@azure-devops/mcp 2.5.0-nightly.20260414 → 2.5.0-nightly.20260416

package/dist/auth.js

@@ -71,6 +71,19 @@ class OAuthAuthenticator {
 function createAuthenticator(type, tenantId) {
     logger.debug(`Creating authenticator of type '${type}' with tenantId='${tenantId ?? "undefined"}'`);
     switch (type) {
+        case "pat":
+            logger.debug(`Authenticator: Using PAT authentication (PERSONAL_ACCESS_TOKEN)`);
+            return async () => {
+                logger.debug(`${type}: Reading token from PERSONAL_ACCESS_TOKEN environment variable`);
+                const b64Pat = process.env["PERSONAL_ACCESS_TOKEN"];
+                if (!b64Pat) {
+                    logger.error(`${type}: PERSONAL_ACCESS_TOKEN environment variable is not set or empty`);
+                    throw new Error("Environment variable 'PERSONAL_ACCESS_TOKEN' is not set or empty. Please set it with a valid base64-encoded Azure DevOps Personal Access Token.");
+                }
+                // Return base64 value as-is — caller uses it directly as the Basic auth credential
+                logger.debug(`${type}: Successfully retrieved PAT from environment variable`);
+                return b64Pat;
+            };
         case "envvar":
             logger.debug(`Authenticator: Using environment variable authentication (ADO_MCP_AUTH_TOKEN)`);
             // Read token from fixed environment variable

package/dist/index.js

@@ -3,7 +3,7 @@
 // Licensed under the MIT License.
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { getBearerHandler, WebApi } from "azure-devops-node-api";
+import { getBearerHandler, getPersonalAccessTokenHandler, WebApi } from "azure-devops-node-api";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import { createAuthenticator } from "./auth.js";
@@ -41,7 +41,7 @@ const argv = yargs(hideBin(process.argv))
     alias: "a",
     describe: "Type of authentication to use",
     type: "string",
-    choices: ["interactive", "azcli", "env", "envvar"],
+    choices: ["interactive", "azcli", "env", "envvar", "pat"],
     default: defaultAuthenticationType,
 })
     .option("tenant", {
@@ -55,10 +55,12 @@ export const orgName = argv.organization;
 const orgUrl = "https://dev.azure.com/" + orgName;
 const domainsManager = new DomainsManager(argv.domains);
 export const enabledDomains = domainsManager.getEnabledDomains();
-function getAzureDevOpsClient(getAzureDevOpsToken, userAgentComposer) {
+function getAzureDevOpsClient(getAzureDevOpsToken, userAgentComposer, authType) {
     return async () => {
         const accessToken = await getAzureDevOpsToken();
-        const authHandler = getBearerHandler(accessToken);
+        // For pat, accessToken is base64("{email}:{token}"). Decode to extract the token part,
+        // since getPersonalAccessTokenHandler prepends ":" internally and just needs the raw token.
+        const authHandler = authType === "pat" ? getPersonalAccessTokenHandler(Buffer.from(accessToken, "base64").toString("utf8").split(":").slice(1).join(":")) : getBearerHandler(accessToken);
         const connection = new WebApi(orgUrl, authHandler, undefined, {
             productName: "AzureDevOps.MCP",
             productVersion: packageVersion,
@@ -93,9 +95,25 @@ async function main() {
     };
     const tenantId = (await getOrgTenant(orgName)) ?? argv.tenant;
     const authenticator = createAuthenticator(argv.authentication, tenantId);
+    if (argv.authentication === "pat") {
+        const basicValue = await authenticator();
+        // basicValue is already base64("{email}:{token}") — use it directly in the Authorization header
+        const _originalFetch = globalThis.fetch;
+        globalThis.fetch = async (input, init) => {
+            if (init?.headers) {
+                const headers = new Headers(init.headers);
+                if (headers.get("Authorization")?.startsWith("Bearer ")) {
+                    headers.set("Authorization", `Basic ${basicValue}`);
+                    init = { ...init, headers };
+                }
+            }
+            return _originalFetch(input, init);
+        };
+        logger.debug("PAT mode: global fetch interceptor installed to rewrite Bearer -> Basic auth headers");
+    }
     // removing prompts untill further notice
     // configurePrompts(server);
-    configureAllTools(server, authenticator, getAzureDevOpsClient(authenticator, userAgentComposer), () => userAgentComposer.userAgent, enabledDomains);
+    configureAllTools(server, authenticator, getAzureDevOpsClient(authenticator, userAgentComposer, argv.authentication), () => userAgentComposer.userAgent, enabledDomains);
     const transport = new StdioServerTransport();
     await server.connect(transport);
 }

package/dist/tools/work-items.js

@@ -293,7 +293,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
         project: z.string().optional().describe("The name or ID of the Azure DevOps project. Reuse from prior context if already known. If not provided, a project selection prompt will be shown."),
         workItemId: z.coerce.number().min(1).describe("The ID of the work item to add a comment to."),
         comment: z.string().describe("The text of the comment to add to the work item."),
-        format: z.enum(["markdown", "html"]).optional().default("html"),
+        format: z.enum(["Markdown", "Html"]).optional().default("Markdown").describe("The format of the comment text, e.g., 'Markdown', 'Html'. Optional, defaults to 'Markdown'."),
     }, async ({ project, workItemId, comment, format }) => {
         try {
             const connection = await connectionProvider();
@@ -309,7 +309,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             const body = {
                 text: comment,
             };
-            const formatParameter = format === "markdown" ? 0 : 1;
+            const formatParameter = (format ?? "Markdown") === "Markdown" ? 0 : 1;
             const response = await fetch(`${orgUrl}/${encodeURIComponent(resolvedProject)}/_apis/wit/workItems/${workItemId}/comments?format=${formatParameter}&api-version=${markdownCommentsApiVersion}`, {
                 method: "POST",
                 headers: {
@@ -340,7 +340,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
         workItemId: z.coerce.number().min(1).describe("The ID of the work item."),
         commentId: z.coerce.number().min(1).describe("The ID of the comment to update."),
         text: z.string().describe("The updated comment text."),
-        format: z.enum(["markdown", "html"]).optional().default("html"),
+        format: z.enum(["Markdown", "Html"]).optional().default("Markdown").describe("The format of the comment text, e.g., 'Markdown', 'Html'. Optional, defaults to 'Markdown'."),
     }, async ({ project, workItemId, commentId, text, format }) => {
         try {
             const connection = await connectionProvider();
@@ -354,7 +354,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             const orgUrl = connection.serverUrl;
             const accessToken = await tokenProvider();
             const body = { text };
-            const formatParameter = format === "markdown" ? 0 : 1;
+            const formatParameter = (format ?? "Markdown") === "Markdown" ? 0 : 1;
             const response = await fetch(`${orgUrl}/${encodeURIComponent(resolvedProject)}/_apis/wit/workItems/${workItemId}/comments/${commentId}?format=${formatParameter}&api-version=${markdownCommentsApiVersion}`, {
                 method: "PATCH",
                 headers: {
@@ -446,7 +446,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
         items: z.array(z.object({
             title: z.string().describe("The title of the child work item."),
             description: z.string().describe("The description of the child work item."),
-            format: z.enum(["Markdown", "Html"]).default("Html").describe("Format for the description on the child work item, e.g., 'Markdown', 'Html'. Defaults to 'Html'."),
+            format: z.enum(["Markdown", "Html"]).default("Markdown").describe("Format for the description on the child work item, e.g., 'Markdown', 'Html'. Defaults to 'Markdown'."),
             areaPath: z.string().optional().describe("Optional area path for the child work item."),
             iterationPath: z.string().optional().describe("Optional iteration path for the child work item."),
         })),
@@ -714,7 +714,7 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             .array(z.object({
             name: z.string().describe("The name of the field, e.g., 'System.Title'."),
             value: z.string().describe("The value of the field."),
-            format: z.enum(["Html", "Markdown"]).optional().describe("the format of the field value, e.g., 'Html', 'Markdown'. Optional, defaults to 'Html'."),
+            format: z.enum(["Html", "Markdown"]).optional().default("Markdown").describe("the format of the field value, e.g., 'Html', 'Markdown'. Optional, defaults to 'Markdown'."),
         }))
             .describe("A record of field names and values to set on the new work item. Each fild is the field name and each value is the corresponding value to set for that field."),
     }, async ({ project, workItemType, fields }) => {
@@ -835,7 +835,11 @@ function configureWorkItemTools(server, tokenProvider, connectionProvider, userA
             id: z.coerce.number().min(1).describe("The ID of the work item to update."),
             path: z.string().describe("The path of the field to update, e.g., '/fields/System.Title'."),
             value: z.string().describe("The new value for the field. This is required for 'add' and 'replace' operations, and should be omitted for 'remove' operations."),
-            format: z.enum(["Html", "Markdown"]).optional().describe("The format of the field value. Only to be used for large text fields. e.g., 'Html', 'Markdown'. Optional, defaults to 'Html'."),
+            format: z
+                .enum(["Html", "Markdown"])
+                .optional()
+                .default("Markdown")
+                .describe("The format of the field value. Only to be used for large text fields. e.g., 'Html', 'Markdown'. Optional, defaults to 'Markdown'."),
         }))
             .describe("An array of updates to apply to work items. Each update should include the operation (op), work item ID (id), field path (path), and new value (value)."),
     }, async ({ updates }) => {

package/dist/version.js

@@ -1 +1 @@
-export const packageVersion = "2.5.0-nightly.20260414";
+export const packageVersion = "2.5.0-nightly.20260416";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-devops/mcp",
-  "version": "2.5.0-nightly.20260414",
+  "version": "2.5.0-nightly.20260416",
   "mcpName": "microsoft.com/azure-devops",
   "description": "MCP server for interacting with Azure DevOps",
   "license": "MIT",
@@ -59,7 +59,7 @@
     "jest": "^30.0.2",
     "jest-extended": "^7.0.0",
     "lint-staged": "^16.2.7",
-    "prettier": "3.8.2",
+    "prettier": "3.8.3",
     "shx": "^0.4.0",
     "ts-jest": "^29.4.6",
     "tsconfig-paths": "^4.2.0",