@azure-devops/mcp 2.5.0-nightly.20260414 → 2.5.0-nightly.20260415

package/dist/auth.js

@@ -71,6 +71,19 @@ class OAuthAuthenticator {
 function createAuthenticator(type, tenantId) {
     logger.debug(`Creating authenticator of type '${type}' with tenantId='${tenantId ?? "undefined"}'`);
     switch (type) {
+        case "pat":
+            logger.debug(`Authenticator: Using PAT authentication (PERSONAL_ACCESS_TOKEN)`);
+            return async () => {
+                logger.debug(`${type}: Reading token from PERSONAL_ACCESS_TOKEN environment variable`);
+                const b64Pat = process.env["PERSONAL_ACCESS_TOKEN"];
+                if (!b64Pat) {
+                    logger.error(`${type}: PERSONAL_ACCESS_TOKEN environment variable is not set or empty`);
+                    throw new Error("Environment variable 'PERSONAL_ACCESS_TOKEN' is not set or empty. Please set it with a valid base64-encoded Azure DevOps Personal Access Token.");
+                }
+                // Return base64 value as-is — caller uses it directly as the Basic auth credential
+                logger.debug(`${type}: Successfully retrieved PAT from environment variable`);
+                return b64Pat;
+            };
         case "envvar":
             logger.debug(`Authenticator: Using environment variable authentication (ADO_MCP_AUTH_TOKEN)`);
             // Read token from fixed environment variable

package/dist/index.js

@@ -3,7 +3,7 @@
 // Licensed under the MIT License.
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { getBearerHandler, WebApi } from "azure-devops-node-api";
+import { getBearerHandler, getPersonalAccessTokenHandler, WebApi } from "azure-devops-node-api";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import { createAuthenticator } from "./auth.js";
@@ -41,7 +41,7 @@ const argv = yargs(hideBin(process.argv))
     alias: "a",
     describe: "Type of authentication to use",
     type: "string",
-    choices: ["interactive", "azcli", "env", "envvar"],
+    choices: ["interactive", "azcli", "env", "envvar", "pat"],
     default: defaultAuthenticationType,
 })
     .option("tenant", {
@@ -55,10 +55,12 @@ export const orgName = argv.organization;
 const orgUrl = "https://dev.azure.com/" + orgName;
 const domainsManager = new DomainsManager(argv.domains);
 export const enabledDomains = domainsManager.getEnabledDomains();
-function getAzureDevOpsClient(getAzureDevOpsToken, userAgentComposer) {
+function getAzureDevOpsClient(getAzureDevOpsToken, userAgentComposer, authType) {
     return async () => {
         const accessToken = await getAzureDevOpsToken();
-        const authHandler = getBearerHandler(accessToken);
+        // For pat, accessToken is base64("{email}:{token}"). Decode to extract the token part,
+        // since getPersonalAccessTokenHandler prepends ":" internally and just needs the raw token.
+        const authHandler = authType === "pat" ? getPersonalAccessTokenHandler(Buffer.from(accessToken, "base64").toString("utf8").split(":").slice(1).join(":")) : getBearerHandler(accessToken);
         const connection = new WebApi(orgUrl, authHandler, undefined, {
             productName: "AzureDevOps.MCP",
             productVersion: packageVersion,
@@ -93,9 +95,25 @@ async function main() {
     };
     const tenantId = (await getOrgTenant(orgName)) ?? argv.tenant;
     const authenticator = createAuthenticator(argv.authentication, tenantId);
+    if (argv.authentication === "pat") {
+        const basicValue = await authenticator();
+        // basicValue is already base64("{email}:{token}") — use it directly in the Authorization header
+        const _originalFetch = globalThis.fetch;
+        globalThis.fetch = async (input, init) => {
+            if (init?.headers) {
+                const headers = new Headers(init.headers);
+                if (headers.get("Authorization")?.startsWith("Bearer ")) {
+                    headers.set("Authorization", `Basic ${basicValue}`);
+                    init = { ...init, headers };
+                }
+            }
+            return _originalFetch(input, init);
+        };
+        logger.debug("PAT mode: global fetch interceptor installed to rewrite Bearer -> Basic auth headers");
+    }
     // removing prompts untill further notice
     // configurePrompts(server);
-    configureAllTools(server, authenticator, getAzureDevOpsClient(authenticator, userAgentComposer), () => userAgentComposer.userAgent, enabledDomains);
+    configureAllTools(server, authenticator, getAzureDevOpsClient(authenticator, userAgentComposer, argv.authentication), () => userAgentComposer.userAgent, enabledDomains);
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }

package/dist/version.js

@@ -1 +1 @@
-export const packageVersion = "2.5.0-nightly.20260414";
+export const packageVersion = "2.5.0-nightly.20260415";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-devops/mcp",
-  "version": "2.5.0-nightly.20260414",
+  "version": "2.5.0-nightly.20260415",
   "mcpName": "microsoft.com/azure-devops",
   "description": "MCP server for interacting with Azure DevOps",
   "license": "MIT",
@@ -59,7 +59,7 @@
     "jest": "^30.0.2",
     "jest-extended": "^7.0.0",
     "lint-staged": "^16.2.7",
-    "prettier": "3.8.2",
+    "prettier": "3.8.3",
     "shx": "^0.4.0",
     "ts-jest": "^29.4.6",
     "tsconfig-paths": "^4.2.0",