@azure-devops/mcp 2.10.0 → 2.11.0

package/dist/tools/work-items.js

@@ -1,7 +1,8 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
-import * as fs from "fs";
+import { constants, open, realpath } from "fs/promises";
 import * as path from "path";
+import { Readable } from "stream";
 import { WorkItemExpand } from "azure-devops-node-api/interfaces/WorkItemTrackingInterfaces.js";
 import { QueryExpand } from "azure-devops-node-api/interfaces/WorkItemTrackingInterfaces.js";
 import { z } from "zod";
@@ -14,10 +15,25 @@ const WORKITEM_TOOLS = {
     wit_query: "wit_query",
     wit_backlog: "wit_backlog",
     wit_work_item_attachment: "wit_work_item_attachment",
+    wit_work_item_attachment_upload: "wit_work_item_attachment_upload",
+    wit_work_item_attachment_link: "wit_work_item_attachment_link",
     wit_work_item_write: "wit_work_item_write",
     wit_work_item_comment_write: "wit_work_item_comment_write",
     wit_work_item_link_write: "wit_work_item_link_write",
 };
+const jsonPatchValueSchema = z.lazy(() => z.union([z.string(), z.number().finite(), z.boolean(), z.null(), z.array(jsonPatchValueSchema), z.record(jsonPatchValueSchema)]));
+const readConsistencyHandler = {
+    prepareRequest(options) {
+        options.headers = { ...options.headers, "X-VSS-ReadConsistencyLevel": "Eventual" };
+    },
+    canHandleAuthentication: () => false,
+    async handleAuthentication() {
+        throw new Error("The read-consistency handler does not handle authentication.");
+    },
+};
+function getReadReplicaWorkItemTrackingApi(connection) {
+    return connection.getWorkItemTrackingApi(undefined, [connection.authHandler, readConsistencyHandler]);
+}
 function getLinkTypeFromName(name) {
     switch (name.toLowerCase()) {
         case "parent":
@@ -68,10 +84,8 @@ function escapeHtml(value) {
     };
     return value.replace(/[&<>"']/g, (character) => entities[character]);
 }
-async function resolveCommentMentions(text, format, tokenProvider, connectionProvider, userAgentProvider) {
+async function prepareCommentText(text, format, tokenProvider, connectionProvider, userAgentProvider) {
     const emailMatches = [...text.matchAll(/@<([^<>\s]+@[^<>\s]+)>/g)];
-    if (emailMatches.length === 0)
-        return text;
     const identities = new Map();
     for (const email of new Set(emailMatches.map((match) => match[1]))) {
         try {
@@ -81,20 +95,30 @@ async function resolveCommentMentions(text, format, tokenProvider, connectionPro
             // Leave mentions unchanged when their identities cannot be resolved.
         }
     }
-    return text.replace(/@<([^<>\s]+@[^<>\s]+)>/g, (mention, email) => {
+    // Encode Markdown transport text once, preserving mention tokens for Azure DevOps.
+    // Encoding ampersands also preserves intentional entity text after one decode.
+    const markdown = format === "Markdown" || format === undefined;
+    return text.replace(/@<([^<>\s]+@[^<>\s]+)>|@<([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})>|[&<>]/gi, (mention, email, id) => {
+        if (id)
+            return mention;
+        if (!email)
+            return markdown ? escapeHtml(mention) : mention;
         const identity = identities.get(email);
         if (!identity)
             return escapeHtml(mention);
-        return format === "Markdown" || format === undefined ? `@<${identity.id}>` : `<a href="#" data-vss-mention="version:2.0,${identity.id}">@${escapeHtml(identity.displayName)}</a>`;
+        return markdown ? `@<${identity.id}>` : `<a href="#" data-vss-mention="version:2.0,${identity.id}">@${escapeHtml(identity.displayName)}</a>`;
     });
 }
 function configureWorkItemTools(server, tokenProvider, connectionProvider, userAgentProvider) {
     // --- wit_work_item ----------------------------------------------------------
-    server.tool(WORKITEM_TOOLS.wit_work_item, "Retrieve work item data for a project. Use the action parameter to specify the operation.", {
+    server.tool(WORKITEM_TOOLS.wit_work_item, "Retrieve work item data. Use the action parameter to specify the operation.", {
         action: z
             .enum(["get", "get_batch", "list_comments", "my", "list_revisions", "list_for_iteration", "get_type"])
             .describe("The action to perform. Options: get (get a single work item by ID), get_batch (get multiple work items by IDs), list_comments (list comments on a work item), my (get work items relevant to the authenticated user), list_revisions (list revisions of a work item), list_for_iteration (list work items for a team iteration), get_type (get metadata for a work item type)."),
-        project: z.string().optional().describe("The name or ID of the Azure DevOps project. Reuse from prior context if already known. If not provided, a project selection prompt will be shown."),
+        project: z
+            .string()
+            .optional()
+            .describe("The name or ID of the Azure DevOps project. Optional for get; when omitted, the work item is retrieved at organization scope. For other actions, a project selection prompt will be shown if omitted."),
         id: z.coerce.number().min(1).optional().describe("Work item ID. Required for: get."),
         ids: z.array(z.coerce.number().min(1)).optional().describe("Work item IDs. Required for: get_batch."),
         workItemId: z.coerce.number().min(1).optional().describe("Work item ID. Required for: list_comments, list_revisions."),
@@ -105,25 +129,20 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             .optional()
             .describe("Expand options (None, Fields, Relations, Links, All). Used for: get, list_revisions. For get, cannot be combined with fields."),
         top: z.coerce.number().optional().describe("Maximum number of results to return. Used for: list_comments, my, list_revisions. Defaults vary by action."),
+        continuationToken: z.string().optional().describe("Token for continuing paged results. Used for: list_comments."),
         includeCompleted: z.boolean().optional().default(false).describe("Include completed work items. Used for: my. Defaults to false."),
         type: z.enum(["assignedtome", "myactivity"]).optional().describe("Type of work items to retrieve. Used for: my. Defaults to 'assignedtome'."),
         skip: z.coerce.number().optional().describe("Number of results to skip for pagination. Used for: list_revisions."),
         team: z.string().optional().describe("Team name or ID. Used for: list_for_iteration."),
         iterationId: z.string().optional().describe("Iteration ID. Required for: list_for_iteration."),
         workItemType: z.string().optional().describe("Work item type name. Required for: get_type."),
-    }, async ({ action, project, id, ids, workItemId, fields, asOf, expand, top, includeCompleted, type, skip, team, iterationId, workItemType }) => {
+    }, async ({ action, project, id, ids, workItemId, fields, asOf, expand, top, continuationToken, includeCompleted, type, skip, team, iterationId, workItemType }) => {
         try {
             const connection = await connectionProvider();
             let resolvedProject = project;
             if (action === "get") {
                 if (!id)
                     return { content: [{ type: "text", text: "id is required for get" }], isError: true };
-                if (!resolvedProject) {
-                    const result = await elicitProject(server, connection, "Select the Azure DevOps project to retrieve the work item from.");
-                    if ("response" in result)
-                        return result.response;
-                    resolvedProject = result.resolved;
-                }
                 let effectiveExpand = expand;
                 if (fields && fields.length > 0 && effectiveExpand != null) {
                     effectiveExpand = "none";
@@ -180,7 +199,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
                     resolvedProject = result.resolved;
                 }
                 const workItemApi = await connection.getWorkItemTrackingApi();
-                const comments = await workItemApi.getComments(resolvedProject, workItemId, top ?? 50);
+                const comments = await workItemApi.getComments(resolvedProject, workItemId, top ?? 50, continuationToken);
                 return { content: [{ type: "text", text: JSON.stringify(comments, null, 2) }] };
             }
             if (action === "my") {
@@ -289,7 +308,10 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
         team: z.string().optional().describe("Team name or ID. Used for: get_results, wiql."),
         timePrecision: z.boolean().optional().describe("Include time precision in date fields. Used for: get_results, wiql."),
         top: z.coerce.number().default(50).describe("Maximum number of results to return. Used for: get_results, wiql. Defaults to 50."),
-        responseType: z.enum(["full", "ids"]).default("full").describe("Response type: 'full' returns complete results (default), 'ids' returns only work item IDs. Used for: get_results."),
+        responseType: z
+            .enum(["full", "ids"])
+            .default("full")
+            .describe("Response type: 'full' returns complete results (default). 'ids' returns only work item IDs and supports flat queries only; any other query type is not supported. Used for: get_results."),
         wiql: z.string().max(32768).optional().describe('The WIQL query string to execute. Required for: wiql. Example: "SELECT [System.Id] FROM WorkItems WHERE [System.TeamProject] = @project".'),
     }, async ({ action, project, query, expand, depth, includeDeleted, useIsoDateFormat, id, team, timePrecision, top, responseType, wiql }) => {
         try {
@@ -311,7 +333,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             if (action === "get_results") {
                 if (!id)
                     return { content: [{ type: "text", text: "id is required for get_results" }], isError: true };
-                const workItemApi = await connection.getWorkItemTrackingApi();
+                const workItemApi = await getReadReplicaWorkItemTrackingApi(connection);
                 const teamContext = { project: resolvedProject, team };
                 const queryResult = await workItemApi.queryById(id, teamContext, timePrecision, top);
                 if (responseType === "ids") {
@@ -323,7 +345,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             if (action === "wiql") {
                 if (!wiql)
                     return { content: [{ type: "text", text: "wiql is required for wiql" }], isError: true };
-                const workItemApi = await connection.getWorkItemTrackingApi();
+                const workItemApi = await getReadReplicaWorkItemTrackingApi(connection);
                 const teamContext = { project: resolvedProject, team };
                 const queryResult = await workItemApi.queryByWiql({ query: wiql }, teamContext, timePrecision, top);
                 return createExternalContentResponse(queryResult, "wiql query results");
@@ -412,12 +434,12 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
     // --- wit_work_item_attachment -----------------------------------------------
     server.tool(WORKITEM_TOOLS.wit_work_item_attachment, "Download a work item attachment by its ID. By default returns the content as a base64-encoded resource. If savePath is provided, saves the file locally to that directory and returns the file path instead. Useful for viewing images (e.g. screenshots) or other files attached to work items such as bugs. If a project is not specified, you will be prompted to select one.", {
         project: z.string().optional().describe("The name or ID of the Azure DevOps project. Reuse from prior context if already known. If not provided, a project selection prompt will be shown."),
-        attachmentId: z.string().describe("The GUID of the attachment. Found in the attachment URL: https://dev.azure.com/{org}/{project}/_apis/wit/attachments/{attachmentId}"),
+        attachmentId: z.string().describe("The GUID of the attachment. Found in the attachment URL: https://dev.azure.com/{org}/{project}/_apis/wit/attachments/{attachmentId}."),
         fileName: z.string().optional().describe("The file name of the attachment, e.g. 'screenshot.png'. Used to determine the MIME type or the saved file's name."),
         savePath: z
             .string()
             .optional()
-            .describe("Optional local directory path where the file should be saved. Must be a relative path (e.g. 'temp' or 'downloads/attachments'); absolute paths and path traversals are not allowed. If provided, saves the attachment to this directory and returns the file path. If omitted, returns the content as a base64-encoded resource."),
+            .describe("Optional local directory path where the downloaded file should be saved. Must be a relative path (e.g. 'temp' or 'downloads/attachments') to an existing directory that resolves (including symlinks) inside the server's working directory; absolute paths are not allowed. If provided, saves the attachment to this directory and returns the file path. If omitted, returns the content as a base64-encoded resource."),
     }, async ({ project, attachmentId, fileName, savePath }) => {
         const isAbsolutePath = (value) => path.posix.isAbsolute(value) || path.win32.isAbsolute(value);
         const hasDriveLetter = (value) => /^[a-zA-Z]:/.test(value);
@@ -427,6 +449,14 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
         if (fileName !== undefined && fileName.includes("..")) {
             throw new Error("Invalid fileName: path traversal is not allowed.");
         }
+        if (!attachmentId)
+            return { content: [{ type: "text", text: "attachmentId is required for download" }], isError: true };
+        if (savePath) {
+            const localFileName = fileName ?? attachmentId;
+            if (!localFileName || localFileName.includes("\0") || path.posix.basename(localFileName) !== localFileName || path.win32.basename(localFileName) !== localFileName) {
+                throw new Error("Invalid fileName: path components are not allowed.");
+            }
+        }
         try {
             const connection = await connectionProvider();
             let resolvedProject = project;
@@ -438,6 +468,12 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             }
             const workItemApi = await connection.getWorkItemTrackingApi();
             const stream = await workItemApi.getAttachmentContent(attachmentId, fileName, resolvedProject);
+            const responseStream = stream;
+            if (responseStream.statusCode !== undefined && (responseStream.statusCode < 200 || responseStream.statusCode >= 300)) {
+                responseStream.resume();
+                const statusMessage = responseStream.statusMessage ? ` ${responseStream.statusMessage}` : "";
+                throw new Error(`Attachment download failed: HTTP ${responseStream.statusCode}${statusMessage}`);
+            }
             const chunks = [];
             await new Promise((resolve, reject) => {
                 stream.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
@@ -446,12 +482,21 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             });
             const buffer = Buffer.concat(chunks);
             if (savePath) {
-                const resolvedFileName = fileName ?? attachmentId;
-                const localFilePath = path.join(savePath, resolvedFileName);
-                if (fs.existsSync(localFilePath)) {
-                    throw new Error(`File already exists: ${localFilePath}`);
+                const workspaceRoot = await realpath(process.cwd());
+                const resolvedDirectory = await realpath(path.resolve(workspaceRoot, savePath));
+                const relativeDirectory = path.relative(workspaceRoot, resolvedDirectory);
+                if (relativeDirectory === ".." || relativeDirectory.startsWith(`..${path.sep}`) || path.isAbsolute(relativeDirectory)) {
+                    throw new Error("Invalid savePath: destination must remain inside the workspace.");
+                }
+                const localFilePath = path.resolve(resolvedDirectory, fileName ?? attachmentId);
+                // O_EXCL fails if the file (or a symlink) already exists, so there is no check-then-write race.
+                const file = await open(localFilePath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | (constants.O_NOFOLLOW ?? 0), 0o600);
+                try {
+                    await file.writeFile(buffer);
+                }
+                finally {
+                    await file.close();
                 }
-                fs.writeFileSync(localFilePath, buffer);
                 return {
                     content: [{ type: "text", text: `Attachment saved to: ${localFilePath}` }],
                 };
@@ -482,6 +527,80 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             };
         }
     });
+    // --- wit_work_item_attachment_upload ----------------------------------------
+    server.tool(WORKITEM_TOOLS.wit_work_item_attachment_upload, "Upload base64-encoded content as a new work item attachment. This tool only uploads the attachment; use wit_work_item_attachment_link separately to link the returned attachment URL to a work item.", {
+        project: z.string().optional().describe("The name or ID of the Azure DevOps project. Reuse from prior context if already known. If not provided, a project selection prompt will be shown."),
+        fileName: z.string().describe("The name of the file to upload, e.g. 'screenshot.png'."),
+        content: z.string().describe("Base64-encoded file content to upload."),
+    }, async ({ project, fileName, content }) => {
+        try {
+            if (fileName.includes(".."))
+                return { content: [{ type: "text", text: "Invalid fileName: path traversal is not allowed." }], isError: true };
+            if (!content)
+                return { content: [{ type: "text", text: "content is required for upload" }], isError: true };
+            if (!/^[A-Za-z0-9+/]+={0,2}$/.test(content))
+                return { content: [{ type: "text", text: "content must be valid base64-encoded data" }], isError: true };
+            const connection = await connectionProvider();
+            let resolvedProject = project;
+            if (!resolvedProject) {
+                const result = await elicitProject(server, connection, "Select the Azure DevOps project to upload the work item attachment to.");
+                if ("response" in result)
+                    return result.response;
+                resolvedProject = result.resolved;
+            }
+            const workItemApi = await connection.getWorkItemTrackingApi();
+            const attachmentReference = await workItemApi.createAttachment({}, Readable.from(Buffer.from(content, "base64")), fileName, undefined, resolvedProject);
+            return { content: [{ type: "text", text: JSON.stringify(attachmentReference, null, 2) }] };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : "Unknown error occurred";
+            return {
+                content: [{ type: "text", text: `Error uploading work item attachment: ${errorMessage}` }],
+                isError: true,
+            };
+        }
+    });
+    // --- wit_work_item_attachment_link ------------------------------------------
+    server.tool(WORKITEM_TOOLS.wit_work_item_attachment_link, "Link an uploaded attachment to a work item using the attachment URL returned by wit_work_item_attachment_upload.", {
+        project: z.string().optional().describe("The name or ID of the Azure DevOps project. Reuse from prior context if already known. If not provided, a project selection prompt will be shown."),
+        workItemId: z.coerce.number().min(1).describe("The ID of the work item to link the uploaded attachment to."),
+        attachmentUrl: z.string().url().describe("The attachment URL returned by wit_work_item_attachment_upload."),
+        comment: z.string().optional().describe("Optional comment to include with the attachment link."),
+    }, async ({ project, workItemId, attachmentUrl, comment }) => {
+        try {
+            const connection = await connectionProvider();
+            let resolvedProject = project;
+            if (!resolvedProject) {
+                const result = await elicitProject(server, connection, "Select the Azure DevOps project containing the work item to link the attachment to.");
+                if ("response" in result)
+                    return result.response;
+                resolvedProject = result.resolved;
+            }
+            const patchDocument = [
+                {
+                    op: "add",
+                    path: "/relations/-",
+                    value: {
+                        rel: "AttachedFile",
+                        url: attachmentUrl,
+                        attributes: { comment: comment || "" },
+                    },
+                },
+            ];
+            const workItemApi = await connection.getWorkItemTrackingApi();
+            const workItem = await workItemApi.updateWorkItem({}, patchDocument, workItemId, resolvedProject);
+            if (!workItem)
+                throw new Error("Work item not found");
+            return { content: [{ type: "text", text: JSON.stringify({ attachmentUrl, workItemId }, null, 2) }] };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : "Unknown error occurred";
+            return {
+                content: [{ type: "text", text: `Error linking work item attachment: ${errorMessage}` }],
+                isError: true,
+            };
+        }
+    });
     // --- wit_work_item_write ----------------------------------------------------
     server.tool(WORKITEM_TOOLS.wit_work_item_write, "Write operations for work items. Use the action parameter to specify the operation.", {
         action: z
@@ -507,13 +626,12 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
                 .default("add")
                 .describe("The operation to perform. Use 'test' with path '/rev' to enforce optimistic concurrency."),
             path: z.string().describe("The path to operate on, e.g. '/fields/System.Title' or '/rev' for a revision test."),
-            value: z
-                .union([z.string(), z.number(), z.boolean(), z.null()])
+            value: jsonPatchValueSchema
                 .optional()
-                .describe("The operation value. Required for add, replace, and test; omit for remove. For a test on '/rev', pass the numeric revision previously read."),
+                .describe("The JSON operation value, including objects and arrays. Required for add, replace, and test; omit for remove. Pass relation objects directly, not as JSON strings. For a test on '/rev', pass the numeric revision previously read."),
         }))
             .optional()
-            .describe('Field updates for a single work item. Required for: update. For a safe read-modify-write, prepend a test operation on "/rev" with value set to the numeric revision returned by the preceding read; Azure DevOps rejects the entire update if the current revision differs.'),
+            .describe('JSON Patch operations for fields and relations on a single work item. Required for: update. For a safe read-modify-write, prepend a test operation on "/rev" with value set to the numeric revision returned by the preceding read; Azure DevOps rejects the entire update if the current revision differs.'),
         batchUpdates: z
             .array(z.object({
             op: z.enum(["Add", "Replace", "Remove"]).default("Add").describe("The operation to perform."),
@@ -746,7 +864,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             const orgUrl = connection.serverUrl;
             const accessToken = await tokenProvider();
             const formatParameter = (format ?? "Markdown") === "Markdown" ? 0 : 1;
-            const resolvedText = await resolveCommentMentions(text, format, tokenProvider, connectionProvider, userAgentProvider);
+            const resolvedText = await prepareCommentText(text, format, tokenProvider, connectionProvider, userAgentProvider);
             if (action === "add") {
                 const response = await fetch(`${orgUrl}/${encodeURIComponent(resolvedProject)}/_apis/wit/workItems/${workItemId}/comments?format=${formatParameter}&api-version=${markdownCommentsApiVersion}`, {
                     method: "POST",

package/dist/tools.js

@@ -2,6 +2,7 @@
 // Licensed under the MIT License.
 import { wrapExternalToolResponse } from "./shared/content-safety.js";
 import { Domain } from "./shared/domains.js";
+import { configureToolsWithAnnotations } from "./shared/tool-annotations.js";
 import { configureAdvSecTools } from "./tools/advanced-security.js";
 import { configureMcpAppsTools } from "./tools/mcp-apps.js";
 import { configurePipelineTools } from "./tools/pipelines.js";
@@ -13,23 +14,25 @@ import { configureWikiTools } from "./tools/wiki.js";
 import { configureWorkTools } from "./tools/work.js";
 import { configureWorkItemTools } from "./tools/work-items.js";
 function configureAllTools(server, tokenProvider, connectionProvider, userAgentProvider, enabledDomains) {
-    const configureIfDomainEnabled = (domain, configureFn) => {
-        if (enabledDomains.has(domain)) {
-            configureToolsWithContentSafety(server, domain, configureFn);
-        }
-    };
-    configureIfDomainEnabled(Domain.CORE, () => configureCoreTools(server, tokenProvider, connectionProvider, userAgentProvider));
-    // This is a local health-check response and contains no Azure DevOps content.
-    if (enabledDomains.has(Domain.MCP_APPS))
-        configureMcpAppsTools(server);
-    configureIfDomainEnabled(Domain.WORK, () => configureWorkTools(server, tokenProvider, connectionProvider));
-    configureIfDomainEnabled(Domain.PIPELINES, () => configurePipelineTools(server, tokenProvider, connectionProvider, userAgentProvider));
-    configureIfDomainEnabled(Domain.REPOSITORIES, () => configureRepoTools(server, tokenProvider, connectionProvider, userAgentProvider));
-    configureIfDomainEnabled(Domain.WORK_ITEMS, () => configureWorkItemTools(server, tokenProvider, connectionProvider, userAgentProvider));
-    configureIfDomainEnabled(Domain.WIKI, () => configureWikiTools(server, tokenProvider, connectionProvider, userAgentProvider));
-    configureIfDomainEnabled(Domain.TEST_PLANS, () => configureTestPlanTools(server, tokenProvider, connectionProvider, userAgentProvider));
-    configureIfDomainEnabled(Domain.SEARCH, () => configureSearchTools(server, tokenProvider, connectionProvider, userAgentProvider));
-    configureIfDomainEnabled(Domain.ADVANCED_SECURITY, () => configureAdvSecTools(server, tokenProvider, connectionProvider));
+    configureToolsWithAnnotations(server, () => {
+        const configureIfDomainEnabled = (domain, configureFn) => {
+            if (enabledDomains.has(domain)) {
+                configureToolsWithContentSafety(server, domain, configureFn);
+            }
+        };
+        configureIfDomainEnabled(Domain.CORE, () => configureCoreTools(server, tokenProvider, connectionProvider, userAgentProvider));
+        // This is a local health-check response and contains no Azure DevOps content.
+        if (enabledDomains.has(Domain.MCP_APPS))
+            configureMcpAppsTools(server);
+        configureIfDomainEnabled(Domain.WORK, () => configureWorkTools(server, tokenProvider, connectionProvider));
+        configureIfDomainEnabled(Domain.PIPELINES, () => configurePipelineTools(server, tokenProvider, connectionProvider, userAgentProvider));
+        configureIfDomainEnabled(Domain.REPOSITORIES, () => configureRepoTools(server, tokenProvider, connectionProvider, userAgentProvider));
+        configureIfDomainEnabled(Domain.WORK_ITEMS, () => configureWorkItemTools(server, tokenProvider, connectionProvider, userAgentProvider));
+        configureIfDomainEnabled(Domain.WIKI, () => configureWikiTools(server, tokenProvider, connectionProvider, userAgentProvider));
+        configureIfDomainEnabled(Domain.TEST_PLANS, () => configureTestPlanTools(server, tokenProvider, connectionProvider, userAgentProvider));
+        configureIfDomainEnabled(Domain.SEARCH, () => configureSearchTools(server, tokenProvider, connectionProvider, userAgentProvider));
+        configureIfDomainEnabled(Domain.ADVANCED_SECURITY, () => configureAdvSecTools(server, tokenProvider, connectionProvider));
+    });
 }
 /**
  * Centralizes the untrusted-content boundary for tool responses. Tool registration

package/dist/version.js

@@ -1 +1 @@
-export const packageVersion = "2.10.0";
+export const packageVersion = "2.11.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-devops/mcp",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "mcpName": "microsoft.com/azure-devops",
   "description": "MCP server for interacting with Azure DevOps",
   "license": "MIT",
@@ -40,8 +40,7 @@
     "@azure/identity": "^4.13.0",
     "@azure/logger": "^1.3.0",
     "@azure/msal-node": "^5.5.0",
-    "@azure/msal-node-extensions": "^5.3.5",
-    "@modelcontextprotocol/sdk": "1.29.0",
+    "@modelcontextprotocol/sdk": "1.31.0",
     "azure-devops-extension-api": "^5.272.3",
     "azure-devops-extension-sdk": "^4.0.2",
     "azure-devops-node-api": "^15.1.2",
@@ -51,6 +50,9 @@
     "zod": "^3.25.63",
     "zod-to-json-schema": "^3.24.5"
   },
+  "optionalDependencies": {
+    "@azure/msal-node-extensions": "^5.3.5"
+  },
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "@types/node": "^22.19.1",