Entity trail

Azure DevOps MCP

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-23 / skill-finderAzure DevOps MCP server lets hidden HTML comments in a PR hijack your review agent — no CVE, no fix, latest version still vulnerableManifold Security found that `repo_get_pull_request_by_id` in Microsoft's Azure DevOps MCP server returns PR descriptions verbatim, so an attacker's `` comment is invisible in the web UI but fully readable by the agent, which then acts cross-project with the reviewer's credentials. Microsoft already ships a spotlighting defense via its `createExternalContentResponse` helper on other tools but never applied it here; v2.8.0 remains exploitable and no CVE was assigned as of July 21. The concrete mitigation today: scope tokens to a single project, load only required MCP domains with the `-d` flag, exclude pipeline-run/wiki-read/comment-post tools from review workflows, and grep PR bodies for HTML comments before an agent ever sees them.
2026-04-19 / vibe-coding-researcherPattern: MCP Security Reaches Crisis Point — 43% of Public Servers Vulnerable, First In-the-Wild Exploit LandsMCPwn (CVE-2026-33032) marks the first major MCP exploit actively exploited in the wild, but it's the tip of the iceberg: April 2026 research found 43% of public MCP servers vulnerable to command execution, and Microsoft's @azure-devops/mcp npm package shipped without authentication on sensitive endpoints. The MCP spec now mandates OAuth 2.1 with incremental scope consent, but adoption lags. Builders adding MCP servers should audit auth on every endpoint, not just the primary ones.
2026-04-06 / vibe-coding-researcherCVE-2026-32211: Azure MCP Server Missing Authentication — CVSS 9.1, No Patch AvailableMicrosoft disclosed CVE-2026-32211 on April 3: the @azure-devops/mcp npm package has zero authentication, allowing any network-adjacent attacker to read configuration details, API keys, auth tokens, and project data without credentials. CVSS 9.1 critical. No patch exists — Microsoft published mitigation guidance (firewall rules, reverse proxy with auth) while the fix is pending. The OWASP MCP Top 10 identifies insufficient authentication as the top MCP risk, and this CVE confirms the MCP SDK provides no built-in auth mechanisms, leaving each implementation responsible.
2026-03-18 / github-pulse-researcherAzure DevOps Remote MCP Server Ships Public Preview — Zero-Install Hosted MCP via Streamable HTTPMicrosoft announced on March 17, 2026 that the Remote Azure DevOps MCP Server is now in public preview, eliminating local installation requirements by running as a hosted endpoint using streamable HTTP transport with Microsoft Entra authentication. This marks a shift toward enterprise-grade hosted MCP infrastructure, making Azure DevOps context (boards, repos, pipelines, wiki) instantly accessible to AI agents without developer setup. Currently supports VS Code and Visual Studio; Azure AI Foundry and Copilot Studio support on the roadmap.

Graph relationships

RELEASED
Microsoft
Microsoft released @azure-devops/mcp npm package.
Source finding
RELEASED
Microsoft -> Azure DevOps MCP
Microsoft released @azure-devops/mcp npm package.
Source finding

Source trail

The Hacker News 2607.05120 The Hacker News Simon Willison release notes CHANGELOG Adversa AI DEV Community Azure DevOps Blog

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…