@mcp-consultant-tools/azure-devops 24.0.0-beta.2 → 25.0.0-beta.4

package/build/index.js

@@ -38,6 +38,21 @@ export function registerAzureDevOpsTools(server, azuredevopsService) {
                 enableWorkItemWrite: process.env.AZUREDEVOPS_ENABLE_WORK_ITEM_WRITE === "true",
                 enableWorkItemDelete: process.env.AZUREDEVOPS_ENABLE_WORK_ITEM_DELETE === "true",
                 enableWikiWrite: process.env.AZUREDEVOPS_ENABLE_WIKI_WRITE === "true",
+                // DevOps Admin Tools - Three-tier permission model
+                // Tier 1: Read-only (master switch)
+                showDevOpsAdminReadonly: process.env.AZUREDEVOPS_SHOW_DEVOPS_ADMIN_READONLY === "true",
+                // Tier 2: Upsert (create + update)
+                enablePipelineUpsert: process.env.AZUREDEVOPS_ENABLE_PIPELINE_UPSERT === "true",
+                enableServiceConnUpsert: process.env.AZUREDEVOPS_ENABLE_SERVICE_CONN_UPSERT === "true",
+                enableVariableGroupUpsert: process.env.AZUREDEVOPS_ENABLE_VARIABLE_GROUP_UPSERT === "true",
+                enableAgentPoolUpsert: process.env.AZUREDEVOPS_ENABLE_AGENT_POOL_UPSERT === "true",
+                enableEnvironmentUpsert: process.env.AZUREDEVOPS_ENABLE_ENVIRONMENT_UPSERT === "true",
+                // Tier 3: Delete/Disable (destructive operations)
+                enablePipelineDelete: process.env.AZUREDEVOPS_ENABLE_PIPELINE_DELETE === "true",
+                enableServiceConnDelete: process.env.AZUREDEVOPS_ENABLE_SERVICE_CONN_DELETE === "true",
+                enableVariableGroupDelete: process.env.AZUREDEVOPS_ENABLE_VARIABLE_GROUP_DELETE === "true",
+                enableAgentPoolDisable: process.env.AZUREDEVOPS_ENABLE_AGENT_POOL_DISABLE === "true",
+                enableEnvironmentDelete: process.env.AZUREDEVOPS_ENABLE_ENVIRONMENT_DELETE === "true",
             };
             service = new AzureDevOpsService(config);
             console.error("Azure DevOps service initialized");
@@ -778,7 +793,837 @@ export function registerAzureDevOpsTools(server, azuredevopsService) {
             };
         }
     });
-    console.error("azure-devops tools registered: 15 tools, 4 prompts");
+    // ========================================
+    // DEVOPS ADMIN TOOLS - CONDITIONAL REGISTRATION
+    // Tools are only registered when corresponding flags are enabled
+    // ========================================
+    // Helper to check if admin readonly is enabled (master switch)
+    const showAdminReadonly = process.env.AZUREDEVOPS_SHOW_DEVOPS_ADMIN_READONLY === "true";
+    // Tier 2: Upsert flags
+    const enablePipelineUpsert = process.env.AZUREDEVOPS_ENABLE_PIPELINE_UPSERT === "true";
+    const enableServiceConnUpsert = process.env.AZUREDEVOPS_ENABLE_SERVICE_CONN_UPSERT === "true";
+    const enableVariableGroupUpsert = process.env.AZUREDEVOPS_ENABLE_VARIABLE_GROUP_UPSERT === "true";
+    const enableAgentPoolUpsert = process.env.AZUREDEVOPS_ENABLE_AGENT_POOL_UPSERT === "true";
+    const enableEnvironmentUpsert = process.env.AZUREDEVOPS_ENABLE_ENVIRONMENT_UPSERT === "true";
+    // Tier 3: Delete/Disable flags
+    const enablePipelineDelete = process.env.AZUREDEVOPS_ENABLE_PIPELINE_DELETE === "true";
+    const enableServiceConnDelete = process.env.AZUREDEVOPS_ENABLE_SERVICE_CONN_DELETE === "true";
+    const enableVariableGroupDelete = process.env.AZUREDEVOPS_ENABLE_VARIABLE_GROUP_DELETE === "true";
+    const enableAgentPoolDisable = process.env.AZUREDEVOPS_ENABLE_AGENT_POOL_DISABLE === "true";
+    const enableEnvironmentDelete = process.env.AZUREDEVOPS_ENABLE_ENVIRONMENT_DELETE === "true";
+    // Track registered tools count
+    let adminToolsCount = 0;
+    // ========================================
+    // PIPELINE READ-ONLY TOOLS (Tier 1)
+    // ========================================
+    if (showAdminReadonly) {
+        server.tool("list-pipelines", "List all YAML pipeline definitions in an Azure DevOps project. Returns pipeline ID, name, path, repository, and YAML file path.", {
+            project: z.string().describe("The project name"),
+        }, async ({ project }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.listPipelineDefinitions(project);
+                return { content: [{ type: "text", text: `Pipeline definitions in project '${project}':\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error listing pipelines:", error);
+                return { content: [{ type: "text", text: `Failed to list pipelines: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-pipeline-definition", "Get detailed YAML pipeline definition including triggers, variables (secrets masked), queue settings, and repository configuration.", {
+            project: z.string().describe("The project name"),
+            definitionId: z.number().describe("The pipeline definition ID"),
+        }, async ({ project, definitionId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getPipelineDefinition(project, definitionId);
+                return { content: [{ type: "text", text: `Pipeline definition ${definitionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting pipeline definition:", error);
+                return { content: [{ type: "text", text: `Failed to get pipeline definition: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-pipeline-yaml", "Get the YAML content for a pipeline definition. Returns the raw azure-pipelines.yml content.", {
+            project: z.string().describe("The project name"),
+            definitionId: z.number().describe("The pipeline definition ID"),
+        }, async ({ project, definitionId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getPipelineYaml(project, definitionId);
+                return { content: [{ type: "text", text: `Pipeline YAML for definition ${definitionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting pipeline YAML:", error);
+                return { content: [{ type: "text", text: `Failed to get pipeline YAML: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("list-pipeline-runs", "List recent pipeline runs for a definition. Returns build ID, status, result, branch, timestamps, and who triggered it.", {
+            project: z.string().describe("The project name"),
+            definitionId: z.number().describe("The pipeline definition ID"),
+            top: z.number().optional().describe("Maximum number of results (default: 10)"),
+        }, async ({ project, definitionId, top }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.listPipelineRuns(project, definitionId, top || 10);
+                return { content: [{ type: "text", text: `Recent runs for pipeline ${definitionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error listing pipeline runs:", error);
+                return { content: [{ type: "text", text: `Failed to list pipeline runs: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-build-status", "Get build status and details. Use detail='summary' for basic status, 'timeline' to include step breakdown, or 'full' for logs.", {
+            project: z.string().describe("The project name"),
+            buildId: z.number().describe("The build ID"),
+            detail: z.enum(["summary", "timeline", "full"]).optional().describe("Level of detail: 'summary' (default), 'timeline' (include steps), or 'full' (include logs)"),
+        }, async ({ project, buildId, detail }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getBuildStatus(project, buildId, detail || 'summary');
+                return { content: [{ type: "text", text: `Build ${buildId} status:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting build status:", error);
+                return { content: [{ type: "text", text: `Failed to get build status: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-build-timeline", "Get step-by-step breakdown of a build. Shows stages, jobs, and tasks with timing, status, and error/warning counts. NOTE: For complex builds, consider using a sub-agent to analyze the timeline data.", {
+            project: z.string().describe("The project name"),
+            buildId: z.number().describe("The build ID"),
+        }, async ({ project, buildId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getBuildTimeline(project, buildId);
+                return { content: [{ type: "text", text: `Build ${buildId} timeline:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting build timeline:", error);
+                return { content: [{ type: "text", text: `Failed to get build timeline: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-build-logs", "Get build logs. Without logId, returns list of available logs with line counts. With logId, returns that log's content. NOTE: For verbose logs, consider using a sub-agent to analyze the content.", {
+            project: z.string().describe("The project name"),
+            buildId: z.number().describe("The build ID"),
+            logId: z.number().optional().describe("Optional specific log ID to retrieve content"),
+        }, async ({ project, buildId, logId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getBuildLogs(project, buildId, logId);
+                return { content: [{ type: "text", text: `Build ${buildId} logs:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting build logs:", error);
+                return { content: [{ type: "text", text: `Failed to get build logs: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        // ========================================
+        // SERVICE CONNECTION READ-ONLY TOOLS (Tier 1)
+        // ========================================
+        server.tool("list-service-connections", "List all service connections in a project. Shows connection type, URL, authorization scheme, and sharing status. Credentials are masked.", {
+            project: z.string().describe("The project name"),
+        }, async ({ project }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.listServiceConnections(project);
+                return { content: [{ type: "text", text: `Service connections in project '${project}':\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error listing service connections:", error);
+                return { content: [{ type: "text", text: `Failed to list service connections: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-service-connection", "Get detailed service connection configuration. Returns type, URL, authorization scheme, data fields, and project references. Secrets are masked.", {
+            project: z.string().describe("The project name"),
+            connectionId: z.string().describe("The service connection ID (GUID)"),
+        }, async ({ project, connectionId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getServiceConnection(project, connectionId);
+                return { content: [{ type: "text", text: `Service connection ${connectionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting service connection:", error);
+                return { content: [{ type: "text", text: `Failed to get service connection: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-service-connection-types", "Get all available service connection types (Azure, AWS, Docker, GitHub, etc.) with their authentication schemes and configuration options.", {}, async () => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getServiceConnectionTypes();
+                return { content: [{ type: "text", text: `Available service connection types:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting service connection types:", error);
+                return { content: [{ type: "text", text: `Failed to get service connection types: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        // ========================================
+        // AGENT POOL READ-ONLY TOOLS (Tier 1)
+        // ========================================
+        server.tool("list-agent-pools", "List all agent pools in the organization. Shows pool type (automation/deployment), size, hosted status, and auto-provision settings.", {
+            poolType: z.enum(["automation", "deployment"]).optional().describe("Optional filter: 'automation' or 'deployment'"),
+        }, async ({ poolType }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.listAgentPools(poolType);
+                return { content: [{ type: "text", text: `Agent pools:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error listing agent pools:", error);
+                return { content: [{ type: "text", text: `Failed to list agent pools: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-agent-pool", "Get detailed agent pool configuration including auto-provision, auto-update, auto-size settings, and owner information.", {
+            poolId: z.number().describe("The agent pool ID"),
+        }, async ({ poolId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getAgentPool(poolId);
+                return { content: [{ type: "text", text: `Agent pool ${poolId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting agent pool:", error);
+                return { content: [{ type: "text", text: `Failed to get agent pool: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("list-agents", "List all agents in a pool. Shows agent name, version, OS, enabled status, and current status (online/offline).", {
+            poolId: z.number().describe("The agent pool ID"),
+            includeCapabilities: z.boolean().optional().describe("Include system and user capabilities (default: false)"),
+        }, async ({ poolId, includeCapabilities }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.listAgents(poolId, includeCapabilities || false);
+                return { content: [{ type: "text", text: `Agents in pool ${poolId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error listing agents:", error);
+                return { content: [{ type: "text", text: `Failed to list agents: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-agent", "Get detailed agent information including capabilities, current assignment, and last completed request.", {
+            poolId: z.number().describe("The agent pool ID"),
+            agentId: z.number().describe("The agent ID"),
+        }, async ({ poolId, agentId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getAgent(poolId, agentId);
+                return { content: [{ type: "text", text: `Agent ${agentId} in pool ${poolId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting agent:", error);
+                return { content: [{ type: "text", text: `Failed to get agent: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        // ========================================
+        // ENVIRONMENT READ-ONLY TOOLS (Tier 1)
+        // ========================================
+        server.tool("list-environments", "List all deployment environments in a project. Shows environment name, description, and modification info.", {
+            project: z.string().describe("The project name"),
+        }, async ({ project }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.listEnvironments(project);
+                return { content: [{ type: "text", text: `Environments in project '${project}':\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error listing environments:", error);
+                return { content: [{ type: "text", text: `Failed to list environments: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-environment", "Get detailed environment configuration including associated resources (Kubernetes, VMs, etc.).", {
+            project: z.string().describe("The project name"),
+            environmentId: z.number().describe("The environment ID"),
+        }, async ({ project, environmentId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getEnvironment(project, environmentId);
+                return { content: [{ type: "text", text: `Environment ${environmentId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting environment:", error);
+                return { content: [{ type: "text", text: `Failed to get environment: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-environment-deployments", "Get deployment history for an environment. Shows pipeline, owner, start/finish times, and result.", {
+            project: z.string().describe("The project name"),
+            environmentId: z.number().describe("The environment ID"),
+            top: z.number().optional().describe("Maximum number of results (default: 10)"),
+        }, async ({ project, environmentId, top }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getEnvironmentDeployments(project, environmentId, top || 10);
+                return { content: [{ type: "text", text: `Deployments to environment ${environmentId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting environment deployments:", error);
+                return { content: [{ type: "text", text: `Failed to get environment deployments: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("get-environment-checks", "Get all checks (approvals, business hours, branch control, etc.) configured for an environment. Essential for understanding pipeline approval requirements.", {
+            project: z.string().describe("The project name"),
+            environmentId: z.number().describe("The environment ID"),
+        }, async ({ project, environmentId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.getEnvironmentChecks(project, environmentId);
+                return { content: [{ type: "text", text: `Checks for environment ${environmentId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error getting environment checks:", error);
+                return { content: [{ type: "text", text: `Failed to get environment checks: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // PIPELINE UPSERT TOOLS (Tier 2)
+    // ========================================
+    if (enablePipelineUpsert) {
+        server.tool("admin-create-pipeline", "Create a new YAML pipeline definition. Requires repository ID and path to YAML file. (requires AZUREDEVOPS_ENABLE_PIPELINE_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            name: z.string().describe("Pipeline name"),
+            repositoryId: z.string().describe("Repository ID (GUID from get-repos or Azure DevOps UI)"),
+            yamlPath: z.string().describe("Path to YAML file in repository (e.g., 'azure-pipelines.yml' or 'pipelines/build.yml')"),
+            folder: z.string().optional().describe("Optional folder path (default: root)"),
+        }, async ({ project, name, repositoryId, yamlPath, folder }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.createPipelineDefinition(project, name, repositoryId, yamlPath, folder);
+                return { content: [{ type: "text", text: `Created pipeline '${name}':\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error creating pipeline:", error);
+                return { content: [{ type: "text", text: `Failed to create pipeline: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-update-pipeline", "Update a pipeline definition (name, path, queue status, triggers, or variables). (requires AZUREDEVOPS_ENABLE_PIPELINE_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            definitionId: z.number().describe("The pipeline definition ID"),
+            name: z.string().optional().describe("New pipeline name"),
+            path: z.string().optional().describe("New folder path"),
+            queueStatus: z.enum(["enabled", "disabled", "paused"]).optional().describe("Queue status"),
+            variables: z.record(z.object({
+                value: z.string(),
+                isSecret: z.boolean().optional(),
+                allowOverride: z.boolean().optional()
+            })).optional().describe("Pipeline variables to set"),
+        }, async ({ project, definitionId, name, path, queueStatus, variables }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const updates = {};
+                if (name)
+                    updates.name = name;
+                if (path)
+                    updates.path = path;
+                if (queueStatus)
+                    updates.queueStatus = queueStatus;
+                if (variables)
+                    updates.variables = variables;
+                const result = await service.updatePipelineDefinition(project, definitionId, updates);
+                return { content: [{ type: "text", text: `Updated pipeline ${definitionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error updating pipeline:", error);
+                return { content: [{ type: "text", text: `Failed to update pipeline: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-rename-pipeline", "Rename a pipeline definition. (requires AZUREDEVOPS_ENABLE_PIPELINE_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            definitionId: z.number().describe("The pipeline definition ID"),
+            newName: z.string().describe("The new pipeline name"),
+        }, async ({ project, definitionId, newName }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.renamePipelineDefinition(project, definitionId, newName);
+                return { content: [{ type: "text", text: `Renamed pipeline ${definitionId} to '${newName}':\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error renaming pipeline:", error);
+                return { content: [{ type: "text", text: `Failed to rename pipeline: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-queue-build", "Queue a new pipeline build/run. Optionally specify branch, variables, or template parameters. (requires AZUREDEVOPS_ENABLE_PIPELINE_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            definitionId: z.number().describe("The pipeline definition ID"),
+            branch: z.string().optional().describe("Source branch (e.g., 'refs/heads/main')"),
+            variables: z.record(z.string()).optional().describe("Runtime variables to pass"),
+            parameters: z.record(z.any()).optional().describe("Template parameters for YAML pipelines"),
+        }, async ({ project, definitionId, branch, variables, parameters }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.queueBuild(project, definitionId, branch, variables, parameters);
+                return { content: [{ type: "text", text: `Queued build for pipeline ${definitionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error queuing build:", error);
+                return { content: [{ type: "text", text: `Failed to queue build: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-cancel-build", "Cancel a running build. The build will finish its current task before stopping. (requires AZUREDEVOPS_ENABLE_PIPELINE_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            buildId: z.number().describe("The build ID to cancel"),
+        }, async ({ project, buildId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.cancelBuild(project, buildId);
+                return { content: [{ type: "text", text: `Cancelled build ${buildId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error cancelling build:", error);
+                return { content: [{ type: "text", text: `Failed to cancel build: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-retry-build", "Retry a failed build with the same configuration. Creates a new build with same definition, branch, and parameters. (requires AZUREDEVOPS_ENABLE_PIPELINE_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            buildId: z.number().describe("The failed build ID to retry"),
+        }, async ({ project, buildId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.retryBuild(project, buildId);
+                return { content: [{ type: "text", text: `Retried build ${buildId}, new build:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error retrying build:", error);
+                return { content: [{ type: "text", text: `Failed to retry build: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // PIPELINE DELETE TOOLS (Tier 3)
+    // ========================================
+    if (enablePipelineDelete) {
+        server.tool("admin-delete-pipeline", "⚠️ DESTRUCTIVE: Delete a pipeline definition. This cannot be undone. (requires AZUREDEVOPS_ENABLE_PIPELINE_DELETE=true)", {
+            project: z.string().describe("The project name"),
+            definitionId: z.number().describe("The pipeline definition ID to delete"),
+        }, async ({ project, definitionId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.deletePipelineDefinition(project, definitionId);
+                return { content: [{ type: "text", text: `Deleted pipeline ${definitionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error deleting pipeline:", error);
+                return { content: [{ type: "text", text: `Failed to delete pipeline: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // SERVICE CONNECTION UPSERT TOOLS (Tier 2)
+    // ========================================
+    if (enableServiceConnUpsert) {
+        server.tool("admin-create-service-connection", "Create a new service connection. Use get-service-connection-types to see available types and auth schemes. (requires AZUREDEVOPS_ENABLE_SERVICE_CONN_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            name: z.string().describe("Connection name"),
+            type: z.string().describe("Connection type (e.g., 'azurerm', 'github', 'docker', 'aws')"),
+            url: z.string().optional().describe("Service URL (required for some types)"),
+            description: z.string().optional().describe("Connection description"),
+            authorization: z.object({
+                scheme: z.string().describe("Auth scheme (e.g., 'ServicePrincipal', 'PersonalAccessToken')"),
+                parameters: z.record(z.string()).optional().describe("Auth parameters (credentials)")
+            }).optional().describe("Authorization configuration"),
+            data: z.record(z.string()).optional().describe("Type-specific configuration data"),
+        }, async ({ project, name, type, url, description, authorization, data }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.createServiceConnection(project, name, type, { url, description, authorization, data });
+                return { content: [{ type: "text", text: `Created service connection '${name}':\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error creating service connection:", error);
+                return { content: [{ type: "text", text: `Failed to create service connection: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-update-service-connection", "Update a service connection's metadata (name, description, URL, data). Cannot update credentials for security. (requires AZUREDEVOPS_ENABLE_SERVICE_CONN_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            connectionId: z.string().describe("The service connection ID (GUID)"),
+            name: z.string().optional().describe("New connection name"),
+            description: z.string().optional().describe("New description"),
+            url: z.string().optional().describe("New service URL"),
+            data: z.record(z.string()).optional().describe("Updated data fields"),
+        }, async ({ project, connectionId, name, description, url, data }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const updates = {};
+                if (name)
+                    updates.name = name;
+                if (description)
+                    updates.description = description;
+                if (url)
+                    updates.url = url;
+                if (data)
+                    updates.data = data;
+                const result = await service.updateServiceConnection(project, connectionId, updates);
+                return { content: [{ type: "text", text: `Updated service connection ${connectionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error updating service connection:", error);
+                return { content: [{ type: "text", text: `Failed to update service connection: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-share-service-connection", "Share a service connection with other projects. (requires AZUREDEVOPS_ENABLE_SERVICE_CONN_UPSERT=true)", {
+            connectionId: z.string().describe("The service connection ID (GUID)"),
+            projectIds: z.array(z.string()).describe("Array of project IDs to share with"),
+        }, async ({ connectionId, projectIds }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.shareServiceConnection(connectionId, projectIds);
+                return { content: [{ type: "text", text: `Shared service connection ${connectionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error sharing service connection:", error);
+                return { content: [{ type: "text", text: `Failed to share service connection: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // SERVICE CONNECTION DELETE TOOLS (Tier 3)
+    // ========================================
+    if (enableServiceConnDelete) {
+        server.tool("admin-delete-service-connection", "⚠️ DESTRUCTIVE: Delete a service connection. Pipelines using this connection will fail. (requires AZUREDEVOPS_ENABLE_SERVICE_CONN_DELETE=true)", {
+            project: z.string().describe("The project name"),
+            connectionId: z.string().describe("The service connection ID (GUID) to delete"),
+        }, async ({ project, connectionId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.deleteServiceConnection(project, connectionId);
+                return { content: [{ type: "text", text: `Deleted service connection ${connectionId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error deleting service connection:", error);
+                return { content: [{ type: "text", text: `Failed to delete service connection: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // VARIABLE GROUP UPSERT TOOLS (Tier 2)
+    // ========================================
+    if (enableVariableGroupUpsert) {
+        server.tool("admin-create-variable-group", "Create a new variable group. Variables can be marked as secret. (requires AZUREDEVOPS_ENABLE_VARIABLE_GROUP_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            name: z.string().describe("Variable group name"),
+            description: z.string().optional().describe("Variable group description"),
+            variables: z.record(z.object({
+                value: z.string(),
+                isSecret: z.boolean().optional()
+            })).optional().describe("Initial variables to set"),
+        }, async ({ project, name, description, variables }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.createVariableGroup(project, name, description, variables);
+                return { content: [{ type: "text", text: `Created variable group '${name}':\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error creating variable group:", error);
+                return { content: [{ type: "text", text: `Failed to create variable group: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-update-variable-group", "Update a variable group's name or description. Use admin-set-variable to modify variables. (requires AZUREDEVOPS_ENABLE_VARIABLE_GROUP_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            groupId: z.number().describe("The variable group ID"),
+            name: z.string().optional().describe("New name"),
+            description: z.string().optional().describe("New description"),
+        }, async ({ project, groupId, name, description }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const updates = {};
+                if (name)
+                    updates.name = name;
+                if (description)
+                    updates.description = description;
+                const result = await service.updateVariableGroupMetadata(project, groupId, updates);
+                return { content: [{ type: "text", text: `Updated variable group ${groupId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error updating variable group:", error);
+                return { content: [{ type: "text", text: `Failed to update variable group: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-set-variable", "Set or update a variable in a variable group. Creates the variable if it doesn't exist. (requires AZUREDEVOPS_ENABLE_VARIABLE_GROUP_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            groupId: z.number().describe("The variable group ID"),
+            variableName: z.string().describe("Variable name"),
+            value: z.string().describe("Variable value"),
+            isSecret: z.boolean().optional().describe("Mark as secret (default: false)"),
+        }, async ({ project, groupId, variableName, value, isSecret }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.setVariable(project, groupId, variableName, value, isSecret || false);
+                return { content: [{ type: "text", text: `Set variable '${variableName}' in group ${groupId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error setting variable:", error);
+                return { content: [{ type: "text", text: `Failed to set variable: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // VARIABLE GROUP DELETE TOOLS (Tier 3)
+    // ========================================
+    if (enableVariableGroupDelete) {
+        server.tool("admin-remove-variable", "Remove a variable from a variable group. (requires AZUREDEVOPS_ENABLE_VARIABLE_GROUP_DELETE=true)", {
+            project: z.string().describe("The project name"),
+            groupId: z.number().describe("The variable group ID"),
+            variableName: z.string().describe("Variable name to remove"),
+        }, async ({ project, groupId, variableName }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.removeVariable(project, groupId, variableName);
+                return { content: [{ type: "text", text: `Removed variable '${variableName}' from group ${groupId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error removing variable:", error);
+                return { content: [{ type: "text", text: `Failed to remove variable: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-delete-variable-group", "⚠️ DESTRUCTIVE: Delete a variable group. Pipelines using this group will fail. (requires AZUREDEVOPS_ENABLE_VARIABLE_GROUP_DELETE=true)", {
+            project: z.string().describe("The project name"),
+            groupId: z.number().describe("The variable group ID to delete"),
+        }, async ({ project, groupId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.deleteVariableGroup(project, groupId);
+                return { content: [{ type: "text", text: `Deleted variable group ${groupId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error deleting variable group:", error);
+                return { content: [{ type: "text", text: `Failed to delete variable group: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // AGENT POOL UPSERT TOOLS (Tier 2)
+    // ========================================
+    if (enableAgentPoolUpsert) {
+        server.tool("admin-update-agent-pool", "Update agent pool settings (auto-provision, auto-update, auto-size, target size). (requires AZUREDEVOPS_ENABLE_AGENT_POOL_UPSERT=true)", {
+            poolId: z.number().describe("The agent pool ID"),
+            autoProvision: z.boolean().optional().describe("Auto-provision pool to new projects"),
+            autoUpdate: z.boolean().optional().describe("Auto-update agents"),
+            autoSize: z.boolean().optional().describe("Auto-size pool based on demand"),
+            targetSize: z.number().optional().describe("Target pool size for auto-scaling"),
+        }, async ({ poolId, autoProvision, autoUpdate, autoSize, targetSize }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const updates = {};
+                if (autoProvision !== undefined)
+                    updates.autoProvision = autoProvision;
+                if (autoUpdate !== undefined)
+                    updates.autoUpdate = autoUpdate;
+                if (autoSize !== undefined)
+                    updates.autoSize = autoSize;
+                if (targetSize !== undefined)
+                    updates.targetSize = targetSize;
+                const result = await service.updateAgentPool(poolId, updates);
+                return { content: [{ type: "text", text: `Updated agent pool ${poolId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error updating agent pool:", error);
+                return { content: [{ type: "text", text: `Failed to update agent pool: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-enable-agent", "Enable a disabled agent to accept new jobs. (requires AZUREDEVOPS_ENABLE_AGENT_POOL_UPSERT=true)", {
+            poolId: z.number().describe("The agent pool ID"),
+            agentId: z.number().describe("The agent ID"),
+        }, async ({ poolId, agentId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.enableAgent(poolId, agentId);
+                return { content: [{ type: "text", text: `Enabled agent ${agentId} in pool ${poolId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error enabling agent:", error);
+                return { content: [{ type: "text", text: `Failed to enable agent: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // AGENT POOL DISABLE TOOLS (Tier 3)
+    // ========================================
+    if (enableAgentPoolDisable) {
+        server.tool("admin-disable-agent", "⚠️ Disable an agent. It will complete current job then stop accepting new jobs. (requires AZUREDEVOPS_ENABLE_AGENT_POOL_DISABLE=true)", {
+            poolId: z.number().describe("The agent pool ID"),
+            agentId: z.number().describe("The agent ID to disable"),
+        }, async ({ poolId, agentId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.disableAgent(poolId, agentId);
+                return { content: [{ type: "text", text: `Disabled agent ${agentId} in pool ${poolId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error disabling agent:", error);
+                return { content: [{ type: "text", text: `Failed to disable agent: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // ENVIRONMENT UPSERT TOOLS (Tier 2)
+    // ========================================
+    if (enableEnvironmentUpsert) {
+        server.tool("admin-create-environment", "Create a new deployment environment. (requires AZUREDEVOPS_ENABLE_ENVIRONMENT_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            name: z.string().describe("Environment name"),
+            description: z.string().optional().describe("Environment description"),
+        }, async ({ project, name, description }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.createEnvironment(project, name, description);
+                return { content: [{ type: "text", text: `Created environment '${name}':\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error creating environment:", error);
+                return { content: [{ type: "text", text: `Failed to create environment: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-update-environment", "Update an environment's name or description. (requires AZUREDEVOPS_ENABLE_ENVIRONMENT_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            environmentId: z.number().describe("The environment ID"),
+            name: z.string().optional().describe("New name"),
+            description: z.string().optional().describe("New description"),
+        }, async ({ project, environmentId, name, description }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const updates = {};
+                if (name)
+                    updates.name = name;
+                if (description)
+                    updates.description = description;
+                const result = await service.updateEnvironment(project, environmentId, updates);
+                return { content: [{ type: "text", text: `Updated environment ${environmentId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error updating environment:", error);
+                return { content: [{ type: "text", text: `Failed to update environment: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-create-environment-check", "Add an approval, business hours, branch control, or other check to an environment. Supports all Azure DevOps check types. (requires AZUREDEVOPS_ENABLE_ENVIRONMENT_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            environmentId: z.number().describe("The environment ID"),
+            checkType: z.enum([
+                "Approval",
+                "BusinessHours",
+                "BranchControl",
+                "InvokeRESTAPI",
+                "InvokeAzureFunction",
+                "ExclusiveLock",
+                "RequiredTemplate"
+            ]).describe("Check type"),
+            settings: z.any().describe("Check-specific settings. For Approval: {approvers: [{id: 'user-guid'}], minRequiredApprovers: 1, instructions: '...'}. For BusinessHours: {businessHours: {startTime: '09:00', endTime: '17:00', timeZoneId: 'UTC'}}. For BranchControl: {allowedBranches: ['refs/heads/main']}"),
+            timeout: z.number().optional().describe("Timeout in minutes (default: 43200 = 30 days)"),
+        }, async ({ project, environmentId, checkType, settings, timeout }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const configuration = { ...settings };
+                if (timeout)
+                    configuration.timeout = timeout;
+                const result = await service.addEnvironmentCheck(project, environmentId, checkType, configuration);
+                return { content: [{ type: "text", text: `Created ${checkType} check on environment ${environmentId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error creating environment check:", error);
+                return { content: [{ type: "text", text: `Failed to create environment check: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-update-environment-check", "Update an existing environment check's settings or timeout. (requires AZUREDEVOPS_ENABLE_ENVIRONMENT_UPSERT=true)", {
+            project: z.string().describe("The project name"),
+            checkId: z.number().describe("The check configuration ID to update"),
+            settings: z.any().optional().describe("Updated check-specific settings"),
+            timeout: z.number().optional().describe("Updated timeout in minutes"),
+        }, async ({ project, checkId, settings, timeout }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const updates = {};
+                if (settings !== undefined)
+                    updates.settings = settings;
+                if (timeout !== undefined)
+                    updates.timeout = timeout;
+                const result = await service.updateEnvironmentCheck(project, checkId, updates);
+                return { content: [{ type: "text", text: `Updated check ${checkId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error updating environment check:", error);
+                return { content: [{ type: "text", text: `Failed to update environment check: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // ========================================
+    // ENVIRONMENT DELETE TOOLS (Tier 3)
+    // ========================================
+    if (enableEnvironmentDelete) {
+        server.tool("admin-delete-environment", "⚠️ DESTRUCTIVE: Delete a deployment environment. Pipelines targeting this environment will fail. (requires AZUREDEVOPS_ENABLE_ENVIRONMENT_DELETE=true)", {
+            project: z.string().describe("The project name"),
+            environmentId: z.number().describe("The environment ID to delete"),
+        }, async ({ project, environmentId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.deleteEnvironment(project, environmentId);
+                return { content: [{ type: "text", text: `Deleted environment ${environmentId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error deleting environment:", error);
+                return { content: [{ type: "text", text: `Failed to delete environment: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+        server.tool("admin-delete-environment-check", "Delete an approval, business hours, branch control, or other check from an environment. (requires AZUREDEVOPS_ENABLE_ENVIRONMENT_DELETE=true)", {
+            project: z.string().describe("The project name"),
+            checkId: z.number().describe("The check configuration ID to delete (get from get-environment-checks)"),
+        }, async ({ project, checkId }) => {
+            try {
+                const service = getAzureDevOpsService();
+                const result = await service.removeEnvironmentCheck(project, checkId);
+                return { content: [{ type: "text", text: `Deleted check ${checkId}:\n\n${JSON.stringify(result, null, 2)}` }] };
+            }
+            catch (error) {
+                console.error("Error deleting environment check:", error);
+                return { content: [{ type: "text", text: `Failed to delete environment check: ${error.message}` }] };
+            }
+        });
+        adminToolsCount++;
+    }
+    // Log registration summary
+    const baseToolsCount = 15;
+    const totalToolsCount = baseToolsCount + adminToolsCount;
+    console.error(`azure-devops tools registered: ${totalToolsCount} tools (${baseToolsCount} base + ${adminToolsCount} admin), 4 prompts`);
 }
 /**
  * Export service class for direct usage