@azure-devops/mcp

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    23:  */
    24: export const logger = winston.createLogger({
>>> 25:     level: process.env.LOG_LEVEL || "info",
    26:     format: winston.format.combine(winston.format.timestamp(), winston.format.errors({ stack: true }), winston.format.json()),
    27:     transports: [

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    3: import winston from "winston";
    4: import { setLogLevel } from "@azure/logger";
>>> 5: const logLevel = process.env.LOG_LEVEL?.toLowerCase();
    6: if (logLevel && ["verbose", "debug", "info", "warning", "error"].includes(logLevel)) {
    7:     // Map Winston log levels to Azure log levels

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    89:             if (type !== "env") {
    90:                 logger.debug(`${type}: Setting AZURE_TOKEN_CREDENTIALS to 'dev' for development credential chain`);
>>> 91:                 process.env.AZURE_TOKEN_CREDENTIALS = "dev";
    92:             }
    93:             let credential = new DefaultAzureCredential(); // CodeQL [SM05138] resolved by explicitly setting AZURE_TOKEN_CREDENTIALS

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    77:             return async () => {
    78:                 logger.debug(`${type}: Reading token from ADO_MCP_AUTH_TOKEN environment variable`);
>>> 79:                 const token = process.env["ADO_MCP_AUTH_TOKEN"];
    80:                 if (!token) {
    81:                     logger.error(`${type}: ADO_MCP_AUTH_TOKEN environment variable is not set or empty`);

Zero-width character detected (potential hidden content)

Detected by automated pattern matching (rule OB-004) with medium confidence. May be a false positive.

    172: For best practices and tips to enhance your experience with the MCP Server, refer to the [How-To guide](./docs/HOWTO.md).
    173: 
>>> 174: ## 🙋‍♀️ Frequently Asked Questions
    175: 
    176: For answers to common questions about the Azure DevOps MCP Server, see the [Frequently Asked Questions](./docs/FAQ.md).

Environment file access

Detected by automated pattern matching (rule DE-002) with medium confidence. May be a false positive.

    16: import { DomainsManager } from "./shared/domains.js";
    17: function isGitHubCodespaceEnv() {
>>> 18:     return process.env.CODESPACES === "true" && !!process.env.CODESPACE_NAME;
    19: }
    20: const defaultAuthenticationType = isGitHubCodespaceEnv() ? "azcli" : "interactive";

Zero-width character detected (potential hidden content)

Detected by automated pattern matching (rule OB-004) with medium confidence. May be a false positive.

    17: 6. [📝 Troubleshooting](#-troubleshooting)
    18: 7. [🎩 Examples & Best Practices](#-examples--best-practices)
>>> 19: 8. [🙋‍♀️ Frequently Asked Questions](#️-frequently-asked-questions)
    20: 9. [📌 Contributing](#-contributing)
    21: 

Decoded base64 content: ��@��� ������

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: u����b��-�g)�)쵩e

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: u����b��-�g)�)쵩e

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ����M2 $�E1

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: u����b��-�g)�)쵩e

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: u����b��-�g)�)쵩e

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r��nZ ���۟�����)���nr)�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ����M2 $�E1

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ����{� �^���xI�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ����{� �^���xI�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ����{� �^���xI�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��ܢ{^���r�������'

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��@��� ������

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: J�b�'���ӭ�즊�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Dynamic code execution via exec()

Detected by automated pattern matching (rule SC-003) with medium confidence. May be a false positive.

    65:     const toolsObjectPattern = /const\s+\w*[Tt][Oo][Oo][Ll][Ss]?\s*=\s*\{([^}]+)\}/g;
    66:     let toolsMatch;
>>> 67:     while ((toolsMatch = toolsObjectPattern.exec(fileContent)) !== null) {
    68:         const objectContent = toolsMatch[1];
    69:         // Now extract individual tool definitions from within the object

Dynamic code execution via exec()

Detected by automated pattern matching (rule SC-003) with medium confidence. May be a false positive.

    70:         const toolPattern = /^\s*[a-zA-Z_][a-zA-Z0-9_]*:\s*"([^"]+)"/gm;
    71:         let match;
>>> 72:         while ((match = toolPattern.exec(objectContent)) !== null) {
    73:             toolNames.push(match[1]);
    74:         }

Dynamic code execution via exec()

Detected by automated pattern matching (rule SC-003) with medium confidence. May be a false positive.

    86:     const paramPattern = /^\s*([a-zA-Z_][a-zA-Z0-9_]*)\s*:\s*z\./gm;
    87:     let match;
>>> 88:     while ((match = paramPattern.exec(fileContent)) !== null) {
    89:         paramNames.push(match[1]);
    90:     }

Decoded base64 content: ��+b�t.z���׫

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��+b�t.z���׫

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �w%�׀�S뢗��'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �w%�׀�S뢗��'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��+b�t.z���׫

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �w%�׀�S뢗��'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��+b�t.z���׫

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��+b�t.z���׫

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �w%�׀�S뢗��'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �w%�׀�S뢗��'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��+b�t.z���׫

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �w%�׀�S뢗��'�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r������b��ڭ��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r������b��ڭ��

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: j���{^���z�Ɗ�'���iǬ

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r�ߊ�y'���S��l

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: }�\�*&n)�u��[l

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: }�\�*&n)�u��[l

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: r�ߊ�y'���S��l

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �k��)b��bzWl��j�̉�貇�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �:�g���b��z۩

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: �:�g���b��z۩

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: zw(u�h�f���Uj[�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��Ai�%�޽�V����

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: zw(u�h�f���Uj[�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��eE�z�O���r�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��eE�z�O���r�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��eE�z�O���r�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��eE�z�O���r�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: ��eE�z�O���r�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: zw(u�h�f���Uj[�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

Decoded base64 content: zw(u�h�f���Uj[�

Detected by automated pattern matching (rule DO-BAS) with medium confidence. May be a false positive.

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    298:             state: safeEnumConvert(StageUpdateType, status),
    299:         };
>>> 300:         const response = await fetch(endpoint, {
    301:             method: "PATCH",
    302:             headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    113:             }
    114:             const url = `${baseUrl}/${project}/_apis/wiki/wikis/${wikiIdentifier}/pages?${params.toString()}`;
>>> 115:             const response = await fetch(url, {
    116:                 headers: {
    117:                     "Authorization": `Bearer ${accessToken}`,

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    175:                         const baseUrl = connection.serverUrl.replace(/\/$/, "");
    176:                         const restUrl = `${baseUrl}/${resolvedProject}/_apis/wiki/wikis/${resolvedWiki}/pages/${parsed.pageId}?includeContent=true&api-version=7.1`;
>>> 177:                         const resp = await fetch(restUrl, {
    178:                             headers: {
    179:                                 "Authorization": `Bearer ${accessToken}`,

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    240:             // First, try to create a new page (PUT without ETag)
    241:             try {
>>> 242:                 const createResponse = await fetch(url, {
    243:                     method: "PUT",
    244:                     headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    266:                     if (!currentEtag) {
    267:                         // Fetch current page to get ETag
>>> 268:                         const getResponse = await fetch(url, {
    269:                             method: "GET",
    270:                             headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    285:                     }
    286:                     // Now update the existing page with ETag
>>> 287:                     const updateResponse = await fetch(url, {
    288:                         method: "PUT",
    289:                         headers: {

High-entropy string (4.9 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    28:     const url = `https://vssps.dev.azure.com/${orgName}`;
    29:     try {
>>> 30:         const response = await fetch(url, { method: "HEAD" });
    31:         if (response.status !== 404) {
    32:             throw new Error(`Expected status 404, got ${response.status}`);

High-entropy string (4.6 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    42:             requestBody.filters = filters;
    43:         }
>>> 44:         const response = await fetch(url, {
    45:             method: "POST",
    46:             headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    86:             requestBody.filters = filters;
    87:         }
>>> 88:         const response = await fetch(url, {
    89:             method: "POST",
    90:             headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    6:     const url = `${connection.serverUrl}/_apis/connectionData`;
    7:     const token = await tokenProvider();
>>> 8:     const response = await fetch(url, {
    9:         method: "GET",
    10:         headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    33:         "filterValue": identity,
    34:     });
>>> 35:     const response = await fetch(`${baseUrl}?${params}`, {
    36:         headers: {
    37:             "Authorization": `Bearer ${token}`,

Possible Base64-encoded payload (long encoded string)

Detected by automated pattern matching (rule OB-001) with medium confidence. May be a false positive.

    212: ---
    213: 
>>> 214: _Trademarks: This project may include trademarks or logos for Microsoft or third parties. Use of Microsoft trademarks or logos must follow [Microsoft’s Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general). Third-party trademarks are subject to their respective policies._
    215: 
    216: <!-- version: 2023-04-07 [Do not delete this line, it is used for analytics that drive template improvements] -->

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    250:             state: safeEnumConvert(StageUpdateType, status),
    251:         };
>>> 252:         const response = await fetch(endpoint, {
    253:             method: "PATCH",
    254:             headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    136:             requestBody.filters = filters;
    137:         }
>>> 138:         const response = await fetch(url, {
    139:             method: "POST",
    140:             headers: {

High-entropy string (4.5 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    235:             };
    236:             const formatParameter = format === "markdown" ? 0 : 1;
>>> 237:             const response = await fetch(`${orgUrl}/${project}/_apis/wit/workItems/${workItemId}/comments?format=${formatParameter}&api-version=${markdownCommentsApiVersion}`, {
    238:                 method: "POST",
    239:                 headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    401:                 };
    402:             });
>>> 403:             const response = await fetch(`${orgUrl}/_apis/wit/$batch?api-version=${batchApiVersion}`, {
    404:                 method: "PATCH",
    405:                 headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    709:                 };
    710:             });
>>> 711:             const response = await fetch(`${orgUrl}/_apis/wit/$batch?api-version=${batchApiVersion}`, {
    712:                 method: "PATCH",
    713:                 headers: {

JavaScript fetch() call

Detected by automated pattern matching (rule NS-003) with medium confidence. May be a false positive.

    774:                 })),
    775:             }));
>>> 776:             const response = await fetch(`${orgUrl}/_apis/wit/$batch?api-version=${batchApiVersion}`, {
    777:                 method: "PATCH",
    778:                 headers: {

High-entropy string (4.7 bits/char) — possible encoded payload

Detected by automated pattern matching (rule EN-001) with medium confidence. May be a false positive.