core_list_orgs
List Azure DevOps organizations the authenticated user has access to
LABSCO SUMMARY
Least privilege as a request header is the most practical idea on this page.
Most servers give you everything the token allows and leave scoping to the credential. Azure DevOps lets the client itself say 'only work items, and read-only' on the connection — which means a documentation agent and a release agent can share one token and still be different in what they can do. Check the prerequisite before planning around it: an Entra-backed organisation, and a client Microsoft supports for the remote endpoint.
What it is
Microsoft's remote server for Azure DevOps. The URL carries your organisation name, so there is no shared address. Toolsets cover work items, repositories and pull requests, pipelines, wiki, test plans, iteration capacity and Advanced Security.
What you get
- Work items, repositories and pull requests, pipelines
- Wiki, test plans and iteration capacity
- The Advanced Security toolset
- Three request headers — X-MCP-Toolsets, X-MCP-Readonly and X-MCP-Tools — that narrow what the connection can reach
Requirements
Microsoft Entra ID OAuth, and an organisation backed by an Entra tenant — standalone MSA organisations are not supported. Microsoft lists VS Code and Visual Studio with GitHub Copilot, GitHub Copilot CLI and the Copilot app, Microsoft Foundry and Copilot Studio as supported; Cursor and Claude Code work once you create a custom Entra app registration. Claude Desktop and Codex cannot complete the Entra sign-in, so Microsoft points them to the local Azure DevOps MCP Server.
Setup effort
Get your endpoint, then paste it — add your endpoint to your client and sign in to Azure DevOps
USE CASES
01
Reading a work item and its pull request together
One connection spans work items and repositories, so the ticket and the branch that closed it are in the same conversation.
02
Giving an agent read-only access
Send X-MCP-Readonly on the connection rather than minting a separate credential.
03
Narrowing to one area of work
Use X-MCP-Toolsets to expose only pipelines, or only test plans, and keep the rest out of context.
48 tools
Listed in project docs. Your client may show a different list.
core_list_projects
List projects in an organization
core_list_project_teams
List teams in a project
core_list_group_members
List direct members and child groups of an Azure DevOps group
work
list_iterations: List all iterations in a project; list_team_iterations: List iterations assigned to a team; get_team_settings: Get team settings including default iteration, backlog iteration, and default area path; get_team_capacity: Get team capacity for an iteration; get_iteration_capacities: Get an iteration's capacity for all teams in the iteration and project
work_iteration_write
create: Create iterations; assign: Assign iterations to a team
work_capacity_write
update: Update the team capacity of a team member for a specific iteration
repo_pull_request
get: Get a pull request by ID; list: List pull requests in a repository or project; list_by_commits: Find pull requests that contain specific commit IDs; get_changes: Get file changes and optional line-by-line diffs for a pull request iteration
repo_pull_request_thread
list: List comment threads on a pull request; list_comments: List comments in a specific thread
repo_repository
get: Get a repository by name or ID; list: List repositories in a project
repo_branch
get: Get a branch by name; list: List branches in a repository; list_mine: List branches the current user has pushed to
repo_file
get_content: Get the text content of a file at a specific branch, tag, or commit; list_directory: List files and folders in a directory, with optional recursive listing
repo_search_commits
Search commits with filtering by text, author, date range, and more
search_code
Full-text code search
repo_pull_request_write
create: Create a pull request; update: Update a pull request, including setting autocomplete; update_reviewers: Add or remove pull request reviewers; vote: Cast a vote on a pull request
repo_pull_request_thread_write
create: Create a new comment thread on a pull request; reply: Reply to a comment in a thread; update_status: Update the status of a comment thread
repo_create_branch
Create a branch
wit_work_item
get: Get a work item by ID; get_batch: Get multiple work items by IDs; list_comments: List comments on a work item; my: Get work items relevant to the authenticated user; list_revisions: List revisions of a work item; list_for_iteration: List work items for a team iteration; get_type: Get metadata for a work item type
wit_query
get: Get a query by ID or path; get_results: Run a saved query; search: Search queries by name; list: List root query folders and their children
wit_query_by_wiql
Run a WIQL query and return matching work items
wit_backlog
list: List backlog levels for a team; list_work_items: List work items in a specific backlog level
search_workitem
Full-text work item search
wit_work_item_write
create: Create a new work item; update: Update fields on a work item; update_batch: Update multiple work items in one call; add_child: Create child work items under a parent
wit_work_item_comment_write
add: Add a comment to a work item; update: Update an existing comment on a work item
wit_work_item_link_write
link: Link two work items; unlink: Remove links from a work item; link_to_pull_request: Link a work item to a pull request; add_artifact_link: Add a repository, branch, commit, build, or wiki artifact link to a work item
wit_work_item_attachment
Download a work item attachment by ID; returns base64-encoded content with filename and MIME type
wit_work_item_attachment_upload
Upload file content (up to 20 MB, Base64-encoded) to the attachment store without attaching it to a work item
wit_work_item_attachment_link
Link a previously uploaded attachment to a work item
pipelines_build
list: List builds with optional filters; get_status: Get status, issues, and report metadata for a build; get_changes: Get commits and work items associated with a build
pipelines_build_log
list: List available logs for a build; get_content: Get the text content of a specific log by ID
pipelines_definition
list: List pipeline definitions with optional filters; list_revisions: List revision history for a pipeline definition
pipelines_run
get: Get a single pipeline run; list: List runs for a pipeline
pipelines_artifact
list: List artifacts for a build; download: Download a named build artifact
pipelines_write
run_pipeline: Queue a new pipeline run; create_pipeline: Create a new YAML pipeline definition; update_build_stage: Cancel, retry, or run a stage on an in-flight build
wiki
list_wikis: List wikis in a project or organization; get_wiki: Get a wiki by identifier; list_pages: List pages in a wiki; get_page: Get page content and metadata
search_wiki
Full-text wiki search
wiki_upsert_page
Create or update a wiki page
testplan
list_plans: List test plans in a project; list_suites: List test suites under a test plan; list_cases: List test cases under a test suite
testplan_show_test_results_from_build_id
Get test results from a build
testplan_test_run
get_results: Get results for a test run with optional detail and outcome filters
testplan_test_plan_write
create: Create a test plan
testplan_test_suite_write
create: Create a test suite; add_test_cases: Add test cases to a suite
testplan_test_case_write
create: Create a test case; update_steps: Update test case steps
testplan_test_run_write
create_run: Create a test run for manual test execution; update_results: Update outcomes and details for test results in a run; complete_run: Complete or abort a test run based on its results; update_test_point_outcome: Update or reset outcomes for test points
advsec_alerts
list: List Advanced Security alerts for a repository with optional filters; get: Get an Advanced Security alert by ID
enterprise_live_migration
list: List migrations for the organization; optional project filter and includeAllMigrations flag; get: Get migration status for a repository; get_cutover_review: Get failed or blocked items before cutover; get_device_flow_config: Get GitHub App device flow config; list_pipelines: List pipelines and rewiring status
enterprise_live_migration_write
create: Create a new migration; pause: Pause an active migration; resume: Resume a paused migration; cutover_set: Schedule a cutover date; cutover_cancel: Cancel a scheduled cutover; approve_cutover: Accept failures and proceed with cutover; abandon: Permanently delete a migration
enterprise_live_migration_pipelines_write
submit: Submit pipelines for rewiring; update: Update pipeline rewiring config; delete: Delete all pipeline clones for a terminal migration
BEFORE YOU INSTALL
What to know first
Tools you get
48 tools named in the project's documentation. Two of the 48 documented tools, core_list_group_members and wit_query_by_wiql, are available only to MCP Insiders: send the X-MCP-Insiders: true header to get them, otherwise you get 46.
Requires
- An Azure DevOps organization backed by a Microsoft Entra tenant (standalone Microsoft account organizations are not supported), and membership in the projects you want to query
- A client that can complete the Microsoft Entra sign-in: VS Code or Visual Studio with GitHub Copilot, GitHub Copilot CLI, or Cursor or Claude Code with a custom Entra app registration (Claude Desktop and Codex cannot, and Microsoft points them to the local Azure DevOps MCP Server)
Where it runs
All 3 documented clients connect to a hosted endpoint.
INSTALLATION
Connect your client
Add your endpoint to your client and sign in to Azure DevOps.
Server setup
ENDPOINT URL
https://mcp.dev.azure.com/<YOUR_ORGANIZATION>MCP Clients
VS Code
VS CODE · JSON
{
"servers": {
"ado-remote-mcp": {
"url": "https://mcp.dev.azure.com/<YOUR_ORGANIZATION>",
"type": "http"
}
},
"inputs": []
}Save this as .vscode/mcp.json in your repository. <YOUR_ORGANIZATION> is your Azure DevOps organization name. Open GitHub Copilot and sign in with your Microsoft Entra account when prompted.
Cursor
Confirm that the Azure DevOps MCP enterprise application is provisioned in your Microsoft Entra tenant
In the Microsoft Entra admin center, create an app registration. Under Authentication, add a Mobile and desktop applications redirect URI of http://localhost:8787/callback and enable Allow public client flows
Under API permissions, add the delegated permissions you need from Azure DevOps MCP (application ID 2a72489c-aab2-4b65-b93a-a91edccf33b8), then grant admin consent (a tenant administrator may need to do this)
Copy the app registration's Application (client) ID
In Cursor, open Settings > Tools & MCP, select New MCP Server and add this configuration; <YOUR_CLIENT_ID> is that ID:
CURSOR · JSON
{
"mcpServers": {
"ado": {
"url": "https://mcp.dev.azure.com",
"type": "http",
"auth": {
"CLIENT_ID": "<YOUR_CLIENT_ID>"
}
}
}
}Save, return to Settings > Tools & MCP, and select Authenticate on the ado server.
Claude Code
Confirm that the Azure DevOps MCP enterprise application is provisioned in your Microsoft Entra tenant
In the Microsoft Entra admin center, create an app registration. Under Authentication, add a Mobile and desktop applications redirect URI of http://localhost:3118/callback and enable Allow public client flows
Under API permissions, add the delegated permissions you need from Azure DevOps MCP (application ID 2a72489c-aab2-4b65-b93a-a91edccf33b8), then grant admin consent (a tenant administrator may need to do this)
Copy the app registration's Application (client) ID
Run this; <YOUR_ORGANIZATION> is your Azure DevOps organization name and <YOUR_CLIENT_ID> that ID:
CLAUDE CODE · TERMINAL
claude mcp add --transport http ado https://mcp.dev.azure.com/<YOUR_ORGANIZATION> --client-id <YOUR_CLIENT_ID> --callback-port 3118Start Claude Code, run /mcp and complete the browser sign-in with your Microsoft Entra account.
