@azure-devops/mcp 2.1.0-nightly.20250917 → 2.1.0-nightly.20250918

package/dist/tools/work-items.js

@@ -3,7 +3,7 @@
 import { WorkItemExpand } from "azure-devops-node-api/interfaces/WorkItemTrackingInterfaces.js";
 import { QueryExpand } from "azure-devops-node-api/interfaces/WorkItemTrackingInterfaces.js";
 import { z } from "zod";
-import { batchApiVersion, markdownCommentsApiVersion, getEnumKeys, safeEnumConvert } from "../utils.js";
+import { batchApiVersion, markdownCommentsApiVersion, getEnumKeys, safeEnumConvert, encodeFormattedValue } from "../utils.js";
 const WORKITEM_TOOLS = {
     my_work_items: "wit_my_work_items",
     list_backlogs: "wit_list_backlogs",
@@ -218,6 +218,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
                 };
             }
             const body = items.map((item, x) => {
+                const encodedDescription = encodeFormattedValue(item.description, item.format);
                 const ops = [
                     {
                         op: "add",
@@ -232,12 +233,12 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
                     {
                         op: "add",
                         path: "/fields/System.Description",
-                        value: item.description,
+                        value: encodedDescription,
                     },
                     {
                         op: "add",
                         path: "/fields/Microsoft.VSTS.TCM.ReproSteps",
-                        value: item.description,
+                        value: encodedDescription,
                     },
                     {
                         op: "add",
@@ -428,10 +429,10 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
         try {
             const connection = await connectionProvider();
             const workItemApi = await connection.getWorkItemTrackingApi();
-            const document = fields.map(({ name, value }) => ({
+            const document = fields.map(({ name, value, format }) => ({
                 op: "add",
                 path: `/fields/${name}`,
-                value: value,
+                value: encodeFormattedValue(value, format),
             }));
             // Check if any field has format === "Markdown" and add the multilineFieldsFormat operation
             // this should only happen for large text fields, but since we dont't know by field name, lets assume if the users
@@ -512,10 +513,10 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
         const uniqueIds = Array.from(new Set(updates.map((update) => update.id)));
         const body = uniqueIds.map((id) => {
             const workItemUpdates = updates.filter((update) => update.id === id);
-            const operations = workItemUpdates.map(({ op, path, value }) => ({
+            const operations = workItemUpdates.map(({ op, path, value, format }) => ({
                 op: op,
                 path: path,
-                value: value,
+                value: encodeFormattedValue(value, format),
             }));
             // Add format operations for Markdown fields
             workItemUpdates.forEach(({ path, value, format }) => {

package/dist/utils.js

@@ -54,3 +54,16 @@ export function safeEnumConvert(enumObject, key) {
     }
     return enumObject[key];
 }
+/**
+ * Encodes `>` and `<` for Markdown formatted fields.
+ *
+ * @param value The text value to encode
+ * @param format The format of the field ('Markdown' or 'Html')
+ * @returns The encoded text, or original text if format is not Markdown
+ */
+export function encodeFormattedValue(value, format) {
+    if (!value || format !== "Markdown")
+        return value;
+    const result = value.replace(/</g, "&lt;").replace(/>/g, "&gt;");
+    return result;
+}

package/dist/version.js

@@ -1 +1 @@
-export const packageVersion = "2.1.0-nightly.20250917";
+export const packageVersion = "2.1.0-nightly.20250918";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-devops/mcp",
-  "version": "2.1.0-nightly.20250917",
+  "version": "2.1.0-nightly.20250918",
   "description": "MCP server for interacting with Azure DevOps",
   "license": "MIT",
   "author": "Microsoft Corporation",