azure-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited azure-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
9-tool MCP server for Azure DevOps: work items, sprints, builds, and pull requests over stdio. Installable via npx or bunx — no clone required.
# Step 1 — authenticate (PAT, no app registration needed)
npx azure-board-mcp authenticate
# OR — OAuth device code (requires AZURE_CLIENT_ID env var)
npx azure-board-mcp authenticate --oauth
# Verify
npx azure-board-mcp check
# Logout
npx azure-board-mcp logoutThe PAT wizard prompts for org, project, and token, validates them, then stores credentials at ~/.azure-mcp-auth.json.
PAT required scopes: Work Items (Read & Write) · Build (Read) · Code (Read) Create at: https://dev.azure.com/{org}/_usersSettings/tokens
export AZURE_ORG=your-org
export AZURE_PROJECT=your-project
export AZURE_PAT=your-pat # or AUTH_TOKEN=<bearer> for OAuth~/.claude/settings.json:
{
"mcpServers": {
"azure": {
"command": "npx",
"args": ["-y", "azure-board-mcp@latest"]
}
}
}Or with bunx:
{
"mcpServers": {
"azure": {
"command": "bunx",
"args": ["azure-board-mcp@latest"]
}
}
}Credentials from ~/.azure-mcp-auth.json are picked up automatically.
| Tool | What it does |
|---|---|
auth_status | Validate credentials and check PAT scopes |
list_work_items | List/filter work items (mine, sprint, state, keyword) |
get_work_item | Full detail: description, acceptance criteria, repro steps, comments, linked PRs/commits/builds |
create_work_item | Create any work item type |
update_work_item | Update fields or append a comment |
add_comment | Post a discussion comment |
query_wiql | Raw WIQL for custom queries |
list_builds | List CI builds with status and URL |
list_pull_requests | List PRs with reviewer votes |
list_work_items(mine: true, sprint: true)get_work_item(id) returns everything visible on the Azure DevOps card:
list_work_items(keyword: "invoice", state: "Active")list_builds(result: "failed", top: 5)list_pull_requests(repo: "my-repo")query_wiql("SELECT [System.Id] FROM WorkItems WHERE [System.Tags] CONTAINS 'billing' AND [System.State] <> 'Closed' ORDER BY [System.ChangedDate] DESC")get_work_item always fetches comments too — no need for a separate call.query_wiql supports @me, @CurrentIteration, @project macros.auth_status to see which scopes are missing.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.