菜单
Shared foundation for all Azure DevOps skills: how to detect and configure the Azure DevOps MCP Server, and how to fall back to the REST API (Entra ID or PAT authentication) when MCP tools are unavailable. Read this before using any azure-devops-* skill.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Enforces approval guardrails for Azure operations. Unless an operation is pre-approved in a project allowlist, any command that deletes or modifies existing Azure resources or user accounts requires explicit user approval before execution. Activate whenever executing Azure operations via az CLI, azd, Azure PowerShell (Az module), Azure MCP tools, or Microsoft Graph — especially before any delete, update, set, remove, or identity-related command.
Validate NuGet package versions before adding or updating packages in .NET projects. Use when choosing a NuGet package version, checking package vulnerabilities, avoiding deprecated packages, auditing dotnet package list results, or requiring confirmation for packages not published in over one year.
Work with GitHub Advanced Security for Azure DevOps (GHAzDO): list and triage code/secret/dependency scanning alerts, dismiss (close) alerts, and associate alerts with work items. Use when the user asks about Advanced Security alerts, CodeQL findings, secret scanning, or dependency vulnerabilities in Azure Repos. REST-API-based — the Azure DevOps MCP Server has no Advanced Security tools.
Manage Azure Artifacts: list and create feeds, inspect package versions, promote packages between views, delete/unlist versions, and publish/download Universal Packages. Use when the user asks about Azure DevOps package feeds, NuGet/npm/Maven/Python/Universal packages, or feed views. REST/CLI-based — the Azure DevOps MCP Server has no Artifacts tools.
Manage Azure Boards work items: create, update fields, add comments, link items, and close them. Use when the user asks to create/update/comment on/close bugs, tasks, user stories, or other work items in Azure DevOps. Prefers Azure DevOps MCP Server tools and falls back to the REST API.
Manage Azure Pipelines: create YAML pipeline definitions, queue runs, and monitor builds including stage control and log analysis. Use when the user asks to create, run, watch, or debug Azure DevOps pipelines or builds. Prefers Azure DevOps MCP Server tools and falls back to the REST API.
| name | azure-devops-foundation |
| description | Shared foundation for all Azure DevOps skills: how to detect and configure the Azure DevOps MCP Server, and how to fall back to the REST API (Entra ID or PAT authentication) when MCP tools are unavailable. Read this before using any azure-devops-* skill. |
| compatibility | Azure DevOps Services. Local MCP server requires Node.js 20+. Microsoft Learn MCP Server recommended for documentation lookup. |
This skill defines the common access strategy used by every azure-devops-* skill in this repository: prefer the Azure DevOps MCP Server tools, fall back to the REST API when MCP is unavailable, and use the Microsoft Learn MCP Server (microsoft_docs_search / microsoft_docs_fetch) to verify any endpoint before calling it.
core_list_projects, wit_work_item, repo_pull_request, or pipelines_build are available in the current session, use them. They handle authentication, pagination, and API versioning for you.curl or PowerShell as described below.az devops) — as an alternative to raw REST when the CLI is installed and signed in. See the azure-devops-cli skill for the complete CLI reference.Important: Two areas have no MCP tools at all and always start at step 2: GitHub Advanced Security (see azure-devops-advanced-security) and Azure Artifacts feeds/packages (see azure-devops-artifacts).
mcp__<server>__ prefix (for example mcp__ado__wit_work_item). In VS Code Copilot agent mode they appear by bare name (wit_work_item).Requires Node.js 20+. Add to .mcp.json (Claude Code) or .vscode/mcp.json (VS Code):
{
"servers": {
"ado": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@azure-devops/mcp", "{organization}"]
}
}
}
"args": ["-y", "@azure-devops/mcp", "{organization}", "-d", "work-items", "repositories"].Hosted endpoint, no installation: https://mcp.dev.azure.com/{organization} (streamable HTTP, Entra ID OAuth).
{
"servers": {
"ado-remote": {
"url": "https://mcp.dev.azure.com/{organization}",
"type": "http",
"headers": { "X-MCP-Toolsets": "repos,wit,pipelines" }
}
}
}
X-MCP-Toolsets (repos, wit, pipelines, wiki, work, testplan), X-MCP-Readonly: true, X-MCP-Tools (explicit tool list), X-MCP-Insiders: true.Preferred — Microsoft Entra ID token (works when the user is signed in with Azure CLI; 499b84ac-1321-427f-aa17-267ca6975798 is the fixed Azure DevOps resource ID):
ADO_TOKEN=$(az account get-access-token \
--resource 499b84ac-1321-427f-aa17-267ca6975798 \
--query accessToken -o tsv)
curl -s -H "Authorization: Bearer ${ADO_TOKEN}" \
"https://dev.azure.com/{organization}/_apis/projects?api-version=7.1"
Alternative — Personal Access Token (PAT), e.g. from the AZURE_DEVOPS_EXT_PAT environment variable (Basic auth with empty username):
curl -s -u ":${AZURE_DEVOPS_EXT_PAT}" \
"https://dev.azure.com/{organization}/_apis/projects?api-version=7.1"
Microsoft recommends Entra ID tokens over PATs. Never print tokens to the terminal, never commit them, and never include them in logs or error reports.
| Convention | Detail |
|---|---|
| Base URL | https://dev.azure.com/{organization}[/{project}]/_apis/{area}/{resource} |
| Specialized hosts | advsec.dev.azure.com (Advanced Security), feeds.dev.azure.com (feed management), pkgs.dev.azure.com (package content), almsearch.dev.azure.com (search) |
api-version | Required on every call. Use 7.1 (GA) unless the resource is preview-only (e.g. Advanced Security uses 7.2-preview.1) |
| Work item writes | Content-Type: application/json-patch+json with a JSON Patch array |
| Other writes | Content-Type: application/json |
| Pagination | Follow x-ms-continuationtoken response header / continuationToken query parameter |
| Rate limiting | On HTTP 429 or 503, honor the Retry-After header and retry with backoff; reduce parallelism |
REST endpoints and api-version values change. Before constructing a REST call you have not used in this session, verify it with the Microsoft Learn MCP Server:
microsoft_docs_search("Azure DevOps REST API <area> <operation>")
microsoft_docs_fetch("<learn.microsoft.com URL from the search result>")
Do not invent endpoints or api-version strings from memory.
X-MCP-Readonly) when the task only requires queries.| Skill | Scope |
|---|---|
| azure-devops-boards | Work items: create, update, comment, close |
| azure-devops-repos | Pull requests: create, review, comment threads |
| azure-devops-pipelines | Pipelines: create, run, monitor |
| azure-devops-advanced-security | GHAS alerts: triage, dismiss, work item association |
| azure-devops-artifacts | Feeds and packages |
| azure-devops-testplans | Test plans, suites, cases |
| azure-devops-wiki | Wiki pages and publishing |
| azure-devops-security-triage | End-to-end GHAS alert remediation workflow |
| azure-devops-cli | Full az devops CLI reference |
microsoft_docs_search("Azure DevOps MCP Server overview")microsoft_docs_search("remote Azure DevOps MCP Server preview")microsoft_docs_search("Azure DevOps REST API get started authentication Entra")microsoft_docs_search("Azure DevOps REST API rate limits")