@azure-devops/mcp 2.9.0-nightly.20260901 → 2.9.0-nightly.20260902

package/dist/shared/content-safety.js

@@ -1,6 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 import { randomBytes } from "crypto";
+const spotlightedResponse = Symbol("spotlightedResponse");
 /**
  * Applies Spotlighting (delimiting mode) to untrusted external content.
  * See: https://arxiv.org/pdf/2403.14720
@@ -20,5 +21,31 @@ export function spotlightContent(content, source) {
 export function createExternalContentResponse(content, source) {
     const serialized = typeof content === "string" ? content : JSON.stringify(content, null, 2);
     const spotlighted = spotlightContent(serialized, source);
-    return { content: [{ type: "text", text: spotlighted }] };
+    const response = { content: [{ type: "text", text: spotlighted }] };
+    response[spotlightedResponse] = true;
+    return response;
+}
+/**
+ * Applies Spotlighting to every textual content block in a tool response while
+ * preserving MCP metadata such as `isError` and `_meta`.
+ *
+ * The private symbol prevents responses created by createExternalContentResponse
+ * from being wrapped twice without trusting attacker-controlled marker text.
+ */
+export function wrapExternalToolResponse(response, source) {
+    const markedResponse = response;
+    if (markedResponse[spotlightedResponse])
+        return response;
+    const content = response.content.map((block) => {
+        if (block.type === "text") {
+            return { ...block, text: spotlightContent(block.text, source) };
+        }
+        if (block.type === "resource" && "text" in block.resource) {
+            return { ...block, resource: { ...block.resource, text: spotlightContent(block.resource.text, source) } };
+        }
+        return block;
+    });
+    const wrapped = { ...response, content };
+    wrapped[spotlightedResponse] = true;
+    return wrapped;
 }

package/dist/tools/repositories.js

@@ -579,11 +579,12 @@ function configureRepoTools(server, tokenProvider, connectionProvider, userAgent
         mergeCommitMessage: z.string().optional().describe("Commit message for autocomplete. Used for update."),
         deleteSourceBranch: z.boolean().optional().default(false).describe("Delete source branch on autocomplete. Used for update."),
         transitionWorkItems: z.boolean().optional().default(true).describe("Transition work items on autocomplete. Used for update."),
-        bypassReason: z.string().optional().describe("Reason for bypassing branch policies. Used for update."),
+        bypassPolicy: z.boolean().optional().default(false).describe("Explicitly bypass branch policies on autocomplete. Used for update and requires bypassReason when true."),
+        bypassReason: z.string().optional().describe("Reason for bypassing branch policies. Used for update only when bypassPolicy is true."),
         reviewerIds: z.array(z.string()).optional().describe("List of reviewer IDs. Required for update_reviewers."),
         reviewerAction: z.enum(["add", "remove"]).optional().describe("Whether to add or remove reviewers. Required for update_reviewers."),
         vote: z.enum(["Approved", "ApprovedWithSuggestions", "NoVote", "WaitingForAuthor", "Rejected"]).optional().describe("The vote to cast. Required for vote."),
-    }, async ({ action, repositoryId, pullRequestId, project, sourceRefName, targetRefName, title, description, isDraft, workItems, forkSourceRepositoryId, labels, status, autoComplete, mergeStrategy, mergeCommitMessage, deleteSourceBranch, transitionWorkItems, bypassReason, reviewerIds, reviewerAction, vote, }) => {
+    }, async ({ action, repositoryId, pullRequestId, project, sourceRefName, targetRefName, title, description, isDraft, workItems, forkSourceRepositoryId, labels, status, autoComplete, mergeStrategy, mergeCommitMessage, deleteSourceBranch, transitionWorkItems, bypassPolicy, bypassReason, reviewerIds, reviewerAction, vote, }) => {
         try {
             const connection = await connectionProvider();
             const gitApi = await connection.getGitApi();
@@ -633,18 +634,21 @@ function configureRepoTools(server, tokenProvider, connectionProvider, userAgent
                 }
                 if (autoComplete !== undefined) {
                     if (autoComplete) {
+                        if (bypassPolicy && !bypassReason) {
+                            return { content: [{ type: "text", text: "bypassReason is required when bypassPolicy is true" }], isError: true };
+                        }
                         const data = await getCurrentUserDetails(tokenProvider, connectionProvider, userAgentProvider);
                         updateRequest.autoCompleteSetBy = { id: data.authenticatedUser.id };
                         const completionOptions = {
                             deleteSourceBranch: deleteSourceBranch || false,
                             transitionWorkItems: transitionWorkItems !== false,
-                            bypassPolicy: !!bypassReason,
+                            bypassPolicy: bypassPolicy === true,
                         };
                         if (mergeStrategy)
                             completionOptions.mergeStrategy = GitPullRequestMergeStrategy[mergeStrategy];
                         if (mergeCommitMessage)
                             completionOptions.mergeCommitMessage = mergeCommitMessage;
-                        if (bypassReason)
+                        if (bypassPolicy && bypassReason)
                             completionOptions.bypassReason = bypassReason;
                         updateRequest.completionOptions = completionOptions;
                     }

package/dist/tools.js

@@ -1,5 +1,6 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
+import { wrapExternalToolResponse } from "./shared/content-safety.js";
 import { Domain } from "./shared/domains.js";
 import { configureAdvSecTools } from "./tools/advanced-security.js";
 import { configureMcpAppsTools } from "./tools/mcp-apps.js";
@@ -14,11 +15,13 @@ import { configureWorkItemTools } from "./tools/work-items.js";
 function configureAllTools(server, tokenProvider, connectionProvider, userAgentProvider, enabledDomains) {
     const configureIfDomainEnabled = (domain, configureFn) => {
         if (enabledDomains.has(domain)) {
-            configureFn();
+            configureToolsWithContentSafety(server, domain, configureFn);
         }
     };
     configureIfDomainEnabled(Domain.CORE, () => configureCoreTools(server, tokenProvider, connectionProvider, userAgentProvider));
-    configureIfDomainEnabled(Domain.MCP_APPS, () => configureMcpAppsTools(server));
+    // This is a local health-check response and contains no Azure DevOps content.
+    if (enabledDomains.has(Domain.MCP_APPS))
+        configureMcpAppsTools(server);
     configureIfDomainEnabled(Domain.WORK, () => configureWorkTools(server, tokenProvider, connectionProvider));
     configureIfDomainEnabled(Domain.PIPELINES, () => configurePipelineTools(server, tokenProvider, connectionProvider, userAgentProvider));
     configureIfDomainEnabled(Domain.REPOSITORIES, () => configureRepoTools(server, tokenProvider, connectionProvider, userAgentProvider));
@@ -28,4 +31,34 @@ function configureAllTools(server, tokenProvider, connectionProvider, userAgentP
     configureIfDomainEnabled(Domain.SEARCH, () => configureSearchTools(server, tokenProvider, connectionProvider, userAgentProvider));
     configureIfDomainEnabled(Domain.ADVANCED_SECURITY, () => configureAdvSecTools(server, tokenProvider, connectionProvider));
 }
+/**
+ * Centralizes the untrusted-content boundary for tool responses. Tool registration
+ * is synchronous, so the original method is restored before this function returns.
+ */
+function configureToolsWithContentSafety(server, domain, configureFn) {
+    const originalTool = server.tool;
+    const originalRegisterTool = server.registerTool;
+    const wrapRegistrationMethod = (registrationMethod) => new Proxy(registrationMethod, {
+        apply(target, thisArg, argumentsList) {
+            const callbackIndex = argumentsList.length - 1;
+            const callback = argumentsList[callbackIndex];
+            if (typeof callback === "function") {
+                argumentsList[callbackIndex] = async (...callbackArgs) => {
+                    const response = (await Reflect.apply(callback, undefined, callbackArgs));
+                    return wrapExternalToolResponse(response, `Azure DevOps ${domain}`);
+                };
+            }
+            return Reflect.apply(target, thisArg, argumentsList);
+        },
+    });
+    server.tool = wrapRegistrationMethod(originalTool);
+    server.registerTool = wrapRegistrationMethod(originalRegisterTool);
+    try {
+        configureFn();
+    }
+    finally {
+        server.tool = originalTool;
+        server.registerTool = originalRegisterTool;
+    }
+}
 export { configureAllTools };

package/dist/version.js

@@ -1 +1 @@
-export const packageVersion = "2.9.0-nightly.20260901";
+export const packageVersion = "2.9.0-nightly.20260902";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azure-devops/mcp",
-  "version": "2.9.0-nightly.20260901",
+  "version": "2.9.0-nightly.20260902",
   "mcpName": "microsoft.com/azure-devops",
   "description": "MCP server for interacting with Azure DevOps",
   "license": "MIT",