// SCAN REPORT

Azure DevOps

84 tools. 29 can modify or destroy data without limits.

1 destructive tool with no built-in limits. Policy required.

Last updated:

29 can modify or destroy data
55 read-only
84 tools total
// TOOL MAP
Read (55) Write / Execute (28) Destructive / Financial (1)
// WHAT CAN GO WRONG
✕

Destructive tools (mcp_ado_wit_work_item_unlink) permanently delete resources. There is no undo. An agent calling these in a retry loop causes irreversible damage.

✕

Write operations (mcp_ado_pipelines_create_pipeline, mcp_ado_repo_create_branch, mcp_ado_repo_create_pull_request) modify state. Without rate limits, an agent can make hundreds of changes in seconds — faster than any human can review or revert.

✕

Execute tools (mcp_ado_pipelines_run_pipeline, mcp_ado_pipelines_update_build_stage) trigger processes with side effects. Builds, notifications, workflows — all fired without throttling.

One command. Full control.

Intercept sits between your agent and Azure DevOps. Every tool call checked against your policy before it executes — so your agent can do its job without breaking things.

npx -y @policylayer/intercept scan -- npx -y @@azure-devops/mcp
Scans every tool. Generates a policy. Starts enforcing.
Works with Claude Code · Cursor · Claude Desktop · Windsurf · any MCP client
// RECOMMENDED RULES
Deny destructive operations
mcp_ado_wit_work_item_unlink:
  rules:
    - action: deny

Destructive tools should never be available to autonomous agents without human approval.

Rate limit write operations
mcp_ado_pipelines_create_pipeline:
  rules:
    - rate_limit: 30/hour

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations
mcp_ado_advsec_get_alert_details:
  rules:
    - rate_limit: 60/minute

Controls API costs and prevents retry loops from exhausting upstream rate limits.

// ALL 84 AZURE DEVOPS TOOLS
DESTRUCTIVE 1 tools
Destructive mcp_ado_wit_work_item_unlink
EXECUTE 2 tools
Execute mcp_ado_pipelines_run_pipeline Execute mcp_ado_pipelines_update_build_stage
WRITE 26 tools
Write mcp_ado_pipelines_create_pipeline Write mcp_ado_repo_create_branch Write mcp_ado_repo_create_pull_request Write mcp_ado_repo_create_pull_request_thread Write mcp_ado_repo_reply_to_comment Write mcp_ado_repo_update_pull_request Write mcp_ado_repo_update_pull_request_reviewers Write mcp_ado_repo_update_pull_request_thread Write mcp_ado_repo_vote_pull_request Write mcp_ado_testplan_add_test_cases_to_suite Write mcp_ado_testplan_create_test_case Write mcp_ado_testplan_create_test_plan Write mcp_ado_testplan_create_test_suite Write mcp_ado_testplan_update_test_case_steps Write mcp_ado_wiki_create_or_update_page Write mcp_ado_wit_add_artifact_link Write mcp_ado_wit_add_child_work_items Write mcp_ado_wit_add_work_item_comment Write mcp_ado_wit_create_work_item Write mcp_ado_wit_link_work_item_to_pull_request Write mcp_ado_wit_update_work_item Write mcp_ado_wit_update_work_items_batch Write mcp_ado_wit_work_items_link Write mcp_ado_work_assign_iterations Write mcp_ado_work_create_iterations Write mcp_ado_work_update_team_capacity
READ 55 tools
Read mcp_ado_advsec_get_alert_details Read mcp_ado_advsec_get_alerts Read mcp_ado_core_get_identity_ids Read mcp_ado_core_list_project_teams Read mcp_ado_core_list_projects Read mcp_ado_pipelines_download_artifact Read mcp_ado_pipelines_get_build_changes Read mcp_ado_pipelines_get_build_definition_revisions Read mcp_ado_pipelines_get_build_definitions Read mcp_ado_pipelines_get_build_log Read mcp_ado_pipelines_get_build_log_by_id Read mcp_ado_pipelines_get_build_status Read mcp_ado_pipelines_get_builds Read mcp_ado_pipelines_get_run Read mcp_ado_pipelines_list_artifacts Read mcp_ado_pipelines_list_runs Read mcp_ado_repo_get_branch_by_name Read mcp_ado_repo_get_pull_request_by_id Read mcp_ado_repo_get_repo_by_name_or_id Read mcp_ado_repo_list_branches_by_repo Read mcp_ado_repo_list_directory Read mcp_ado_repo_list_my_branches_by_repo Read mcp_ado_repo_list_pull_request_thread_comments Read mcp_ado_repo_list_pull_request_threads Read mcp_ado_repo_list_pull_requests_by_commits Read mcp_ado_repo_list_pull_requests_by_repo_or_project Read mcp_ado_repo_list_repos_by_project Read mcp_ado_repo_search_commits Read mcp_ado_search_code Read mcp_ado_search_wiki Read mcp_ado_search_workitem Read mcp_ado_testplan_list_test_cases Read mcp_ado_testplan_list_test_plans Read mcp_ado_testplan_list_test_suites Read mcp_ado_testplan_show_test_results_from_build_id Read mcp_ado_wiki_get_page Read mcp_ado_wiki_get_page_content Read mcp_ado_wiki_get_wiki Read mcp_ado_wiki_list_pages Read mcp_ado_wiki_list_wikis Read mcp_ado_wit_get_query Read mcp_ado_wit_get_query_results_by_id Read mcp_ado_wit_get_work_item Read mcp_ado_wit_get_work_item_type Read mcp_ado_wit_get_work_items_batch_by_ids Read mcp_ado_wit_get_work_items_for_iteration Read mcp_ado_wit_list_backlog_work_items Read mcp_ado_wit_list_backlogs Read mcp_ado_wit_list_work_item_comments Read mcp_ado_wit_list_work_item_revisions Read mcp_ado_wit_my_work_items Read mcp_ado_work_get_iteration_capacities Read mcp_ado_work_get_team_capacity Read mcp_ado_work_list_iterations Read mcp_ado_work_list_team_iterations
// FAQ
Can an AI agent delete data through the Azure DevOps MCP server? +

Yes. The Azure DevOps server exposes 1 destructive tools including mcp_ado_wit_work_item_unlink. These permanently remove resources with no undo. Intercept blocks destructive tools by default so they never reach the upstream server.

How do I prevent bulk modifications through Azure DevOps? +

The Azure DevOps server has 26 write tools including mcp_ado_pipelines_create_pipeline, mcp_ado_repo_create_branch, mcp_ado_repo_create_pull_request. Set rate limits in your policy file -- for example, rate_limit: 10/hour prevents an agent from making more than 10 modifications per hour. Intercept enforces this at the transport layer.

How many tools does the Azure DevOps MCP server expose? +

84 tools across 4 categories: Destructive, Execute, Read, Write. 55 are read-only. 29 can modify, create, or delete data.

How do I add Intercept to my Azure DevOps setup? +

One line change. Instead of running the Azure DevOps server directly, prefix it with Intercept: intercept -c azure-devops.yaml -- npx -y @@@azure-devops/mcp. Download a pre-built policy from policylayer.com/policies/azure-devops and adjust the limits to match your use case.

// RELATED SERVERS

Other MCP servers with similar tools.

Starter policies available for each. Same risk classification, same one-command setup.

Mcp Api 310 tools
adminautomation
Aibtc 288 tools
adminautomation
Google Super 200 tools
adminautomation
Propresenter 177 tools
adminautomation
Leaper Vision Toolkit 169 tools
adminautomation
Apiosk 160 tools
adminautomation
Mcp Sitecore 153 tools
adminautomation
SmartBear MCP 147 tools
adminautomation
policylayer/intercept

Control every MCP tool call
your agent makes.

Set budgets, approvals, and hard limits across MCP servers.

npx -y @policylayer/intercept init
Protect your agent in 30 seconds. Scans your MCP config and generates enforcement policies for every server.
// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.