@azure-devops/mcp 2.10.0 → 2.11.0

package/README.md

@@ -1,19 +1,14 @@
 # Azure DevOps MCP Server
 
-> [!WARNING]
-> We recently completed a full tool consolidation that includes renaming of existing tools. Please see the [Toolset documentation](docs/TOOLSET.md) for the complete list of new tool names.
+> [!IMPORTANT]
+> We recommend using the [Remote MCP Server](https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server) instead of this local server. It requires no installation and gets new features first.
 >
-> If this is a breaking change for your agents or skills, you can temporarily pin the version to `@azure-devops/mcp@2.8.1`
+> [Learn more](#remote-mcp-server-recommended)
 
 This project gives AI agents access to Azure DevOps through the Model Context Protocol (MCP). Use the hosted remote server for the simplest setup, or run the local server when you need a `stdio` connection.
 
 ## Table of Contents
 
-> [!IMPORTANT]
-> We recommend using the [Remote MCP Server](https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server) instead of this local server. It requires no installation and gets new features first.
->
-> [Learn more](#remote-mcp-server-recommended)
-
 1. [Overview](#overview)
 2. [Design](#design)
 3. [Remote MCP Server (Recommended)](#remote-mcp-server-recommended)
@@ -103,18 +98,11 @@ These steps use Visual Studio Code and GitHub Copilot. For other supported clien
 
 ```json
 {
-  "inputs": [
-    {
-      "id": "ado_org",
-      "type": "promptString",
-      "description": "Azure DevOps organization name  (e.g. 'contoso')"
-    }
-  ],
   "servers": {
     "ado": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "@azure-devops/mcp", "${input:ado_org}"]
+      "args": ["-y", "@azure-devops/mcp", "{organization}"]
     }
   }
 }
@@ -141,18 +129,11 @@ Add `-d` followed by the domains to the server arguments. For example, this conf
 
 ```json
 {
-  "inputs": [
-    {
-      "id": "ado_org",
-      "type": "promptString",
-      "description": "Azure DevOps organization name  (e.g. 'contoso')"
-    }
-  ],
   "servers": {
     "ado_with_filtered_domains": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "@azure-devops/mcp", "${input:ado_org}", "-d", "core", "work", "work-items"]
+      "args": ["-y", "@azure-devops/mcp", "{organization}", "-d", "core", "work", "work-items"]
     }
   }
 }
@@ -174,7 +155,7 @@ Set default Azure DevOps project and team values in `.vscode/mcp.json` so tools
     "ado": {
       "type": "stdio",
       "command": "npx",
-      "args": ["-y", "@azure-devops/mcp", "myorg", "--authentication", "azcli"],
+      "args": ["-y", "@azure-devops/mcp", "{organization}", "--authentication", "azcli"],
       "env": {
         "ado_mcp_project": "Contoso",
         "ado_mcp_team": "Fabrikam Team"

package/dist/auth.js

@@ -1,11 +1,8 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 import { AzureCliCredential, ChainedTokenCredential, DefaultAzureCredential } from "@azure/identity";
-import { PublicClientApplication } from "@azure/msal-node";
-import { NativeBrokerPlugin } from "@azure/msal-node-extensions";
-import open from "open";
 import { logger } from "./logger.js";
-const scopes = ["499b84ac-1321-427f-aa17-267ca6975798/.default"];
+import { azureDevOpsScopes, OAuthAuthenticator } from "./oauth.js";
 const patAllowedHosts = new Set(["dev.azure.com", "vssps.dev.azure.com", "almsearch.dev.azure.com"]);
 function isPatAllowedHost(hostname) {
     const normalizedHostname = hostname.toLowerCase();
@@ -30,104 +27,6 @@ function installPatFetchInterceptor(basicValue) {
         return originalFetch(input, { ...init, headers });
     };
 }
-class OAuthAuthenticator {
-    static clientId = "0d50963b-7bb9-4fe7-94c7-a99af00b5136";
-    static defaultAuthority = "https://login.microsoftonline.com/common";
-    static zeroTenantId = "00000000-0000-0000-0000-000000000000";
-    accountId;
-    publicClientApp;
-    publicClientAppFallback;
-    constructor(tenantId) {
-        this.accountId = null;
-        let authority = OAuthAuthenticator.defaultAuthority;
-        if (tenantId && tenantId !== OAuthAuthenticator.zeroTenantId) {
-            authority = `https://login.microsoftonline.com/${tenantId}`;
-            logger.debug(`OAuthAuthenticator: Using tenant-specific authority for tenantId='${tenantId}'`);
-        }
-        else {
-            logger.debug(`OAuthAuthenticator: Using default common authority`);
-        }
-        this.publicClientApp = new PublicClientApplication({
-            auth: {
-                clientId: OAuthAuthenticator.clientId,
-                authority,
-            },
-            broker: {
-                nativeBrokerPlugin: new NativeBrokerPlugin(),
-            },
-            system: {
-                loggerOptions: {
-                    loggerCallback: (level, message) => {
-                        logger.debug(`MSALClient[${level}]: ${message}`);
-                    },
-                },
-            },
-        });
-        this.publicClientAppFallback = new PublicClientApplication({
-            auth: {
-                clientId: OAuthAuthenticator.clientId,
-                authority,
-            },
-        });
-        logger.debug(`OAuthAuthenticator: Initialized with clientId='${OAuthAuthenticator.clientId}'`);
-    }
-    async getToken() {
-        let authResult = null;
-        if (this.accountId) {
-            logger.debug(`OAuthAuthenticator: Attempting silent token acquisition for cached account`);
-            try {
-                authResult = await this.publicClientApp.acquireTokenSilent({
-                    scopes,
-                    account: this.accountId,
-                });
-                logger.debug(`OAuthAuthenticator: Successfully acquired token silently`);
-            }
-            catch (error) {
-                logger.debug(`OAuthAuthenticator: Silent token acquisition failed: ${error instanceof Error ? error.message : String(error)}`);
-                authResult = null;
-            }
-        }
-        else {
-            logger.debug(`OAuthAuthenticator: No cached account available, interactive auth required`);
-        }
-        if (!authResult) {
-            logger.debug(`OAuthAuthenticator: Starting interactive token acquisition`);
-            try {
-                authResult = await this.publicClientApp.acquireTokenInteractive({
-                    scopes,
-                    openBrowser: async (url) => {
-                        logger.debug(`OAuthAuthenticator: Opening browser for authentication with target URL: ${url}`);
-                        open(url);
-                    },
-                });
-                this.accountId = authResult.account;
-                logger.debug(`OAuthAuthenticator: Successfully acquired token interactively, account cached`);
-            }
-            catch (error) {
-                const msalErrorMessage = error.platformBrokerError ? JSON.stringify(error.platformBrokerError) : "";
-                logger.debug(`OAuthAuthenticator: Interactive token acquisition failed: ${error instanceof Error ? error.message + msalErrorMessage : String(error)}`);
-                authResult = null;
-            }
-        }
-        if (!authResult) {
-            logger.debug(`OAuthAuthenticator: Starting interactive token acquisition without broker`);
-            authResult = await this.publicClientAppFallback.acquireTokenInteractive({
-                scopes,
-                openBrowser: async (url) => {
-                    logger.debug(`OAuthAuthenticator: Opening browser for authentication with target URL: ${url}`);
-                    open(url);
-                },
-            });
-            logger.debug(`OAuthAuthenticator: Successfully acquired token interactively without broker`);
-        }
-        if (!authResult?.accessToken) {
-            logger.error(`OAuthAuthenticator: Authentication result contains no access token`);
-            throw new Error("Failed to obtain Azure DevOps OAuth token.");
-        }
-        logger.debug(`OAuthAuthenticator: Token obtained successfully`);
-        return authResult.accessToken;
-    }
-}
 function createAuthenticator(type, tenantId) {
     logger.debug(`Creating authenticator of type '${type}' with tenantId='${tenantId ?? "undefined"}'`);
     switch (type) {
@@ -170,7 +69,7 @@ function createAuthenticator(type, tenantId) {
                 credential = new ChainedTokenCredential(azureCliCredential, credential);
             }
             return async () => {
-                const result = await credential.getToken(scopes);
+                const result = await credential.getToken(azureDevOpsScopes);
                 if (!result) {
                     logger.error(`${type}: Failed to obtain token - credential.getToken returned null/undefined`);
                     throw new Error("Failed to obtain Azure DevOps token. Ensure you have Azure CLI logged or use interactive type of authentication.");

package/dist/oauth.js

@@ -0,0 +1,130 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import { PublicClientApplication } from "@azure/msal-node";
+import open from "open";
+import { logger } from "./logger.js";
+export const azureDevOpsScopes = ["499b84ac-1321-427f-aa17-267ca6975798/.default"];
+const clientId = "0d50963b-7bb9-4fe7-94c7-a99af00b5136";
+const defaultAuthority = "https://login.microsoftonline.com/common";
+const zeroTenantId = "00000000-0000-0000-0000-000000000000";
+class ClientAppWrapper {
+    accountId;
+    publicClientApp;
+    withBroker;
+    constructor(authority) {
+        this.accountId = null;
+        this.publicClientApp = new PublicClientApplication({
+            auth: {
+                clientId,
+                authority,
+            },
+        });
+        this.withBroker = false;
+    }
+    static async initialize(authority, tryWithBroker) {
+        const clientApp = new ClientAppWrapper(authority);
+        if (tryWithBroker) {
+            try {
+                const { NativeBrokerPlugin } = await import("@azure/msal-node-extensions");
+                clientApp.publicClientApp = new PublicClientApplication({
+                    auth: {
+                        clientId,
+                        authority,
+                    },
+                    broker: {
+                        nativeBrokerPlugin: new NativeBrokerPlugin(),
+                    },
+                    system: {
+                        loggerOptions: {
+                            loggerCallback: (level, message) => {
+                                logger.debug(`MSALClient[${level}]: ${message}`);
+                            },
+                        },
+                    },
+                });
+                clientApp.withBroker = true;
+                logger.debug(`PublicClientApplication(authority='${authority}') initialized with broker successfully`);
+            }
+            catch (error) {
+                logger.debug(`PublicClientApplication(authority='${authority}') initialized without broker`);
+                logger.error(`Failed to initialize PublicClientApplication with broker: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        return clientApp;
+    }
+    isWithBroker() {
+        return this.withBroker;
+    }
+    async getToken() {
+        const logPrefix = `ClientAppWrapper(${this.withBroker ? "withBroker" : "noBroker"})`;
+        let authResult = null;
+        if (this.accountId) {
+            logger.debug(`${logPrefix}: Attempting silent token acquisition for cached account`);
+            try {
+                authResult = await this.publicClientApp.acquireTokenSilent({
+                    scopes: azureDevOpsScopes,
+                    account: this.accountId,
+                });
+                logger.debug(`${logPrefix}: Successfully acquired token silently`);
+            }
+            catch (error) {
+                logger.debug(`${logPrefix}: Silent token acquisition failed: ${error instanceof Error ? error.message : String(error)}`);
+                authResult = null;
+            }
+        }
+        else {
+            logger.debug(`${logPrefix}: No cached account available, interactive auth required`);
+        }
+        if (!authResult) {
+            logger.debug(`${logPrefix}: Starting interactive token acquisition`);
+            try {
+                authResult = await this.publicClientApp.acquireTokenInteractive({
+                    scopes: azureDevOpsScopes,
+                    openBrowser: async (url) => {
+                        logger.debug(`${logPrefix}: Opening browser for authentication with target URL: ${url}`);
+                        open(url);
+                    },
+                });
+                this.accountId = authResult.account;
+                logger.debug(`${logPrefix}: Successfully acquired token interactively, account cached`);
+            }
+            catch (error) {
+                const msalErrorMessage = error.platformBrokerError ? JSON.stringify(error.platformBrokerError) : "";
+                logger.debug(`${logPrefix}: Interactive token acquisition failed: ${error instanceof Error ? error.message + msalErrorMessage : String(error)}`);
+                authResult = null;
+            }
+        }
+        if (!authResult?.accessToken) {
+            throw new Error("Failed to obtain Azure DevOps OAuth token.");
+        }
+        logger.debug(`${logPrefix}: Token obtained successfully`);
+        return authResult.accessToken;
+    }
+}
+export class OAuthAuthenticator {
+    authority;
+    clientApp;
+    constructor(tenantId) {
+        this.authority = defaultAuthority;
+        if (tenantId && tenantId !== zeroTenantId) {
+            this.authority = `https://login.microsoftonline.com/${tenantId}`;
+        }
+        this.clientApp = null;
+    }
+    async getToken() {
+        if (!this.clientApp) {
+            this.clientApp = await ClientAppWrapper.initialize(this.authority, true);
+        }
+        try {
+            const token = await this.clientApp.getToken();
+            return token;
+        }
+        catch {
+            if (this.clientApp.isWithBroker()) {
+                logger.debug(`OAuthAuthenticator: Token acquisition failed with broker, retrying without broker`);
+                this.clientApp = await ClientAppWrapper.initialize(this.authority, false);
+            }
+        }
+        return await this.clientApp.getToken();
+    }
+}

package/dist/shared/tool-annotations.js

@@ -0,0 +1,85 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+const READ_ONLY_ANNOTATIONS = {
+    readOnlyHint: true,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+};
+const MUTATING_ANNOTATIONS = {
+    readOnlyHint: false,
+    destructiveHint: true,
+    idempotentHint: false,
+    openWorldHint: true,
+};
+const ADDITIVE_ANNOTATIONS = {
+    ...MUTATING_ANNOTATIONS,
+    destructiveHint: false,
+};
+const TOOL_ANNOTATIONS = {
+    advsec_get_alert_details: READ_ONLY_ANNOTATIONS,
+    advsec_get_alerts: READ_ONLY_ANNOTATIONS,
+    core_get_identity_ids: READ_ONLY_ANNOTATIONS,
+    core_list_projects: READ_ONLY_ANNOTATIONS,
+    core_list_project_teams: READ_ONLY_ANNOTATIONS,
+    mcp_apps_ping: { ...READ_ONLY_ANNOTATIONS, openWorldHint: false },
+    pipelines_artifact: MUTATING_ANNOTATIONS,
+    pipelines_build: READ_ONLY_ANNOTATIONS,
+    pipelines_build_log: READ_ONLY_ANNOTATIONS,
+    pipelines_definition: READ_ONLY_ANNOTATIONS,
+    pipelines_run: READ_ONLY_ANNOTATIONS,
+    pipelines_write: MUTATING_ANNOTATIONS,
+    repo_branch: READ_ONLY_ANNOTATIONS,
+    repo_create_branch: ADDITIVE_ANNOTATIONS,
+    repo_file: READ_ONLY_ANNOTATIONS,
+    repo_file_write: MUTATING_ANNOTATIONS,
+    repo_pull_request: READ_ONLY_ANNOTATIONS,
+    repo_pull_request_org: READ_ONLY_ANNOTATIONS,
+    repo_pull_request_thread: READ_ONLY_ANNOTATIONS,
+    repo_pull_request_thread_write: MUTATING_ANNOTATIONS,
+    repo_pull_request_write: MUTATING_ANNOTATIONS,
+    repo_repository: READ_ONLY_ANNOTATIONS,
+    repo_search_commits: READ_ONLY_ANNOTATIONS,
+    search_code: READ_ONLY_ANNOTATIONS,
+    search_wiki: READ_ONLY_ANNOTATIONS,
+    search_workitem: READ_ONLY_ANNOTATIONS,
+    testplan: READ_ONLY_ANNOTATIONS,
+    testplan_show_test_results_from_build_id: READ_ONLY_ANNOTATIONS,
+    testplan_test_case_write: MUTATING_ANNOTATIONS,
+    testplan_test_plan_write: MUTATING_ANNOTATIONS,
+    testplan_test_suite_write: MUTATING_ANNOTATIONS,
+    wiki: READ_ONLY_ANNOTATIONS,
+    wiki_upsert_page: MUTATING_ANNOTATIONS,
+    wit_backlog: MUTATING_ANNOTATIONS,
+    wit_query: READ_ONLY_ANNOTATIONS,
+    wit_work_item: READ_ONLY_ANNOTATIONS,
+    wit_work_item_attachment: READ_ONLY_ANNOTATIONS,
+    wit_work_item_attachment_link: ADDITIVE_ANNOTATIONS,
+    wit_work_item_attachment_upload: ADDITIVE_ANNOTATIONS,
+    wit_work_item_comment_write: MUTATING_ANNOTATIONS,
+    wit_work_item_link_write: MUTATING_ANNOTATIONS,
+    wit_work_item_write: MUTATING_ANNOTATIONS,
+    work: READ_ONLY_ANNOTATIONS,
+    work_capacity_write: MUTATING_ANNOTATIONS,
+    work_iteration_write: ADDITIVE_ANNOTATIONS,
+};
+function configureToolsWithAnnotations(server, configureFn) {
+    const originalTool = server.tool;
+    server.tool = new Proxy(originalTool, {
+        apply(target, thisArg, argumentsList) {
+            const toolName = argumentsList[0];
+            if (typeof toolName !== "string" || !Object.hasOwn(TOOL_ANNOTATIONS, toolName)) {
+                throw new Error(`Missing MCP annotations for tool: ${String(toolName)}`);
+            }
+            argumentsList.splice(argumentsList.length - 1, 0, TOOL_ANNOTATIONS[toolName]);
+            return Reflect.apply(target, thisArg, argumentsList);
+        },
+    });
+    try {
+        configureFn();
+    }
+    finally {
+        server.tool = originalTool;
+    }
+}
+export { configureToolsWithAnnotations, TOOL_ANNOTATIONS };

package/dist/tools/pipelines.js

@@ -3,13 +3,30 @@
 import { apiVersion, getEnumKeys, safeEnumConvert } from "../utils.js";
 import { BuildQueryOrder, DefinitionQueryOrder } from "azure-devops-node-api/interfaces/BuildInterfaces.js";
 import { z } from "zod";
+const buildQueryOrderKeys = getEnumKeys(BuildQueryOrder);
+const definitionQueryOrderKeys = getEnumKeys(DefinitionQueryOrder);
 import { StageUpdateType } from "azure-devops-node-api/interfaces/BuildInterfaces.js";
 import { ConfigurationType, RepositoryType } from "azure-devops-node-api/interfaces/PipelinesInterfaces.js";
 import { mkdirSync, createWriteStream } from "fs";
 import { createExternalContentResponse } from "../shared/content-safety.js";
 import { join, posix, resolve, win32 } from "path";
+import { Readable, Transform } from "stream";
+import { pipeline } from "stream/promises";
 import { pipelinesWriteShape } from "./pipelines.dto.js";
 const errorResult = (text) => ({ content: [{ type: "text", text }], isError: true });
+const MAX_ARTIFACT_FILE_BYTES = 1024 * 1024 * 1024;
+const MAX_ARTIFACT_BASE64_BYTES = 10 * 1024 * 1024;
+function getArtifactResponseStream(response) {
+    if (!response.body)
+        throw new Error("Artifact download returned an empty response body.");
+    return Readable.fromWeb(response.body);
+}
+function validateArtifactContentLength(response, maxBytes, limitDescription) {
+    const contentLength = Number(response.headers.get("content-length"));
+    if (Number.isFinite(contentLength) && contentLength > maxBytes) {
+        throw new Error(`Artifact download exceeds the ${limitDescription} limit.`);
+    }
+}
 async function runPipeline(args, connectionProvider) {
     if (!args.pipelineId)
         return errorResult("pipelineId is required for run_pipeline");
@@ -138,7 +155,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
         continuationToken: z.string().optional().describe("Token for continuing paged results. Used for: list, get_changes."),
         maxBuildsPerDefinition: z.number().optional().describe("Maximum number of builds per definition. Used for: list."),
         deletedFilter: z.number().optional().describe("Filter for deleted builds (see QueryDeletedOption enum). Used for: list."),
-        queryOrder: z.string().optional().describe("Order in which builds are returned (BuildQueryOrder values). Used for: list."),
+        queryOrder: z.enum(buildQueryOrderKeys).optional().describe("Order in which builds are returned. Used for: list."),
         branchName: z.string().optional().describe("Branch name to filter builds. Used for: list."),
         buildIds: z.array(z.coerce.number().min(1)).optional().describe("Array of specific build IDs to retrieve. Used for: list."),
         repositoryId: z.string().optional().describe("Repository ID to filter builds. Used for: list."),
@@ -222,7 +239,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
         repositoryType: z.enum(["TfsGit", "GitHub", "BitbucketCloud"]).optional().describe("Repository type to filter definitions. Used for: list."),
         name: z.string().optional().describe("Name filter for build definitions. Used for: list."),
         path: z.string().optional().describe("Path filter for build definitions. Used for: list."),
-        queryOrder: z.string().optional().describe("Order in which definitions are returned (DefinitionQueryOrder values). Used for: list."),
+        queryOrder: z.enum(definitionQueryOrderKeys).optional().describe("Order in which definitions are returned. Used for: list."),
         top: z.number().optional().describe("Maximum number of definitions to return. Used for: list."),
         continuationToken: z.string().optional().describe("Token for continuing paged results. Used for: list."),
         minMetricsTime: z.coerce.date().optional().describe("Minimum metrics time to filter definitions. Used for: list."),
@@ -338,25 +355,47 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
                 if (!artifact) {
                     return { content: [{ type: "text", text: `Artifact ${resolvedArtifactName} not found in build ${buildId}.` }], isError: true };
                 }
-                const fileStream = await buildApi.getArtifactContentZip(project, buildId, resolvedArtifactName);
+                if (!artifact.resource?.downloadUrl) {
+                    throw new Error(`Artifact ${resolvedArtifactName} does not have a download URL.`);
+                }
+                const accessToken = await tokenProvider();
+                const response = await fetch(artifact.resource.downloadUrl, {
+                    headers: { "Authorization": `Bearer ${accessToken}`, "User-Agent": userAgentProvider() },
+                });
+                if (!response.ok) {
+                    throw new Error(`Artifact download failed: ${response.status} ${response.statusText}`);
+                }
                 if (destinationPath) {
+                    validateArtifactContentLength(response, MAX_ARTIFACT_FILE_BYTES, "1 GB file size");
                     const fullDestinationPath = resolve(destinationPath);
                     mkdirSync(fullDestinationPath, { recursive: true });
                     const fileDestinationPath = join(fullDestinationPath, `${resolvedArtifactName}.zip`);
                     const writeStream = createWriteStream(fileDestinationPath);
-                    await new Promise((resolve, reject) => {
-                        fileStream.pipe(writeStream);
-                        fileStream.on("end", () => resolve());
-                        fileStream.on("error", (err) => reject(err));
+                    let downloadedBytes = 0;
+                    const sizeLimitStream = new Transform({
+                        transform(chunk, _encoding, callback) {
+                            downloadedBytes += chunk.length;
+                            if (downloadedBytes > MAX_ARTIFACT_FILE_BYTES) {
+                                callback(new Error("Artifact download exceeds the 1 GB file size limit."));
+                                return;
+                            }
+                            callback(null, chunk);
+                        },
                     });
+                    await pipeline(getArtifactResponseStream(response), sizeLimitStream, writeStream);
                     return { content: [{ type: "text", text: `Artifact ${resolvedArtifactName} downloaded to ${destinationPath}.` }] };
                 }
+                validateArtifactContentLength(response, MAX_ARTIFACT_BASE64_BYTES, "10 MB base64 response size");
                 const chunks = [];
-                await new Promise((resolve, reject) => {
-                    fileStream.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-                    fileStream.on("end", () => resolve());
-                    fileStream.on("error", (err) => reject(err));
-                });
+                let downloadedBytes = 0;
+                for await (const chunk of getArtifactResponseStream(response)) {
+                    const bufferChunk = Buffer.from(chunk);
+                    downloadedBytes += bufferChunk.length;
+                    if (downloadedBytes > MAX_ARTIFACT_BASE64_BYTES) {
+                        throw new Error("Artifact download exceeds the 10 MB base64 response size limit.");
+                    }
+                    chunks.push(bufferChunk);
+                }
                 const buffer = Buffer.concat(chunks);
                 const base64Data = buffer.toString("base64");
                 return {