@sonyjv/azure-devops-mcp 2.9.0-onprem.1

package/LICENSE.md

@@ -0,0 +1,21 @@
+    MIT License
+
+    Copyright (c) Microsoft Corporation.
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE

package/README.md

@@ -0,0 +1,234 @@
+# Azure DevOps MCP Server
+
+> [!NOTE]
+> **This is a fork.** [sonyjv/azure-devops-mcp](https://github.com/sonyjv/azure-devops-mcp) is a personal fork of [microsoft/azure-devops-mcp](https://github.com/microsoft/azure-devops-mcp), the official Azure DevOps MCP Server. It adds support for connecting to an **on-premises Azure DevOps Server / TFS collection**, in addition to Azure DevOps Services (cloud) — see [Azure DevOps Server (On-Premises)](./docs/GETTINGSTARTED.md#azure-devops-server-on-premises).
+>
+> This fork is published to npm as [`@sonyjv/azure-devops-mcp`](https://www.npmjs.com/package/@sonyjv/azure-devops-mcp) (Microsoft's own `@azure-devops/mcp` name is upstream's) — run it with `npx -y @sonyjv/azure-devops-mcp`, no separate clone or build step needed. It is not intended to be merged upstream. See [Local MCP Server Installation](#local-mcp-server-installation-optional).
+
+> [!WARNING]
+> We recently completed a full tool consolidation that includes renaming of existing tools. Please see the [Toolset documentation](docs/TOOLSET.md) for the complete list of new tool names.
+
+This project gives AI agents access to Azure DevOps through the Model Context Protocol (MCP). Use the hosted remote server for the simplest setup, or run the local server when you need a `stdio` connection — or when you need on-premises Azure DevOps Server support, which the hosted remote server (below) does not provide.
+
+## Table of Contents
+
+> [!IMPORTANT]
+> If you're on Azure DevOps Services (cloud) and don't need on-premises support, Microsoft's [Remote MCP Server](https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server) requires no installation and gets new features first — see [Learn more](#remote-mcp-server-recommended). It does **not** support on-premises Azure DevOps Server, which is this fork's reason for existing — on-prem users need the local server below.
+
+1. [Overview](#overview)
+2. [Design](#design)
+3. [Remote MCP Server (Recommended)](#remote-mcp-server-recommended)
+4. [Supported Tools](#supported-tools)
+5. [Local MCP Server Installation (Optional)](#local-mcp-server-installation-optional)
+6. [Using Domains (Local Server)](#using-domains-local-server)
+7. [Project and Team Defaults (Local Server)](#project-and-team-defaults-local-server)
+8. [Troubleshooting](#troubleshooting)
+9. [Examples and Best Practices](#examples-and-best-practices)
+10. [Frequently Asked Questions](#frequently-asked-questions)
+11. [Contributing](#contributing)
+
+## Overview
+
+The Azure DevOps MCP Server brings Azure DevOps context to your agents. Try prompts like:
+
+- "List my ADO projects"
+- "List ADO Builds for 'Contoso'"
+- "List ADO Repos for 'Contoso'"
+- "List test plans for 'Contoso'"
+- "List teams for project 'Contoso'"
+- "List iterations for project 'Contoso'"
+- "List my work items for project 'Contoso'"
+- "List work items in current iteration for 'Contoso' project and 'Contoso Team'"
+- "List all wikis in the 'Contoso' project"
+- "Create a wiki page '/Architecture/Overview' with content about system design"
+- "Update the wiki page '/Getting Started' with new onboarding instructions"
+- "Get the content of the wiki page '/API/Authentication' from the Documentation wiki"
+
+## Design
+
+Each tool handles a focused Azure DevOps task. The server provides a thin layer over the REST APIs, while the AI agent handles higher-level reasoning.
+
+## Remote MCP Server (Recommended)
+
+For complete instructions, see the [Remote MCP Server onboarding documentation](https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops).
+
+The remote server will eventually replace the local server. The local server remains supported, but new development will focus on the remote server. Existing local server users should begin planning their migration.
+
+If you encounter issues with tools, need support, or have a feature request, you can report an issue using the [Remote MCP Server issue template](https://github.com/microsoft/azure-devops-mcp/issues/new?template=remote-mcp-server-issue.md). During the preview period, we will track Remote MCP Server issues through this repository.
+
+### Quick Start
+
+Create `.vscode/mcp.json` in your project and add this configuration. Replace `{organization}` with your Azure DevOps organization name.
+
+```json
+{
+  "servers": {
+    "ado-remote-mcp": {
+      "url": "https://mcp.dev.azure.com/{organization}",
+      "type": "http"
+    }
+  },
+  "inputs": []
+}
+```
+
+See the [remote server configuration documentation](https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops#mcpjson-configuration) for more options.
+
+After saving `.vscode/mcp.json`, start the server from the MCP view in VS Code, then run a prompt like `List ADO projects`.
+
+## Supported Tools
+
+See the [Available Tools](https://learn.microsoft.com/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops#available-tools) documentation for the complete list of available remote tools.
+
+For the complete list of local tools, see [TOOLSET.md](./docs/TOOLSET.md).
+
+## Local MCP Server Installation (Optional)
+
+> [!NOTE]
+> This fork publishes under its own package name, `@sonyjv/azure-devops-mcp` — `npx -y @azure-devops/mcp` (as documented for the [upstream project](https://github.com/microsoft/azure-devops-mcp)) installs Microsoft's original package, **not** this fork's on-premises support. `npx -y @sonyjv/azure-devops-mcp` works exactly like installing any published npm package — no clone or build step, and no local `git` needed. If you'd rather always track the unreleased `main` branch instead of a published version, `npx -y github:sonyjv/azure-devops-mcp` also works, though it needs `git` and direct network access to GitHub, which some locked-down/corporate networks block even when npm registry access works fine. Clone-and-build (see [Run from Source](./docs/GETTINGSTARTED.md#run-from-source)) is only needed if you're modifying the code yourself.
+
+These steps use Visual Studio Code and GitHub Copilot. For other supported clients, including Visual Studio 2022, Codex, Claude Code, Cursor, OpenCode, and Kilo Code, see the [getting started guide](./docs/GETTINGSTARTED.md). That guide also covers connecting to an on-premises Azure DevOps Server / TFS collection instead of Azure DevOps Services — see [Azure DevOps Server (On-Premises)](./docs/GETTINGSTARTED.md#azure-devops-server-on-premises).
+
+### Prerequisites
+
+1. Install [VS Code](https://code.visualstudio.com/download) or [VS Code Insiders](https://code.visualstudio.com/insiders).
+2. Install [Node.js 20 or later](https://nodejs.org/en/download).
+3. Open your project in VS Code.
+
+### Installation
+
+#### Install from npm
+
+1. Create `.vscode/mcp.json` in your project.
+2. Add this configuration:
+
+```json
+{
+  "inputs": [
+    {
+      "id": "ado_org",
+      "type": "promptString",
+      "description": "Azure DevOps organization name (e.g. 'contoso'), or a full on-premises collection URL (e.g. 'http://tfsserver:8080/tfs/DefaultCollection')"
+    }
+  ],
+  "servers": {
+    "ado": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@sonyjv/azure-devops-mcp", "${input:ado_org}"]
+    }
+  }
+}
+```
+
+3. Save the file, then start the `ado` server from the MCP view in VS Code.
+4. Open GitHub Copilot Chat and switch to [Agent mode](https://code.visualstudio.com/blogs/2025/02/24/introducing-copilot-agent-mode).
+5. Select the Azure DevOps tools, then try a prompt such as `List ADO projects`.
+6. When prompted, sign in with a Microsoft account that has access to the selected Azure DevOps organization (or configure PAT authentication for an on-premises server — see [Authentication](./docs/GETTINGSTARTED.md#authentication)).
+
+To pin to a specific released version instead of always resolving `latest`, replace `@sonyjv/azure-devops-mcp` with `@sonyjv/azure-devops-mcp@<version>` (see the [available versions](https://www.npmjs.com/package/@sonyjv/azure-devops-mcp?activeTab=versions)).
+
+For better tool selection, add `.github/copilot-instructions.md` to your project with this instruction:
+
+```text
+This project uses Azure DevOps. Always check whether the Azure DevOps MCP server has a tool relevant to the user's request.
+```
+
+## Using Domains (Local Server)
+
+The local server includes many tools. Domains let you load only the tool groups you need, which keeps the tool list manageable and helps clients with tool limits. Available domains are `core`, `work`, `work-items`, `search`, `test-plans`, `repositories`, `wiki`, `pipelines`, and `advanced-security`.
+
+Add `-d` followed by the domains to the server arguments. For example, this configuration loads only work item-related tools:
+
+```json
+{
+  "inputs": [
+    {
+      "id": "ado_org",
+      "type": "promptString",
+      "description": "Azure DevOps organization name  (e.g. 'contoso')"
+    }
+  ],
+  "servers": {
+    "ado_with_filtered_domains": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@sonyjv/azure-devops-mcp", "${input:ado_org}", "-d", "core", "work", "work-items"]
+    }
+  }
+}
+```
+
+Always include `core` so the agent can retrieve project information.
+
+> If you omit `-d`, the server loads all domains.
+
+## Project and Team Defaults (Local Server)
+
+Set default Azure DevOps project and team values in `.vscode/mcp.json` so tools can skip selection prompts.
+
+### Example `.vscode/mcp.json`
+
+```json
+{
+  "servers": {
+    "ado": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["-y", "@sonyjv/azure-devops-mcp", "myorg", "--authentication", "azcli"],
+      "env": {
+        "ado_mcp_project": "Contoso",
+        "ado_mcp_team": "Fabrikam Team"
+      }
+    }
+  }
+}
+```
+
+## Troubleshooting
+
+See the [Troubleshooting guide](./docs/TROUBLESHOOTING.md) for help with common issues and logging.
+
+## Examples
+
+See the [examples](./docs/EXAMPLES.md) for sample prompts.
+
+## Frequently Asked Questions
+
+For answers to common questions about the Azure DevOps MCP Server, see the [Frequently Asked Questions](./docs/FAQ.md).
+
+## Contributing
+
+We welcome contributions. During preview, file issues for bugs, enhancements, or documentation improvements.
+
+See our [Contributions Guide](./CONTRIBUTING.md) for:
+
+- Development setup
+- Adding new tools
+- Code style and testing
+- Pull request process
+
+Read the [Contributions Guide](./CONTRIBUTING.md) before creating a pull request.
+
+## Code of Conduct
+
+This project follows the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
+For questions, see the [FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [open@microsoft.com](mailto:open@microsoft.com).
+
+## Hall of Fame
+
+Thanks to all contributors who make this project awesome! ❤️
+
+[![Contributors](https://contrib.rocks/image?repo=microsoft/azure-devops-mcp)](https://github.com/microsoft/azure-devops-mcp/graphs/contributors)
+
+> Generated with [contrib.rocks](https://contrib.rocks)
+
+## License
+
+Licensed under the [MIT License](./LICENSE.md).
+
+---
+
+_Trademarks: This project may include trademarks or logos for Microsoft or third parties. Use of Microsoft trademarks or logos must follow [Microsoft’s Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general). Third-party trademarks are subject to their respective policies._
+
+<!-- version: 2023-04-07 [Do not delete this line, it is used for analytics that drive template improvements] -->

package/dist/auth.js

@@ -0,0 +1,205 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import { AzureCliCredential, ChainedTokenCredential, DefaultAzureCredential } from "@azure/identity";
+import { PublicClientApplication } from "@azure/msal-node";
+import { NativeBrokerPlugin } from "@azure/msal-node-extensions";
+import open from "open";
+import { logger } from "./logger.js";
+const scopes = ["499b84ac-1321-427f-aa17-267ca6975798/.default"];
+const patAllowedHosts = new Set(["dev.azure.com", "vssps.dev.azure.com", "almsearch.dev.azure.com"]);
+function isPatAllowedHost(hostname) {
+    const normalizedHostname = hostname.toLowerCase();
+    return patAllowedHosts.has(normalizedHostname) || normalizedHostname.endsWith(".visualstudio.com");
+}
+/**
+ * Installs a global fetch interceptor that rewrites the Bearer auth header to Basic
+ * for requests carrying the PAT.
+ *
+ * @param rawPat The raw (unencoded) Azure DevOps Personal Access Token.
+ * @param configuredHost Hostname of the Azure DevOps connection the user explicitly configured
+ * (e.g. via the CLI `organization` argument). Trusted in addition to the built-in cloud allow-list,
+ * and — unlike the cloud hosts — allowed over plain `http:` too, since on-premises Azure DevOps
+ * Server / TFS collections are frequently reached over an internal network without TLS.
+ */
+function installPatFetchInterceptor(rawPat, configuredHost) {
+    const originalFetch = globalThis.fetch;
+    const patBearerValue = `Bearer ${rawPat}`;
+    // HTTP Basic auth requires a username:password pair; Azure DevOps ignores the username for PAT
+    // auth, so "PAT" is just a placeholder — matching the literal value azure-devops-node-api's own
+    // PersonalAccessTokenCredentialHandler uses internally, for consistency with the requests it sends.
+    const basicAuthValue = Buffer.from(`PAT:${rawPat}`).toString("base64");
+    const normalizedConfiguredHost = configuredHost?.toLowerCase();
+    globalThis.fetch = async (input, init) => {
+        const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+        if (headers.get("Authorization") !== patBearerValue) {
+            return originalFetch(input, init);
+        }
+        const requestUrl = new URL(input instanceof Request ? input.url : input.toString());
+        const isConfiguredHost = normalizedConfiguredHost !== undefined && requestUrl.hostname.toLowerCase() === normalizedConfiguredHost;
+        const schemeAllowed = requestUrl.protocol === "https:" || (requestUrl.protocol === "http:" && isConfiguredHost);
+        if (!schemeAllowed || !(isPatAllowedHost(requestUrl.hostname) || isConfiguredHost)) {
+            throw new Error(`Refusing to send a Personal Access Token to untrusted destination '${requestUrl.origin}'`);
+        }
+        headers.set("Authorization", `Basic ${basicAuthValue}`);
+        if (input instanceof Request) {
+            return originalFetch(new Request(input, { ...init, headers }));
+        }
+        return originalFetch(input, { ...init, headers });
+    };
+}
+class OAuthAuthenticator {
+    static clientId = "0d50963b-7bb9-4fe7-94c7-a99af00b5136";
+    static defaultAuthority = "https://login.microsoftonline.com/common";
+    static zeroTenantId = "00000000-0000-0000-0000-000000000000";
+    accountId;
+    publicClientApp;
+    publicClientAppFallback;
+    constructor(tenantId) {
+        this.accountId = null;
+        let authority = OAuthAuthenticator.defaultAuthority;
+        if (tenantId && tenantId !== OAuthAuthenticator.zeroTenantId) {
+            authority = `https://login.microsoftonline.com/${tenantId}`;
+            logger.debug(`OAuthAuthenticator: Using tenant-specific authority for tenantId='${tenantId}'`);
+        }
+        else {
+            logger.debug(`OAuthAuthenticator: Using default common authority`);
+        }
+        this.publicClientApp = new PublicClientApplication({
+            auth: {
+                clientId: OAuthAuthenticator.clientId,
+                authority,
+            },
+            broker: {
+                nativeBrokerPlugin: new NativeBrokerPlugin(),
+            },
+            system: {
+                loggerOptions: {
+                    loggerCallback: (level, message) => {
+                        logger.debug(`MSALClient[${level}]: ${message}`);
+                    },
+                },
+            },
+        });
+        this.publicClientAppFallback = new PublicClientApplication({
+            auth: {
+                clientId: OAuthAuthenticator.clientId,
+                authority,
+            },
+        });
+        logger.debug(`OAuthAuthenticator: Initialized with clientId='${OAuthAuthenticator.clientId}'`);
+    }
+    async getToken() {
+        let authResult = null;
+        if (this.accountId) {
+            logger.debug(`OAuthAuthenticator: Attempting silent token acquisition for cached account`);
+            try {
+                authResult = await this.publicClientApp.acquireTokenSilent({
+                    scopes,
+                    account: this.accountId,
+                });
+                logger.debug(`OAuthAuthenticator: Successfully acquired token silently`);
+            }
+            catch (error) {
+                logger.debug(`OAuthAuthenticator: Silent token acquisition failed: ${error instanceof Error ? error.message : String(error)}`);
+                authResult = null;
+            }
+        }
+        else {
+            logger.debug(`OAuthAuthenticator: No cached account available, interactive auth required`);
+        }
+        if (!authResult) {
+            logger.debug(`OAuthAuthenticator: Starting interactive token acquisition`);
+            try {
+                authResult = await this.publicClientApp.acquireTokenInteractive({
+                    scopes,
+                    openBrowser: async (url) => {
+                        logger.debug(`OAuthAuthenticator: Opening browser for authentication with target URL: ${url}`);
+                        open(url);
+                    },
+                });
+                this.accountId = authResult.account;
+                logger.debug(`OAuthAuthenticator: Successfully acquired token interactively, account cached`);
+            }
+            catch (error) {
+                const msalErrorMessage = error.platformBrokerError ? JSON.stringify(error.platformBrokerError) : "";
+                logger.debug(`OAuthAuthenticator: Interactive token acquisition failed: ${error instanceof Error ? error.message + msalErrorMessage : String(error)}`);
+                authResult = null;
+            }
+        }
+        if (!authResult) {
+            logger.debug(`OAuthAuthenticator: Starting interactive token acquisition without broker`);
+            authResult = await this.publicClientAppFallback.acquireTokenInteractive({
+                scopes,
+                openBrowser: async (url) => {
+                    logger.debug(`OAuthAuthenticator: Opening browser for authentication with target URL: ${url}`);
+                    open(url);
+                },
+            });
+            logger.debug(`OAuthAuthenticator: Successfully acquired token interactively without broker`);
+        }
+        if (!authResult?.accessToken) {
+            logger.error(`OAuthAuthenticator: Authentication result contains no access token`);
+            throw new Error("Failed to obtain Azure DevOps OAuth token.");
+        }
+        logger.debug(`OAuthAuthenticator: Token obtained successfully`);
+        return authResult.accessToken;
+    }
+}
+function createAuthenticator(type, tenantId) {
+    logger.debug(`Creating authenticator of type '${type}' with tenantId='${tenantId ?? "undefined"}'`);
+    switch (type) {
+        case "pat":
+            logger.debug(`Authenticator: Using PAT authentication (PERSONAL_ACCESS_TOKEN)`);
+            return async () => {
+                logger.debug(`${type}: Reading token from PERSONAL_ACCESS_TOKEN environment variable`);
+                const rawPat = process.env["PERSONAL_ACCESS_TOKEN"];
+                if (!rawPat) {
+                    logger.error(`${type}: PERSONAL_ACCESS_TOKEN environment variable is not set or empty`);
+                    throw new Error("Environment variable 'PERSONAL_ACCESS_TOKEN' is not set or empty. Please set it to a valid Azure DevOps Personal Access Token.");
+                }
+                logger.debug(`${type}: Successfully retrieved PAT from environment variable`);
+                return rawPat;
+            };
+        case "envvar":
+            logger.debug(`Authenticator: Using environment variable authentication (ADO_MCP_AUTH_TOKEN)`);
+            // Read token from fixed environment variable
+            return async () => {
+                logger.debug(`${type}: Reading token from ADO_MCP_AUTH_TOKEN environment variable`);
+                const token = process.env["ADO_MCP_AUTH_TOKEN"];
+                if (!token) {
+                    logger.error(`${type}: ADO_MCP_AUTH_TOKEN environment variable is not set or empty`);
+                    throw new Error("Environment variable 'ADO_MCP_AUTH_TOKEN' is not set or empty. Please set it with a valid Azure DevOps Personal Access Token.");
+                }
+                logger.debug(`${type}: Successfully retrieved token from environment variable`);
+                return token;
+            };
+        case "azcli":
+        case "env":
+            if (type !== "env") {
+                logger.debug(`${type}: Setting AZURE_TOKEN_CREDENTIALS to 'dev' for development credential chain`);
+                process.env.AZURE_TOKEN_CREDENTIALS = "dev";
+            }
+            let credential = new DefaultAzureCredential(); // CodeQL [SM05138] resolved by explicitly setting AZURE_TOKEN_CREDENTIALS
+            if (tenantId) {
+                // Use Azure CLI credential if tenantId is provided for multi-tenant scenarios
+                const azureCliCredential = new AzureCliCredential({ tenantId });
+                credential = new ChainedTokenCredential(azureCliCredential, credential);
+            }
+            return async () => {
+                const result = await credential.getToken(scopes);
+                if (!result) {
+                    logger.error(`${type}: Failed to obtain token - credential.getToken returned null/undefined`);
+                    throw new Error("Failed to obtain Azure DevOps token. Ensure you have Azure CLI logged or use interactive type of authentication.");
+                }
+                logger.debug(`${type}: Successfully obtained Azure DevOps token`);
+                return result.token;
+            };
+        default:
+            logger.debug(`Authenticator: Using OAuth interactive authentication (default)`);
+            const authenticator = new OAuthAuthenticator(tenantId);
+            return () => {
+                return authenticator.getToken();
+            };
+    }
+}
+export { createAuthenticator, installPatFetchInterceptor };

package/dist/index.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { getBearerHandler, getPersonalAccessTokenHandler, WebApi } from "azure-devops-node-api";
+import yargs from "yargs";
+import { createAuthenticator, installPatFetchInterceptor } from "./auth.js";
+import { logger } from "./logger.js";
+import { getOrgTenant } from "./org-tenants.js";
+//import { configurePrompts } from "./prompts.js";
+import { configureAllTools } from "./tools.js";
+import { UserAgentComposer } from "./useragent.js";
+import { getCliArgs, resolveOrgUrl } from "./utils.js";
+import { packageVersion } from "./version.js";
+import { DomainsManager } from "./shared/domains.js";
+function isGitHubCodespaceEnv() {
+    return process.env.CODESPACES === "true" && !!process.env.CODESPACE_NAME;
+}
+const defaultAuthenticationType = isGitHubCodespaceEnv() ? "azcli" : "interactive";
+// Parse command line arguments using yargs
+const argv = yargs(getCliArgs())
+    .scriptName("mcp-server-azuredevops")
+    .usage("Usage: $0 <organization> [options]")
+    .version(packageVersion)
+    .command("$0 <organization> [options]", "Azure DevOps MCP Server", (yargs) => {
+    yargs.positional("organization", {
+        describe: "Azure DevOps organization name (e.g. 'contoso'), or a full base URL for on-premises Azure DevOps Server / TFS (e.g. 'http://tfsserver:8080/tfs/DefaultCollection')",
+        type: "string",
+        demandOption: true,
+    });
+})
+    .option("domains", {
+    alias: "d",
+    describe: "Domain(s) to enable: 'all' for everything, or specific domains like 'repositories builds work'. Defaults to 'all'.",
+    type: "string",
+    array: true,
+    default: "all",
+})
+    .option("authentication", {
+    alias: "a",
+    describe: "Type of authentication to use",
+    type: "string",
+    choices: ["interactive", "azcli", "env", "envvar", "pat"],
+    default: defaultAuthenticationType,
+})
+    .option("tenant", {
+    alias: "t",
+    describe: "Azure tenant ID (optional, applied when using 'interactive' and 'azcli' type of authentication)",
+    type: "string",
+})
+    .help()
+    .parseSync();
+const { orgUrl, cloudOrgName } = resolveOrgUrl(argv.organization);
+// Preserved for the handful of tools that still call fixed Azure DevOps Services
+// endpoints (e.g. code/wiki/work-item search) rather than the connected server's URL.
+// Those remain cloud-only; see docs/TOOLSET.md and README for the on-prem limitation.
+export const orgName = cloudOrgName ?? argv.organization;
+const domainsManager = new DomainsManager(argv.domains);
+export const enabledDomains = domainsManager.getEnabledDomains();
+function getAzureDevOpsClient(getAzureDevOpsToken, userAgentComposer, authType) {
+    return async () => {
+        const accessToken = await getAzureDevOpsToken();
+        const authHandler = authType === "pat" ? getPersonalAccessTokenHandler(accessToken) : getBearerHandler(accessToken);
+        const connection = new WebApi(orgUrl, authHandler, undefined, {
+            productName: "AzureDevOps.MCP",
+            productVersion: packageVersion,
+            userAgent: userAgentComposer.userAgent,
+        });
+        return connection;
+    };
+}
+async function main() {
+    logger.info("Starting Azure DevOps MCP Server", {
+        organization: orgName,
+        organizationUrl: orgUrl,
+        authentication: argv.authentication,
+        tenant: argv.tenant,
+        domains: argv.domains,
+        enabledDomains: Array.from(enabledDomains),
+        version: packageVersion,
+        isCodespace: isGitHubCodespaceEnv(),
+    });
+    const server = new McpServer({
+        name: "Azure DevOps MCP Server",
+        version: packageVersion,
+        icons: [
+            {
+                src: "https://cdn.vsassets.io/content/icons/favicon.ico",
+            },
+        ],
+    });
+    const userAgentComposer = new UserAgentComposer(packageVersion);
+    server.server.oninitialized = () => {
+        userAgentComposer.appendMcpClientInfo(server.server.getClientVersion());
+    };
+    if (!cloudOrgName && !["pat", "envvar"].includes(argv.authentication)) {
+        logger.warn(`Authentication type '${argv.authentication}' was requested against a non-Azure DevOps Services URL ('${orgUrl}'). Azure DevOps Server (on-premises) generally only supports 'pat' (or 'envvar') authentication.`);
+    }
+    const tenantId = argv.tenant ?? (cloudOrgName ? await getOrgTenant(cloudOrgName) : undefined);
+    const authenticator = createAuthenticator(argv.authentication, tenantId);
+    if (argv.authentication === "pat") {
+        const rawPat = await authenticator();
+        installPatFetchInterceptor(rawPat, new URL(orgUrl).hostname);
+        logger.debug("PAT mode: global fetch interceptor installed to rewrite Bearer -> Basic auth headers");
+    }
+    // removing prompts until further notice
+    // configurePrompts(server);
+    configureAllTools(server, authenticator, getAzureDevOpsClient(authenticator, userAgentComposer, argv.authentication), () => userAgentComposer.userAgent, enabledDomains);
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((error) => {
+    logger.error("Fatal error in main():", error);
+    process.exit(1);
+});

package/dist/logger.js

@@ -0,0 +1,34 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+import winston from "winston";
+import { setLogLevel } from "@azure/logger";
+const logLevel = process.env.LOG_LEVEL?.toLowerCase();
+if (logLevel && ["verbose", "debug", "info", "warning", "error"].includes(logLevel)) {
+    // Map Winston log levels to Azure log levels
+    const logLevelMap = {
+        verbose: "verbose",
+        debug: "info",
+        info: "info",
+        warning: "warning",
+        error: "error",
+    };
+    const azureLogLevel = logLevelMap[logLevel];
+    setLogLevel(azureLogLevel);
+}
+/**
+ * Logger utility for MCP server
+ *
+ * Since MCP servers use stdio transport for communication on stdout,
+ * we log to stderr to avoid interfering with the MCP protocol.
+ */
+export const logger = winston.createLogger({
+    level: process.env.LOG_LEVEL || "info",
+    format: winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json()),
+    transports: [
+        new winston.transports.Stream({
+            stream: process.stderr,
+        }),
+    ],
+    // Prevent Winston from exiting on error
+    exitOnError: false,
+});