Feature Request: Add support for on-premise Azure DevOps Server / TFS

[ahouben]

Summary

Add on-premises Azure DevOps Server / TFS support while preserving existing cloud behavior.

Motivation

Currently, the Microsoft Azure DevOps MCP server only supports Azure DevOps Services (cloud) by hardcoding the organization URL to https://dev.azure.com/{org}. Many enterprises use on-premises installations of Azure DevOps Server or TFS and cannot use this MCP server.

This work is based on and inspired by @MShipleyDP's work in #648 and PR 647 which unfortunately was rejected with "closed as not planned" and after many similar requests (#76, #78, #98, #473, #574, #666, #869) a clear statement was explicitly added to the FAQ.

In this issue comment @danhellem mentions some reasons why on-premises support receives so little love:

1. extra overhead to maintain
2. server is behind on some of the newer API's that we use
3. would need to change authentication methods

@danhellem Is there anything that would change your mind (e.g. cookies, chocolate 😊) ? Any advice on alternate ways to connect on-premises instances to GenAI tools ?

Changes

• Auto-detects cloud vs. on-prem from the organization argument and centralizes deployment context in server-context.
• Supports PAT-based auth via AZURE_DEVOPS_PAT, including correct Basic auth headers for raw REST calls.
• Routes identity and search APIs correctly for on-prem instances instead of cloud-only endpoints.
• Adds optional SSL bypass for internal/self-signed cert environments via AZURE_DEVOPS_IGNORE_SSL_ERRORS.
• Returns friendly “not supported on-premises” errors for Advanced Security APIs.
• Improves compatibility for wiki, auth, repo filtering, and empty test plan suite responses.
• Updates tests and README with on-prem verification coverage.

Installation

The following patched Azure DevOps MCP Servers with on-premises support are available as:

• @ahouben/azure-devops-mcp: derived from the currently latest HEAD
• @ahouben/azure-devops-mcp@2.4-latest: derived from the currently latest published 2.4.0 version

The artifacts were published using npm's Trusted Publishing for proper supply-chain security, e.g. Publish Package workflow action.

Add the appropriate version to your mcp configuration, e.g. for Adding MCP Servers to GitHub Copilot CLI to your ~/.copilot/mcp-config.json:

{
  "mcpServers": {
    "ado-on-prem": {
      "type": "stdio",
      "command": "npx",
      "tools": [
        "*"
      ],
      "args": [
        "-y",
        "@ahouben/azure-devops-mcp@2.4-latest",
        "https://tfs.company.com/DefaultCollection",
	"-a",
	"env"
      ],
      "env": {
        "AZURE_DEVOPS_PAT": "<PAT>",
        "AZURE_DEVOPS_IGNORE_SSL_ERRORS": "true"
      }
    }
  }
}

Testing

• ✅ Successfully system-level tested (read-only operations only) with a fairly recent version of an on-premises Azure DevOps Server instance
• ✅ All existing unit tests pass (15 test suites, 682 test cases)
• ✅ Backward compatible with cloud configurations
• ✅ PAT authentication working
• ✅ Self-signed certificate support working

System-level test results

Legend: ✅ Pass · ⏭️ Skipped (write op or n/a) · 🚫 Not supported on-premises (by design)

Core & Work

#	Tool	Result	Notes
1	core_list_projects	✅
2	core_list_project_teams	✅
3	core_get_identity_ids	✅
4	work_list_iterations	✅
5	work_list_team_iterations	✅
6	work_get_team_capacity	✅
7	work_get_iteration_capacities	✅
8	work_create_iterations	⏭️	Write — not run
9	work_assign_iterations	⏭️	Write — not run
10	work_update_team_capacity	⏭️	Write — not run

Pipelines

#	Tool	Result	Notes
11	pipelines_get_build_definitions	✅
12	pipelines_get_builds	✅
13	pipelines_get_build_status	✅
14	pipelines_get_build_changes	✅
15	pipelines_get_build_log	✅
16	pipelines_get_build_log_by_id	✅
17	pipelines_get_build_definition_revisions	✅
18	pipelines_list_runs	✅
19	pipelines_get_run	✅
20	pipelines_run_pipeline	⏭️	Write — not run
21	pipelines_update_build_stage	⏭️	Write — not run

Repositories

#	Tool	Result	Notes
22	repo_list_repos_by_project	✅
23	repo_get_repo_by_name_or_id	✅
24	repo_list_branches_by_repo	✅
25	repo_list_my_branches_by_repo	✅
26	repo_get_branch_by_name	✅
27	repo_list_pull_requests_by_repo_or_project	✅
28	repo_get_pull_request_by_id	✅
29	repo_list_pull_request_threads	✅
30	repo_list_pull_request_thread_comments	✅
31	repo_search_commits	✅
32	repo_list_pull_requests_by_commits	✅
33	repo_create_branch	⏭️	Write — not run
34	repo_create_pull_request	⏭️	Write — not run
35	repo_update_pull_request	⏭️	Write — not run
36	repo_update_pull_request_reviewers	⏭️	Write — not run
37	repo_reply_to_comment	⏭️	Write — not run
38	repo_create_pull_request_thread	⏭️	Write — not run
39	repo_update_pull_request_thread	⏭️	Write — not run

Search

#	Tool	Result	Notes
40	search_code	✅
41	search_wiki	✅
42	search_workitem	✅

Wiki

#	Tool	Result	Notes
43	wiki_list_wikis	✅
44	wiki_get_wiki	✅
45	wiki_list_pages	✅
46	wiki_get_page	✅
47	wiki_get_page_content	✅
48	wiki_create_or_update_page	⏭️	Write — not run

Work Items

#	Tool	Result	Notes
49	wit_my_work_items	✅
50	wit_list_backlogs	✅
51	wit_list_backlog_work_items	✅
52	wit_get_work_item	✅
53	wit_get_work_items_batch_by_ids	✅
54	wit_list_work_item_comments	✅
55	wit_list_work_item_revisions	✅
56	wit_get_work_items_for_iteration	✅
57	wit_get_work_item_type	✅
58	wit_get_query	✅
59	wit_get_query_results_by_id	✅
60	wit_add_work_item_comment	⏭️	Write — not run
61	wit_update_work_item	⏭️	Write — not run
62	wit_create_work_item	⏭️	Write — not run
63	wit_add_child_work_items	⏭️	Write — not run
64	wit_link_work_item_to_pull_request	⏭️	Write — not run
65	wit_update_work_items_batch	⏭️	Write — not run
66	wit_work_items_link	⏭️	Write — not run
67	wit_work_item_unlink	⏭️	Write — not run
68	wit_add_artifact_link	⏭️	Write — not run

Test Plans

#	Tool	Result	Notes
69	testplan_list_test_plans	✅
70	testplan_list_test_suites	✅
71	testplan_list_test_cases	⏭️	Skipped — requires active test plan
72	testplan_show_test_results_from_build_id	✅
73	testplan_create_test_plan	⏭️	Write — not run
74	testplan_create_test_suite	⏭️	Write — not run
75	testplan_create_test_case	⏭️	Write — not run
76	testplan_add_test_cases_to_suite	⏭️	Write — not run
77	testplan_update_test_case_steps	⏭️	Write — not run

Advanced Security

#	Tool	Result	Notes
78	advsec_get_alerts	🚫	Returns friendly on-premises not-supported message (by design)
79	advsec_get_alert_details	🚫	Not applicable — no alert IDs available on-premises

Summary

Category	Count
✅ Passed (read)	47
⏭️ Skipped (write / n/a)	30
🚫 Not supported on-premises (by design)	2
Total tools	79

All 47 read-only tools passed against Azure DevOps Server (on-premises).
Advanced Security tools are cloud-only by design and return a descriptive error on-premises.

[danhellem]

Sorry, as of right now we do not have plans to enable this for on-prem. Once we complete our remote MCP Server we will reconsider supporting in local to give options. I am moving this to a discussion for tracking.

[martinvelek-collab]

Hello,
is there a progress with the decision to support on-premise deployments?
I somehow don't understand the reason, why the on-premise support cannot be provide - use as is, no help. It could save time instead of letting the AI to "add the support" every new release or using other - who knows how - made solutions.

[TristeTristan]

Hi,

Please, make it available.

Within companies we are missing one of the most important features of AI. The subscriptions companies pay to Microsoft are really expensive. Not giving us the possibility to use it is like selling us a car without giving us the keys.

[jrmoreno1]

I would also like to request that this be added, all of the items that are shown as skipped are outside of what would typically be used, while a couple of them would be nice, they are in no way an obstacle to adoption.