@azure-devops/mcp 2.5.0-nightly.20260323 → 2.5.0-nightly.20260325

package/dist/tools/advanced-security.js

@@ -37,7 +37,7 @@ function configureAdvSecTools(server, _, connectionProvider) {
             .array(z.enum(getEnumKeys(AlertValidityStatus)))
             .optional()
             .describe("Filter alerts by validity status. Only applicable for secret alerts."),
-        top: z.number().optional().default(100).describe("Maximum number of alerts to return. Defaults to 100."),
+        top: z.coerce.number().optional().default(100).describe("Maximum number of alerts to return. Defaults to 100."),
         orderBy: z.enum(["id", "firstSeen", "lastSeen", "fixedOn", "severity"]).optional().default("severity").describe("Order results by specified field. Defaults to 'severity'."),
         continuationToken: z.string().optional().describe("Continuation token for pagination."),
     }, async ({ project, repository, alertType, states, severities, ruleId, ruleName, toolName, ref, onlyDefaultBranch, confidenceLevels, validity, top, orderBy, continuationToken }) => {
@@ -79,7 +79,7 @@ function configureAdvSecTools(server, _, connectionProvider) {
     server.tool(ADVSEC_TOOLS.get_alert_details, "Get detailed information about a specific Advanced Security alert.", {
         project: z.string().describe("The name or ID of the Azure DevOps project."),
         repository: z.string().describe("The name or ID of the repository containing the alert."),
-        alertId: z.number().describe("The ID of the alert to retrieve details for."),
+        alertId: z.coerce.number().min(1).describe("The ID of the alert to retrieve details for."),
         ref: z.string().optional().describe("Git reference (branch) to filter the alert."),
     }, async ({ project, repository, alertId, ref }) => {
         try {

package/dist/tools/core.js

@@ -16,8 +16,8 @@ function configureCoreTools(server, tokenProvider, connectionProvider, userAgent
     server.tool(CORE_TOOLS.list_project_teams, "Retrieve a list of teams for an Azure DevOps project. If a project is not specified, you will be prompted to select one.", {
         project: z.string().optional().describe("The name or ID of the Azure DevOps project. Reuse from prior context if already known. If not provided, a project selection prompt will be shown."),
         mine: z.boolean().optional().describe("If true, only return teams that the authenticated user is a member of."),
-        top: z.number().optional().describe("The maximum number of teams to return. Defaults to 100."),
-        skip: z.number().optional().describe("The number of teams to skip for pagination. Defaults to 0."),
+        top: z.coerce.number().optional().describe("The maximum number of teams to return. Defaults to 100."),
+        skip: z.coerce.number().optional().describe("The number of teams to skip for pagination. Defaults to 0."),
     }, async ({ project, mine, top, skip }) => {
         try {
             const connection = await connectionProvider();
@@ -47,9 +47,9 @@ function configureCoreTools(server, tokenProvider, connectionProvider, userAgent
     });
     server.tool(CORE_TOOLS.list_projects, "Retrieve a list of projects in your Azure DevOps organization.", {
         stateFilter: z.enum(["all", "wellFormed", "createPending", "deleted"]).default("wellFormed").describe("Filter projects by their state. Defaults to 'wellFormed'."),
-        top: z.number().optional().describe("The maximum number of projects to return. Defaults to 100."),
-        skip: z.number().optional().describe("The number of projects to skip for pagination. Defaults to 0."),
-        continuationToken: z.number().optional().describe("Continuation token for pagination. Used to fetch the next set of results if available."),
+        top: z.coerce.number().optional().describe("The maximum number of projects to return. Defaults to 100."),
+        skip: z.coerce.number().optional().describe("The number of projects to skip for pagination. Defaults to 0."),
+        continuationToken: z.coerce.number().optional().describe("Continuation token for pagination. Used to fetch the next set of results if available."),
         projectNameFilter: z.string().optional().describe("Filter projects by name. Supports partial matches."),
     }, async ({ stateFilter, top, skip, continuationToken, projectNameFilter }) => {
         try {

package/dist/tools/pipelines.js

@@ -37,7 +37,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
         top: z.number().optional().describe("Maximum number of build definitions to return"),
         continuationToken: z.string().optional().describe("Token for continuing paged results"),
         minMetricsTime: z.coerce.date().optional().describe("Minimum metrics time to filter build definitions"),
-        definitionIds: z.array(z.number()).optional().describe("Array of build definition IDs to filter"),
+        definitionIds: z.array(z.coerce.number().min(1)).optional().describe("Array of build definition IDs to filter"),
         builtAfter: z.coerce.date().optional().describe("Return definitions that have builds after this date"),
         notBuiltAfter: z.coerce.date().optional().describe("Return definitions that do not have builds after this date"),
         includeAllProperties: z.boolean().optional().describe("Whether to include all properties in the results"),
@@ -105,7 +105,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_get_build_definition_revisions, "Retrieves a list of revisions for a specific build definition.", {
         project: z.string().describe("Project ID or name to get the build definition revisions for"),
-        definitionId: z.number().describe("ID of the build definition to get revisions for"),
+        definitionId: z.coerce.number().min(1).describe("ID of the build definition to get revisions for"),
     }, async ({ project, definitionId }) => {
         const connection = await connectionProvider();
         const buildApi = await connection.getBuildApi();
@@ -116,8 +116,8 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_get_builds, "Retrieves a list of builds for a given project.", {
         project: z.string().describe("Project ID or name to get builds for"),
-        definitions: z.array(z.number()).optional().describe("Array of build definition IDs to filter builds"),
-        queues: z.array(z.number()).optional().describe("Array of queue IDs to filter builds"),
+        definitions: z.array(z.coerce.number().min(1)).optional().describe("Array of build definition IDs to filter builds"),
+        queues: z.array(z.coerce.number().min(1)).optional().describe("Array of queue IDs to filter builds"),
         buildNumber: z.string().optional().describe("Build number to filter builds"),
         minTime: z.coerce.date().optional().describe("Minimum finish time to filter builds"),
         maxTime: z.coerce.date().optional().describe("Maximum finish time to filter builds"),
@@ -137,7 +137,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
             .optional()
             .describe("Order in which builds are returned"),
         branchName: z.string().optional().describe("Branch name to filter builds"),
-        buildIds: z.array(z.number()).optional().describe("Array of build IDs to retrieve"),
+        buildIds: z.array(z.coerce.number().min(1)).optional().describe("Array of build IDs to retrieve"),
         repositoryId: z.string().optional().describe("Repository ID to filter builds"),
         repositoryType: z.enum(["TfsGit", "GitHub", "BitbucketCloud"]).optional().describe("Type of repository to filter builds"),
     }, async ({ project, definitions, queues, buildNumber, minTime, maxTime, requestedFor, reasonFilter, statusFilter, resultFilter, tagFilters, properties, top, continuationToken, maxBuildsPerDefinition, deletedFilter, queryOrder, branchName, buildIds, repositoryId, repositoryType, }) => {
@@ -150,7 +150,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_get_build_log, "Retrieves the logs for a specific build.", {
         project: z.string().describe("Project ID or name to get the build log for"),
-        buildId: z.number().describe("ID of the build to get the log for"),
+        buildId: z.coerce.number().min(1).describe("ID of the build to get the log for"),
     }, async ({ project, buildId }) => {
         const connection = await connectionProvider();
         const buildApi = await connection.getBuildApi();
@@ -161,10 +161,10 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_get_build_log_by_id, "Get a specific build log by log ID.", {
         project: z.string().describe("Project ID or name to get the build log for"),
-        buildId: z.number().describe("ID of the build to get the log for"),
-        logId: z.number().describe("ID of the log to retrieve"),
-        startLine: z.number().optional().describe("Starting line number for the log content, defaults to 0"),
-        endLine: z.number().optional().describe("Ending line number for the log content, defaults to the end of the log"),
+        buildId: z.coerce.number().min(1).describe("ID of the build to get the log for"),
+        logId: z.coerce.number().min(1).describe("ID of the log to retrieve"),
+        startLine: z.coerce.number().optional().describe("Starting line number for the log content, defaults to 0"),
+        endLine: z.coerce.number().optional().describe("Ending line number for the log content, defaults to the end of the log"),
     }, async ({ project, buildId, logId, startLine, endLine }) => {
         const connection = await connectionProvider();
         const buildApi = await connection.getBuildApi();
@@ -175,7 +175,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_get_build_changes, "Get the changes associated with a specific build.", {
         project: z.string().describe("Project ID or name to get the build changes for"),
-        buildId: z.number().describe("ID of the build to get changes for"),
+        buildId: z.coerce.number().min(1).describe("ID of the build to get changes for"),
         continuationToken: z.string().optional().describe("Continuation token for pagination"),
         top: z.number().default(100).describe("Number of changes to retrieve, defaults to 100"),
         includeSourceChange: z.boolean().optional().describe("Whether to include source changes in the results, defaults to false"),
@@ -189,8 +189,8 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_get_run, "Gets a run for a particular pipeline.", {
         project: z.string().describe("Project ID or name to run the build in"),
-        pipelineId: z.number().describe("ID of the pipeline to run"),
-        runId: z.number().describe("ID of the run to get"),
+        pipelineId: z.coerce.number().min(1).describe("ID of the pipeline to run"),
+        runId: z.coerce.number().min(1).describe("ID of the run to get"),
     }, async ({ project, pipelineId, runId }) => {
         const connection = await connectionProvider();
         const pipelinesApi = await connection.getPipelinesApi();
@@ -201,7 +201,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_list_runs, "Gets top 10000 runs for a particular pipeline.", {
         project: z.string().describe("Project ID or name to run the build in"),
-        pipelineId: z.number().describe("ID of the pipeline to run"),
+        pipelineId: z.coerce.number().min(1).describe("ID of the pipeline to run"),
     }, async ({ project, pipelineId }) => {
         const connection = await connectionProvider();
         const pipelinesApi = await connection.getPipelinesApi();
@@ -227,7 +227,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
         }))
             .optional(),
         pipelines: z.record(z.string().describe("Name of the pipeline resource."), z.object({
-            runId: z.number().describe("Id of the source pipeline run that triggered or is referenced by this pipeline run."),
+            runId: z.coerce.number().min(1).describe("Id of the source pipeline run that triggered or is referenced by this pipeline run."),
             version: z.string().optional().describe("Version of the source pipeline run."),
         })),
         repositories: z
@@ -241,8 +241,8 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_run_pipeline, "Starts a new run of a pipeline.", {
         project: z.string().describe("Project ID or name to run the build in"),
-        pipelineId: z.number().describe("ID of the pipeline to run"),
-        pipelineVersion: z.number().optional().describe("Version of the pipeline to run. If not provided, the latest version will be used."),
+        pipelineId: z.coerce.number().min(1).describe("ID of the pipeline to run"),
+        pipelineVersion: z.coerce.number().min(1).optional().describe("Version of the pipeline to run. If not provided, the latest version will be used."),
         previewRun: z.boolean().optional().describe("If true, returns the final YAML document after parsing templates without creating a new run."),
         resources: resourcesSchema.optional().describe("A dictionary of resources to pass to the pipeline."),
         stagesToSkip: z.array(z.string()).optional().describe("A list of stages to skip."),
@@ -277,7 +277,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_get_build_status, "Fetches the status of a specific build.", {
         project: z.string().describe("Project ID or name to get the build status for"),
-        buildId: z.number().describe("ID of the build to get the status for"),
+        buildId: z.coerce.number().min(1).describe("ID of the build to get the status for"),
     }, async ({ project, buildId }) => {
         const connection = await connectionProvider();
         const buildApi = await connection.getBuildApi();
@@ -288,14 +288,14 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_update_build_stage, "Updates the stage of a specific build.", {
         project: z.string().describe("Project ID or name to update the build stage for"),
-        buildId: z.number().describe("ID of the build to update"),
+        buildId: z.coerce.number().min(1).describe("ID of the build to update"),
         stageName: z.string().describe("Name of the stage to update"),
         status: z.enum(getEnumKeys(StageUpdateType)).describe("New status for the stage"),
         forceRetryAllJobs: z.boolean().default(false).describe("Whether to force retry all jobs in the stage."),
     }, async ({ project, buildId, stageName, status, forceRetryAllJobs }) => {
         const connection = await connectionProvider();
         const orgUrl = connection.serverUrl;
-        const endpoint = `${orgUrl}/${project}/_apis/build/builds/${buildId}/stages/${stageName}?api-version=${apiVersion}`;
+        const endpoint = `${orgUrl}/${encodeURIComponent(project)}/_apis/build/builds/${buildId}/stages/${encodeURIComponent(stageName)}?api-version=${apiVersion}`;
         const token = await tokenProvider();
         const body = {
             forceRetryAllJobs: forceRetryAllJobs,
@@ -321,7 +321,7 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_list_artifacts, "Lists artifacts for a given build.", {
         project: z.string().describe("The name or ID of the project."),
-        buildId: z.number().describe("The ID of the build."),
+        buildId: z.coerce.number().min(1).describe("The ID of the build."),
     }, async ({ project, buildId }) => {
         const connection = await connectionProvider();
         const buildApi = await connection.getBuildApi();
@@ -332,16 +332,17 @@ function configurePipelineTools(server, tokenProvider, connectionProvider, userA
     });
     server.tool(PIPELINE_TOOLS.pipelines_download_artifact, "Downloads a pipeline artifact.", {
         project: z.string().describe("The name or ID of the project."),
-        buildId: z.number().describe("The ID of the build."),
+        buildId: z.coerce.number().min(1).describe("The ID of the build."),
         artifactName: z.string().describe("The name of the artifact to download."),
         destinationPath: z.string().optional().describe("The local path to download the artifact to. If not provided, returns binary content as base64."),
     }, async ({ project, buildId, artifactName, destinationPath }) => {
         const isAbsolutePath = (value) => posix.isAbsolute(value) || win32.isAbsolute(value);
+        const hasDriveLetter = (value) => /^[a-zA-Z]:/.test(value);
         if (artifactName.includes("..")) {
             throw new Error("Invalid artifactName: path traversal is not allowed.");
         }
-        if (destinationPath && (destinationPath.includes("..") || isAbsolutePath(destinationPath))) {
-            throw new Error("Invalid destinationPath: absolute paths and paths traversals are not allowed.");
+        if (destinationPath && (destinationPath.includes("..") || isAbsolutePath(destinationPath) || hasDriveLetter(destinationPath))) {
+            throw new Error("Invalid destinationPath: absolute paths and path traversals are not allowed.");
         }
         const connection = await connectionProvider();
         const buildApi = await connection.getBuildApi();