@azure-devops/mcp 2.5.0-nightly.20260318 → 2.5.0-nightly.20260320

package/dist/tools/pipelines.js

@@ -6,7 +6,7 @@ import { z } from "zod";
 import { StageUpdateType } from "azure-devops-node-api/interfaces/BuildInterfaces.js";
 import { ConfigurationType, RepositoryType } from "azure-devops-node-api/interfaces/PipelinesInterfaces.js";
 import { mkdirSync, createWriteStream } from "fs";
-import { join, resolve } from "path";
+import { join, posix, resolve, win32 } from "path";
 const PIPELINE_TOOLS = {
     pipelines_get_builds: "pipelines_get_builds",
     pipelines_get_build_changes: "pipelines_get_build_changes",
@@ -336,6 +336,13 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
         artifactName: z.string().describe("The name of the artifact to download."),
         destinationPath: z.string().optional().describe("The local path to download the artifact to. If not provided, returns binary content as base64."),
     }, async ({ project, buildId, artifactName, destinationPath }) => {
+        const isAbsolutePath = (value) => posix.isAbsolute(value) || win32.isAbsolute(value);
+        if (artifactName.includes("..")) {
+            throw new Error("Invalid artifactName: path traversal is not allowed.");
+        }
+        if (destinationPath && (destinationPath.includes("..") || isAbsolutePath(destinationPath))) {
+            throw new Error("Invalid destinationPath: absolute paths and paths traversals are not allowed.");
+        }
         const connection = await connectionProvider();
         const buildApi = await connection.getBuildApi();
         const artifact = await buildApi.getArtifact(project, buildId, artifactName);

package/dist/tools/repositories.js

@@ -86,6 +86,9 @@ function filterReposByName(repositories, repoNameFilter) {
     return filteredByName;
 }
 function trimPullRequest(pr, includeDescription = false) {
+    if (!pr) {
+        return null;
+    }
     return {
         pullRequestId: pr.pullRequestId,
         codeReviewId: pr.codeReviewId,
@@ -170,6 +173,11 @@ function configureRepoTools(server, tokenProvider, connectionProvider, userAgent
                 }
             }
             const trimmedPullRequest = trimPullRequest(pullRequest, true);
+            if (!trimmedPullRequest) {
+                return {
+                    content: [{ type: "text", text: "Pull request created but API returned no data." }],
+                };
+            }
             return {
                 content: [{ type: "text", text: JSON.stringify(trimmedPullRequest, null, 2) }],
             };
@@ -365,6 +373,11 @@ function configureRepoTools(server, tokenProvider, connectionProvider, userAgent
                 updatedPullRequest = await gitApi.getPullRequest(repositoryId, pullRequestId, project);
             }
             const trimmedUpdatedPullRequest = trimPullRequest(updatedPullRequest, true);
+            if (!trimmedUpdatedPullRequest) {
+                return {
+                    content: [{ type: "text", text: "Pull request updated but API returned no data." }],
+                };
+            }
             return {
                 content: [{ type: "text", text: JSON.stringify(trimmedUpdatedPullRequest, null, 2) }],
             };

package/dist/version.js

@@ -1 +1 @@
-export const packageVersion = "2.5.0-nightly.20260318";
+export const packageVersion = "2.5.0-nightly.20260320";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-devops/mcp",
-  "version": "2.5.0-nightly.20260318",
+  "version": "2.5.0-nightly.20260320",
   "mcpName": "microsoft.com/azure-devops",
   "description": "MCP server for interacting with Azure DevOps",
   "license": "MIT",