@azure-devops/mcp 2.5.0-nightly.20260319 → 2.5.0-nightly.20260320

package/dist/tools/pipelines.js

@@ -6,7 +6,7 @@ import { z } from "zod";
 import { StageUpdateType } from "azure-devops-node-api/interfaces/BuildInterfaces.js";
 import { ConfigurationType, RepositoryType } from "azure-devops-node-api/interfaces/PipelinesInterfaces.js";
 import { mkdirSync, createWriteStream } from "fs";
-import { join, resolve } from "path";
+import { join, posix, resolve, win32 } from "path";
 const PIPELINE_TOOLS = {
     pipelines_get_builds: "pipelines_get_builds",
     pipelines_get_build_changes: "pipelines_get_build_changes",
@@ -336,6 +336,13 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
         artifactName: z.string().describe("The name of the artifact to download."),
         destinationPath: z.string().optional().describe("The local path to download the artifact to. If not provided, returns binary content as base64."),
     }, async ({ project, buildId, artifactName, destinationPath }) => {
+        const isAbsolutePath = (value) => posix.isAbsolute(value) || win32.isAbsolute(value);
+        if (artifactName.includes("..")) {
+            throw new Error("Invalid artifactName: path traversal is not allowed.");
+        }
+        if (destinationPath && (destinationPath.includes("..") || isAbsolutePath(destinationPath))) {
+            throw new Error("Invalid destinationPath: absolute paths and paths traversals are not allowed.");
+        }
         const connection = await connectionProvider();
         const buildApi = await connection.getBuildApi();
         const artifact = await buildApi.getArtifact(project, buildId, artifactName);

package/dist/version.js

@@ -1 +1 @@
-export const packageVersion = "2.5.0-nightly.20260319";
+export const packageVersion = "2.5.0-nightly.20260320";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-devops/mcp",
-  "version": "2.5.0-nightly.20260319",
+  "version": "2.5.0-nightly.20260320",
   "mcpName": "microsoft.com/azure-devops",
   "description": "MCP server for interacting with Azure DevOps",
   "license": "MIT",