query_work_items · Azure DevOps MCP Server MCP

WHAT IT DOES

What query_work_items does on Azure DevOps MCP Server

AI agents invoke query_work_items to trigger actions in Azure DevOps MCP Server. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why query_work_items needs a policy

The tool executes arbitrary WIQL queries, which is an Execute-category action. While read-only WIQL queries are common, WIQL can potentially be used to perform complex operations and the tool's open-ended nature (arbitrary query execution) elevates it above a simple Read. The blast radius is medium since it primarily retrieves data but could expose sensitive project/work item information if misused.

From the tool's definition "Execute a WIQL query against Azure DevOps work items" — the word 'Execute' and 'query' indicate running arbitrary WIQL (Work Item Query Language) statements against Azure DevOps.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

query_work_items Rate-limited

query_work_items stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "query_work_items": {
      "limits": [
        {
          "counter": "query_work_items_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Azure DevOps MCP Server, so you can run agents against it safely.

FAQ

Questions about query_work_items

What does the query_work_items tool do? +

Execute a WIQL query against Azure DevOps work items. It is categorised as a Execute tool in the Azure DevOps MCP Server MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on query_work_items? +

Register the Azure DevOps MCP Server MCP server in PolicyLayer and add a rule for query_work_items: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Azure DevOps MCP Server. Nothing to install.

What risk level is query_work_items? +

query_work_items is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit query_work_items? +

Yes. Add a rate_limit block to the query_work_items rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block query_work_items completely? +

Set action: deny in the PolicyLayer policy for query_work_items. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides query_work_items? +

query_work_items is provided by the Azure DevOps MCP Server MCP server (saktheeswar/azure_devops_mcp_server). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.