whenever a tool returns AUTH_REQUIRED).' This is a clear, actionable condition that tells the agent exactly when this tool is needed versus other tools. It also implies when not to run it (when no AUTH_REQUIRED is returned), providing complete usage guidance for this prerequisite auth tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
download_artifactA
Download a package artifact (.nupkg / .tgz) from a feed via the browser session (pkgs.dev.azure.com). Validates archive integrity (size, sha256, valid zip/tgz) for re-hosting.
| Name | Required | Description | Default |
|---|---|---|---|
| feedId | Yes | Feed id (or name). | |
| project | No | Project scope of the feed (id or name). Resolved automatically from the feed; only set it to override. | |
| saveDir | Yes | Directory to write the downloaded artifact to. | |
| version | Yes | Exact version to download. | |
| protocol | Yes | Package protocol. | |
| packageName | Yes | Package name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It adds valuable context by stating that the download validates archive integrity (size, sha256, valid zip/tgz) for re-hosting, and that it uses the browser session. This goes beyond a simple 'downloads artifact' statement, though it doesn't detail error handling or file overwrite behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two focused sentences: the first states the core action and resource, the second adds validation detail. Every phrase earns its place, and it is front-loaded with the primary purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters and no output schema, the description covers the essential context (purpose, authentication via browser session, validation behavior). It doesn't explain return values, but for a file-download tool the saveDir parameter implies the outcome. It could mention prerequisites or failure modes, but overall it is fairly complete for its complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description does not add extra parameter meaning beyond what the schema already provides. It mentions package formats in general but doesn't elaborate on specific parameters like project override or saveDir semantics, leaving that to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Download a package artifact') and the specific resource (.nupkg / .tgz from a feed via pkgs.dev.azure.com). It further distinguishes the tool by mentioning validation for re-hosting, making it distinct from sibling tools which deal with projects, work items, or PRs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context (downloading artifacts from a feed) but does not explicitly state when to use this tool versus alternatives or list exclusions. The mention of 'browser session' hints at a prerequisite, but lacks explicit guidance like 'use this when downloading packages, otherwise use search_feeds to locate them.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_comment_detailsA
Resolve a work item (and optionally a specific comment) AND download all related attachments (work-item AttachedFile relations + attachments referenced in the comment body). Returns metadata + downloaded content stats (size, sha256).
| Name | Required | Description | Default |
|---|---|---|---|
| saveDir | No | Directory to write downloaded attachment files to (optional). | |
| commentId | No | Specific comment id to resolve (optional). | |
| workItemId | Yes | Work item id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry full behavioral disclosure. It does state the download behavior and that it returns size/sha256 stats, but it is ambiguous about what happens when saveDir is omitted and whether this writes to disk or is a read-only operation from the agent's perspective.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, every clause earns its place. The first sentence front-loads the core purpose, and the second succinctly describes return value. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains the scope of attachments and return stats, but lacks clarity on side effects, error behavior, and the role of the optional saveDir in the overall flow. Without an output schema, a bit more detail would be needed for full agent certainty.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline applies. The description adds context about attachment sources (AttachedFile relations + comment body references) but does not clarify parameter semantics beyond what the schema already provides (e.g., the effect of omitting saveDir).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific compound verb ('Resolve...AND download') identifying both the resource (work item/comment) and the action (download attachments). It distinguishes itself from siblings like get_work_item and get_work_item_comments by explicitly including attachment download and content stats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied ('if you need work item details plus attachments'), but no explicit alternatives or exclusions are stated. Sibling tools are not referenced, so the agent must infer when to choose this over get_work_item or download_artifact.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_pull_requestA
Get a pull request with metadata, branches, reviewers and linked work items. Resolved org-wide — repoId may be a GUID or a repository name.
| Name | Required | Description | Default |
|---|---|---|---|
| prId | Yes | Pull request id. | |
| repoId | Yes | Repository id (GUID) or name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description adds context by listing the contained fields (metadata, branches, reviewers, linked work items) and discloses the org-wide resolution behavior and repoId flexibility. It lacks explicit side-effect or error information, but the read-only nature is implied by 'Get'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and scope. The second sentence adds a crucial resolution detail without verbosity; every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter get operation with no output schema, the description provides the essential return scope and a key resolution caveat. It is complete enough for an agent to invoke correctly, though it doesn't describe the output structure or error conditions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers both parameters, and the description adds extra meaning to repoId by noting it may be a GUID or name. This goes beyond the schema's type/description, providing actionable resolution semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Get' and names the resource (pull request) with a clear scope: metadata, branches, reviewers, and linked work items. This distinguishes it from siblings like search_pull_requests and get_pull_request_comments.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when/when-not guidance or alternatives are mentioned. Usage is implied by requiring prId and the verb 'Get', but the description doesn't reference sibling tools or criteria for choosing this over search_pull_requests.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_pull_request_commentsA
Get PR threads (system vs human). Resolved org-wide — repoId may be a GUID or a repository name.
| Name | Required | Description | Default |
|---|---|---|---|
| prId | Yes | Pull request id. | |
| repoId | Yes | Repository id (GUID) or name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It adds useful behavioral details like 'system vs human' threads and 'Resolved org-wide' for repoId lookup. However, it omits other behavioral aspects such as output format, pagination, or any side effects, keeping it at a mid-level.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the primary action. Every phrase adds value, with no redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description should clarify what the tool returns. It only says 'Get PR threads' without describing the structure of a thread or comment, leaving a significant gap for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The description's note about repoId ('may be a GUID or a repository name') essentially repeats the schema description, adding minimal extra meaning beyond the structured data.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get PR threads (system vs human).' The verb 'Get' and resource 'PR threads' are specific, and the 'system vs human' distinction helps differentiate it from sibling comment-related tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for use by specifying it retrieves PR threads and notes that repoId can be a GUID or name. However, it does not explicitly mention alternatives or when not to use this tool, which would push it to a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_work_itemA
Get a single work item with $expand=all, including relations (hierarchy, Related, and ArtifactLink PR references resolved).
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Work item id. | |
| bypassCache | No | Force a fresh fetch, ignoring the cache. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses $expand=all and resolved relations, but does not mention caching behavior (though bypassCache exists), error handling, or authentication. The information about relations is useful but incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the key action and scope. No wasteful words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, the description is moderately useful but leaves gaps: it doesn't describe the return format, potential errors, or when to use alternatives. It provides some context with the expansion detail, but could be more complete for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for both parameters (id and bypassCache), so the description does not need to add param explanations. It adds no additional parameter semantics beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Get' with resource 'a single work item', clearly distinguishing from search_work_items and get_work_item_comments. It also adds the $expand=all detail, further clarifying scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for fetching a single work item by id but provides no explicit guidance on when to choose this over search_work_items or get_work_item_comments. No exclusions or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_work_item_commentsA
Get the full discussion for a work item (GET _apis/wit/workItems/{id}/comments — a SEPARATE endpoint, not part of $expand).
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | Work item id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. The verb 'Get' indicates a read-only operation, and 'full discussion' suggests the complete set of comments is returned. However, it does not disclose potential pagination, ordering, or error behavior, leaving some gaps in behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence. The main action is front-loaded, and the parenthetical adds valuable technical context without unnecessary verbosity. Every word contributes to understanding the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, single-parameter read tool with no output schema, the description and schema together provide complete information. The agent knows what the tool does (gets full discussion), what input is needed (work item id), and the relationship to the broader API. No further details are necessary for correct selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage for the single 'id' parameter with the description 'Work item id.' The tool description adds no additional parameter-level information, so the baseline score of 3 is appropriate since the schema already handles parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and the resource ('full discussion for a work item'), which distinguishes it from sibling tools like get_work_item (which retrieves the work item itself) and get_comment_details (which likely gets a single comment). The parenthetical about the separate endpoint further clarifies its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description strongly implies the intended use case: to fetch the complete comment thread for a work item. The note that this is a separate endpoint not part of $expand guides the agent away from using get_work_item's expand option. It doesn't explicitly name alternative tools for exclusions, but the context is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_projectsA
List ALL Azure DevOps projects the user can access in the organization (GET _apis/projects). Use this to discover projects to browse.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It indicates a read-only operation via 'List' and 'GET', and notes the important constraint that it returns only projects the user can access. However, it does not disclose potential pagination, output structure, or authentication requirements, which are relevant for a tool with no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: two sentences that front-load the action and resource, include a scoping parenthetical, and end with a clear usage directive. Every word contributes, with no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no output schema, no annotations), the description provides sufficient context for an agent to understand its purpose and when to invoke it. It could optionally mention return details, but its current coverage is adequate for a zero-parameter list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so schema coverage is trivially 100% and there is no parameter information to add. The baseline of 4 applies, and the description appropriately does not attempt to explain nonexistent parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Purpose is crystal clear: 'List ALL Azure DevOps projects the user can access in the organization' uses a specific verb and resource, and explicitly scopes to accessible projects. It also includes the API endpoint (GET _apis/projects) for additional precision, and distinguishes itself from the sibling list_repositories by focusing on projects rather than repositories.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool: 'Use this to discover projects to browse.' This implies it is the entry point for browsing, making the usage obvious. It does not explicitly mention alternatives or exclusions, but given the unique role among siblings, this is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_repositoriesA
List ALL Git repositories the user can access across the organization (GET _apis/git/repositories), or within one project. Returns id, name and owning project for each repo.
| Name | Required | Description | Default |
|---|---|---|---|
| project | No | Restrict to a single project (optional; omit for org-wide). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that the tool returns 'id, name and owning project for each repo,' and notes that it lists only repositories 'the user can access,' which adds context about permission filtering. It does not mention pagination or rate limits, but for a simple list endpoint, this is reasonably transparent. The return structure and access scope go beyond what a bare name would suggest.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no redundant words. It front-loads the primary action and scope, includes a technical endpoint reference, and states the return values. Every word adds value, making it appropriately sized and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (1 optional parameter, no output schema, no annotations), the description is complete: it covers what the tool lists, the optional project scoping, and the returned fields. There is nothing missing for an agent to correctly invoke or interpret the result. The description fully compensates for the absence of an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%: the only parameter 'project' has a detailed description ('Restrict to a single project (optional; omit for org-wide)') that already explains its meaning and optionality. The main description restates this concept ('or within one project') but does not add new semantic detail. Thus, the schema already does the heavy lifting, and the description merely reinforces it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List'), the resource ('Git repositories'), and the scope ('across the organization' or 'within one project'). It distinguishes itself from sibling tools like list_projects by explicitly focusing on Git repositories, and from search_work_items/get_work_item by being a direct listing tool. The specific verb and resource make the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool: to list all accessible repositories or restrict to a project. It implies this is the tool for repository enumeration, but it does not explicitly mention alternatives or when not to use it (e.g., 'use search_work_items to find work items'). This is a minor gap, so a 4 is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_feedsA
Browse Azure Artifacts feeds (GET feeds.dev.azure.com/_apis/packaging/feeds). Pass feedId to also list packages + versions. Each feed reports its project (null for org-scoped feeds); project-scoped feeds are addressed under their project automatically.
| Name | Required | Description | Default |
|---|---|---|---|
| feedId | No | Feed id or name to browse for packages (optional). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It discloses the HTTP method (GET), the effect of feedId, and the nuanced project property behavior (null for org-scoped feeds, automatic project addressing). This goes beyond a minimal description, though it stops short of detailing pagination or response structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences with no filler. The core operation is front-loaded, and each additional sentence adds valuable context (feedId behavior and project-scoping nuance). Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description covers the main behavior, the parameter's effect, and an important edge case (project vs org-scoped feeds). It is sufficiently complete for an agent to use it effectively, though it could mention authentication prerequisites or pagination explicitly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining that supplying feedId also lists packages and versions, which is not stated in the parameter description. This improves the agent's understanding of the parameter's semantic effect.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Browse') and clearly identifies the resource (Azure Artifacts feeds), including the REST endpoint. It also distinguishes the tool's behavior when feedId is passed (listing packages + versions), which differentiates it from sibling tools focused on work items, repositories, and pull requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: browse feeds by default, pass feedId to additionally list packages and versions. It also explains the project-scoping behavior for feeds, which helps the agent decide when and how to invoke the tool. It does not explicitly name alternatives, but no sibling feed-specific tool exists, so this is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_pull_requestsA
Search pull requests ORG-WIDE by default, or within a repo (repoId) or a project. Filters: status, creatorId, targetRef. (GET _apis/git/pullrequests)
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | ||
| repoId | No | Repository id (GUID) or name (omit for org-wide / project-wide search). | |
| status | No | active | completed | abandoned | all. | |
| project | No | Restrict to a single project (optional). | |
| creatorId | No | Creator identity id. | |
| targetRef | No | Target branch ref name, e.g. refs/heads/main. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the full burden. It discloses the default org-wide scope, the ability to restrict to repo/project, and the available filters. The API endpoint '(GET _apis/git/pullrequests)' informs the agent that this is a read-only operation, but it does not address pagination, result ordering, or authentication requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise clauses plus a parenthetical API path, with no wasted words. It front-loads the core purpose and scope, then lists filters, making it efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with 6 optional parameters and no output schema, the description gives a solid overview of scope and filters. It does not mention pagination via `top` or the return format, which would be useful, but the tool name and API path make it inferable that a list of pull requests is returned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 83%, and the description reiterates the filter parameters (status, creatorId, targetRef) and scoping (repoId, project) but adds little beyond what the schema already provides. The `top` parameter lacks a schema description and is not mentioned in the description, leaving that parameter under-explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it 'Search[es] pull requests ORG-WIDE by default' and can scope to a repo or project, naming specific filters. This verb+resource+scope structure distinguishes it from sibling tools like get_pull_request (which retrieves a single PR) and search_work_items (which searches a different entity).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool: 'ORG-WIDE by default, or within a repo (repoId) or a project' indicates the search scope. However, it does not explicitly exclude alternatives or mention when to prefer get_pull_request over this search, so it's clear context without exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_work_itemsA
Search/browse work items ORG-WIDE (cross-project) by default. Backend is WIQL (POST _apis/wit/wiql); pass text for full-text Search (almsearch), or project to scope to one project. Returns id + summary fields.
| Name | Required | Description | Default |
|---|---|---|---|
| top | No | Max results (default 50). | |
| text | No | Full-text search string (uses almsearch; falls back to WIQL). | |
| wiql | No | Raw WIQL query. If omitted, a bounded recent-items query (@Me) is used. | |
| project | No | Restrict to a single project (optional; omit for org-wide). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the cross-project default, WIQL backend, almsearch behavior for text, and return fields (id + summary). It does not mention pagination or auth requirements, but covers essential behavioral traits for a read-only search operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences front-loaded with purpose and scope. No wasted words; technical backend detail is integrated efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 optional parameters and no output schema, the description covers target resource, default scope, parameter usage, and return fields. It omits the default query when no `wiql` is provided (though schema covers this). With no annotations, it could marginally benefit from explicitly contrasting with get_work_item, but sibling context helps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description mentions `text` and `project` usage but largely parallels the schema property descriptions. It adds marginal value by explaining the backend and org-wide default, but does not significantly enrich parameter understanding beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Search/browse' with a clear resource 'work items' and scope 'ORG-WIDE (cross-project)'. It distinguishes the tool from siblings like get_work_item (which retrieves a single item) and search_pull_requests (different resource type).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear usage context: default is org-wide, use `project` to scope, and use `text` for full-text search. Implicitly differentiates from get_work_item by focusing on search/browse, but does not explicitly name alternatives or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
12 tool updates
v1.3.1- First observed
authenticate - First observed
download_artifact - First observed
get_comment_details - First observed
get_pull_request - First observed
get_pull_request_comments - First observed
get_work_item - First observed
get_work_item_comments - First observed
list_projects - First observed
list_repositories - First observed
search_feeds - First observed
search_pull_requests - First observed
search_work_items
TDQS
Each tool targets a distinct resource/action: projects, repositories, work items, PRs, feeds, artifacts, and authentication. The only possible overlap is between get_work_item_comments and get_comment_details, but their descriptions clearly separate discussion retrieval from comment resolution plus attachment download.
Most tools follow a consistent verb_noun pattern (list_projects, search_work_items, get_pull_request). Minor deviations include get_comment_details (which omits 'work_item') and authenticate (verb-only), but these do not significantly hinder readability.
With 12 tools, the set is well-scoped for a browser-oriented Azure DevOps server. Each tool covers a meaningful browsing operation, and there is no redundancy or bloat.
The toolset provides good read-only coverage: listing and searching projects, repos, work items, PRs, and feeds, plus getting details and comments. Minor gaps include no explicit get_project or get_repository (though list tools return sufficient info) and no code search, but core browsing needs are met.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
The MCP server for Azure DevOps, bringing the power of Azure DevOps directly to your agents.
Browser MCP for logged-in tasks. Uses your Chrome — credentials stay local. Zero-token replay.
The Cortex MCP server provides read-only access to real-time engineering context from the Cortex developer portal, allowing AI coding assistants to answer natural language questions about your organization's catalog (microservices, libraries, domains, teams, infrastructure), scorecards (engineering standards and best practices), initiatives (goals and deadlines), and Engineering Intelligence metrics. It includes tools for querying documentation, tracking personal entities, and accessing AI-assisted insights across the entire Cortex ecosystem.
Governed MCP gateway: one endpoint for your tools, with credential custody and audit log.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables interaction with Azure DevOps services including work items, repositories, pipelines, wikis, and test plans through a local MCP server that provides direct access to Azure DevOps REST APIs from your code editor.82,447MIT
- FlicenseCqualityDmaintenanceProvides AI assistants with comprehensive access to Azure DevOps services including work items, repositories, pull requests, wikis, builds, pipelines, and test plans through 25+ MCP tools with multi-project support.25-
- AlicenseBqualityDmaintenanceA read-only MCP server connecting AI assistants to Azure DevOps Server (on-premises) for browsing projects, repos, builds, work items, releases, pipelines, and test results.391,0281MIT
- AlicenseBqualityBmaintenanceEnables AI assistants to interact with Azure DevOps, providing tools for managing work items, repositories, pipelines, and more through the Model Context Protocol.10014MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/VMargan/mcp-ado-browser'
If you have feedback or need assistance with the MCP directory API, please join our Discord server