Azure Devops Onprem MCP Server
Azure DevOps Server 2022.2 data access via 48 tools with TFVC and safety features.
Data last scanned today · Reviewed today
Overview
Azure Devops Onprem MCP Server enables direct, local integration with Azure DevOps Server 2022.2 environments. It features 48 dedicated tools across six domains, including extensive support for TFVC operations such as changesets and shelvesets, alongside Git, pipelines, wikis, and test plans. Designed for on-premises use, it operates without cloud proxies or telemetry. The server prioritizes write-safety by implementing six layers of protection, including confirmation directives, a read-only kill switch, and mandatory dry-run previews on all write operations. It provides typed, schema-validated outputs for common tools to ensure reliable data chaining in multi-agent workflows.
Our verdict
With a high-risk security score of 45/100, users should exercise caution. The project is community-maintained by a single contributor and lacks official vendor support, which increases maintenance and supply-chain risk. While it includes robust write-safety mechanisms and supports read-only configurations, the absence of OAuth and the reliance on personal access tokens (PAT) for authentication necessitate careful credential management.
- Comprehensive TFVC support with 10 dedicated tools
- Six-layer write-safety system with mandatory dry-run previews
- Stateless profile-based secret management using environment files
- Supports typed output schemas for reliable agent chaining
- Community-maintained with no official vendor backing
- Single contributor represents a bus-factor project risk
- No OAuth support detected for authentication
Setup
{
"mcpServers": {
"azure-devops-mcp-onprem": {
"args": [
"-y",
"@burcusg/azure-devops-mcp-onprem"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| tfvc_list_shelvesets | Lists shelvesets. | low |
| tfvc_get_shelveset | Gets shelveset details including file changes and work item links. | low |
| tfvc_get_shelveset_file | Gets the content of a file within a shelveset. | low |
| tfvc_list_changesets | Lists changesets. | low |
| tfvc_get_changeset | Gets changeset details including linked work items. | low |
| tfvc_get_changeset_changes | Gets the list of changes within a changeset. | low |
| tfvc_browse | Browses TFVC files. | low |
| tfvc_get_file | Gets a file at a specific changeset version. | low |
| tfvc_get_file_diff | Gets the diff of a file between two changesets. | low |
| get_work_item_changesets | Gets all TFVC changesets touching a work item. | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›Does this server support TFVC repositories?
Yes, it provides 10 dedicated tools for TFVC, including support for shelvesets, changesets, file diffs, and work-item linkage.
›How can I prevent storing sensitive credentials in my configuration file?
You can use profile-based secrets by setting AZURE_DEVOPS_PROFILE to a name, which allows the server to use a gitignored .env.<name> file for PAT storage instead of the main mcp.json.
›Can I limit which tools are available to specific users?
Yes, you can restrict available functionality by setting the AZURE_DEVOPS_ENABLED_DOMAINS environment variable to a comma-separated list of permitted domains.
›Is my data sent to a cloud proxy or external telemetry service?
No, the server operates locally for on-prem environments using PAT authentication with no cloud proxy, telemetry, or third-party calls.
›What happens when an AI agent attempts to perform a write operation?
All write operations are governed by a safety layer that includes mandatory dry-run previews, audit logging, rate limiting, and a configurable readonly kill switch.
›Does the @me token work across different environments?
Yes, the @me token is resolved per tenant and is stateless, allowing it to work automatically for fields like owner, author, and assignedTo.
Badge
Maintain this server? Add the live badge to your README.