{"_id":"@bedolla/enriazure","name":"@bedolla/enriazure","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@bedolla/enriazure","version":"0.1.0","description":"Azure DevOps Server-only MCP with multi-collection administration and guarded CRUD.","author":{"name":"Bedolla"},"license":"AGPL-3.0-or-later","homepage":"https://github.com/Bedolla/EnriAzure#readme","bugs":{"url":"https://github.com/Bedolla/EnriAzure/issues"},"repository":{"type":"git","url":"git+https://github.com/Bedolla/EnriAzure.git"},"type":"module","bin":{"enriazure":"dist/index.js"},"publishConfig":{"access":"public"},"scripts":{"typecheck":"tsc -p tsconfig.json --noEmit","clean":"node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"","build":"npm run clean && tsc -p tsconfig.build.json && node -e \"require('node:fs').chmodSync('dist/index.js',0o755)\"","lint":"eslint .","format:check":"prettier --check .","test":"vitest run"},"engines":{"node":">=24"},"dependencies":{"@modelcontextprotocol/sdk":"1.30.0","zod":"4.4.3"},"devDependencies":{"@eslint/js":"10.0.1","@types/node":"24.13.3","eslint":"10.8.0","jiti":"2.7.0","prettier":"3.9.6","typescript":"6.0.3","typescript-eslint":"8.65.0","vitest":"4.1.10"},"keywords":["mcp","model-context-protocol","azure-devops-server","on-premises","self-hosted"],"gitHead":"d07f149bb13a744e888a004d79d5de54572c85f4","_id":"@bedolla/enriazure@0.1.0","_nodeVersion":"24.18.0","_npmVersion":"11.16.0","dist":{"integrity":"sha512-Zo+oCdjHqY9F3aTPuLZWhaJHzBKHfG8DNVjmu4kC2aooGUVMGliKiOiDwFiitK/zmrJmR8UbLNaw0BlfY1WwzA==","shasum":"cd604c55e903ae3d3c8d94ee4ad60fb327b18997","tarball":"https://registry.npmjs.org/@bedolla/enriazure/-/enriazure-0.1.0.tgz","fileCount":371,"unpackedSize":5511469,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@bedolla%2fenriazure@0.1.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIFnatQiLwzUleTeoz0zfRdPDHvFhcnnyy2IKP7/kmg9fAiBXnCjIV6mvEHyBVNsOablvQbQkisQ/WEqOI0C0a/3E5Q=="}]},"_npmUser":{"name":"bedolla","email":"Fer@Bedol.la"},"directories":{},"maintainers":[{"name":"bedolla","email":"Fer@Bedol.la"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/enriazure_0.1.0_1785377051713_0.8467358886432954"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-30T02:04:11.557Z","0.1.0":"2026-07-30T02:04:11.938Z","modified":"2026-07-30T02:04:12.320Z"},"maintainers":[{"name":"bedolla","email":"Fer@Bedol.la"}],"description":"Azure DevOps Server-only MCP with multi-collection administration and guarded CRUD.","homepage":"https://github.com/Bedolla/EnriAzure#readme","keywords":["mcp","model-context-protocol","azure-devops-server","on-premises","self-hosted"],"repository":{"type":"git","url":"git+https://github.com/Bedolla/EnriAzure.git"},"author":{"name":"Bedolla"},"bugs":{"url":"https://github.com/Bedolla/EnriAzure/issues"},"license":"AGPL-3.0-or-later","readme":"# EnriAzure\n\nEnriAzure lets an LLM work with **Azure DevOps Server 2022 Update 2 installed\non your own infrastructure**.\n\nYou can ask the LLM to inspect or manage projects, repositories, pull requests,\nwork items, sprints, pipelines, deployments, Variable Groups, agents, releases,\nartifacts, wikis, tests, permissions, and other Azure DevOps Server resources.\n\n> EnriAzure is only for self-hosted/on-premises Azure DevOps Server. It rejects\n> Azure DevOps Services (`dev.azure.com`) and Azure cloud-management APIs.\n\n## What you need\n\nYou do not need Azure CLI, an Azure subscription, Microsoft Entra ID, a cloud\nSDK, or knowledge of the Azure DevOps REST API.\n\nYou need these four things:\n\n1. **A reachable Azure DevOps Server address.** It can use a public or internal\n   DNS name, a LAN hostname or IP address, or `localhost` when Azure DevOps\n   Server runs on the same computer as EnriAzure. Examples include\n   `https://ado.example.test`, `http://ado-server.example.test:8080/tfs`, and\n   `http://localhost:8080/tfs`.\n2. **A Personal Access Token (PAT) from that Server.** EnriAzure uses the PAT\n   like a password. It can do only what the PAT scopes and its owner are allowed\n   to do.\n3. **Node.js 24 LTS or a newer supported release.** Node.js runs EnriAzure on\n   the same computer as your MCP application.\n4. **An MCP-compatible application that supports local `stdio` servers.** This\n   is the software where you interact with the LLM. It starts the EnriAzure MCP\n   server and gives its tools to the LLM.\n\n### Create the PAT\n\nIn the Azure DevOps Server web interface:\n\n1. Sign in to the Azure DevOps Server web portal.\n2. Open **User settings** and select **Personal access tokens**.\n3. Select **+ New Token**.\n4. Enter a descriptive name and choose an expiration date.\n5. Select the scopes EnriAzure needs. Reading requires the corresponding read\n   scopes; creating, changing, or deleting resources requires the corresponding\n   write or manage scopes.\n6. Select **Create**, copy the token immediately, and store it securely. The\n   complete token is not displayed again.\n\nTreat the PAT like a password. Do not post it in an issue, commit it to a\nrepository, or place it in a file that other users can read. Microsoft provides\nadditional PAT guidance in\n[Use personal access tokens](https://learn.microsoft.com/azure/devops/organizations/accounts/use-personal-access-tokens-to-authenticate?view=azure-devops-2022).\n\n## Configure EnriAzure\n\nChoose one of the following three ways to run EnriAzure. Each configuration\nstarts the same MCP server and accepts the same environment variables. The\nexamples use the EnriCode CLI configuration format: add the selected `mcp`\nobject to the EnriCode CLI JSON configuration.\n\n### Run a local source checkout\n\nUse this option when EnriAzure is already cloned or downloaded on the computer\nthat runs the MCP application. Install its dependencies and compile the\nJavaScript entry point:\n\n```text\ngit clone https://github.com/Bedolla/EnriAzure.git\ncd EnriAzure\nnpm ci\nnpm run build\n```\n\nThen configure the MCP application to run that compiled file with Node.js:\n\n```json\n{\n  \"mcp\": {\n    \"servers\": {\n      \"EnriAzure\": {\n        \"enabled\": true,\n        \"transport\": \"stdio\",\n        \"command\": \"node\",\n        \"args\": [\"/absolute/path/to/EnriAzure/dist/index.js\"],\n        \"env\": {\n          \"ENRIAZURE_SERVER_URL\": \"https://ado.example.test\",\n          \"ENRIAZURE_PAT\": \"PASTE_YOUR_PAT_HERE\",\n          \"ENRIAZURE_WRITE_POLICY\": \"read-only\"\n        }\n      }\n    }\n  }\n}\n```\n\nReplace the argument with the absolute path to the generated `dist/index.js`\nfile. On Windows, a JSON path looks like\n`C:\\\\Tools\\\\EnriAzure\\\\dist\\\\index.js`.\n\n### Run with `npx` without installing EnriAzure first (recommended)\n\n`npx` is included with npm. No separate EnriAzure installation is required. If\nthe requested package is not already available, `npx` downloads it from the\nconfigured npm registry into the npm cache and starts it:\n\n```json\n{\n  \"mcp\": {\n    \"servers\": {\n      \"EnriAzure\": {\n        \"enabled\": true,\n        \"transport\": \"stdio\",\n        \"command\": \"npx\",\n        \"args\": [\"--yes\", \"@bedolla/enriazure@latest\"],\n        \"env\": {\n          \"ENRIAZURE_SERVER_URL\": \"https://ado.example.test\",\n          \"ENRIAZURE_PAT\": \"PASTE_YOUR_PAT_HERE\",\n          \"ENRIAZURE_WRITE_POLICY\": \"read-only\"\n        }\n      }\n    }\n  }\n}\n```\n\n`--yes` lets `npx` download the package without an interactive confirmation.\n`@latest` selects the newest stable release. On Windows, use `npx.cmd` if the\napplication says it cannot find `npx`. To keep the same release until you\nintentionally update it, replace `@latest` with an exact version, for example\n`@bedolla/enriazure@0.1.0`.\n\n### Run a global npm installation\n\nUse this option to install EnriAzure once and update it manually:\n\n```text\nnpm install --global @bedolla/enriazure@latest\n```\n\nThe global installation provides the `enriazure` command:\n\n```json\n{\n  \"mcp\": {\n    \"servers\": {\n      \"EnriAzure\": {\n        \"enabled\": true,\n        \"transport\": \"stdio\",\n        \"command\": \"enriazure\",\n        \"args\": [],\n        \"env\": {\n          \"ENRIAZURE_SERVER_URL\": \"https://ado.example.test\",\n          \"ENRIAZURE_PAT\": \"PASTE_YOUR_PAT_HERE\",\n          \"ENRIAZURE_WRITE_POLICY\": \"read-only\"\n        }\n      }\n    }\n  }\n}\n```\n\nOn Windows, npm also creates `enriazure.cmd`; use that command if the MCP\napplication cannot resolve `enriazure`. Update the installed package later by\nrunning the same\n`npm install --global @bedolla/enriazure@latest` command.\n\n### Environment variables used by all three configurations\n\nThe examples include the required Server address and PAT plus an explicit\nwrite policy. The following table documents every supported `ENRIAZURE_*`\nvariable; omit optional variables unless you need to change their default\nbehavior.\n\n| Variable                            | Required | Accepted values and behavior                                                                                                                                                                                                       |\n| ----------------------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `ENRIAZURE_SERVER_URL`              | Yes      | Absolute `http://` or `https://` root of an Azure DevOps Server instance, for example `https://ado.example.test` or `https://ado.example.test/tfs`. Do not include a collection, project, API path, or credentials.                |\n| `ENRIAZURE_PAT`                     | Yes      | A non-empty PAT written directly, or an exact reference such as `${AZURE_DEVOPS_SERVER_PAT}`.                                                                                                                                      |\n| `ENRIAZURE_DEFAULT_COLLECTION`      | No       | A collection name or ID. Empty or omitted means no default. A tool call can select any other collection, so this does not restrict the Server scope.                                                                               |\n| `ENRIAZURE_DEFAULT_PROJECT`         | No       | A project name or ID. Empty or omitted means no default. A tool call can select any other project, so this does not restrict the Server scope.                                                                                     |\n| `ENRIAZURE_REQUEST_TIMEOUT_SECONDS` | No       | Positive whole number of seconds allowed for one Server request. Default: `180` (3 minutes).                                                                                                                                       |\n| `ENRIAZURE_MAX_RESPONSE_SIZE_MB`    | No       | Maximum whole number of megabytes loaded for one Server response. It does not limit a project or the total data EnriAzure can access. Default: `64`. Increase it only if EnriAzure reports this exact limit.                       |\n| `ENRIAZURE_WRITE_POLICY`            | No       | `read-only` allows inspection only; `write` also allows create, edit, run, queue, approve, assign, and upload; `full` additionally allows delete, remove, restore, purge, and complete lifecycle operations. Default: `read-only`. |\n\nChanging the write policy does not grant Azure DevOps permissions. The PAT\nowner and PAT permissions must also allow the requested operation.\n\nIn all three examples, replace `https://ado.example.test` and\n`PASTE_YOUR_PAT_HERE` with your Server root and PAT. In EnriCode CLI,\n`mcp.servers.EnriAzure.enabled` enables this server and `transport: \"stdio\"`\nstarts it as a local process.\n\n## Keep the PAT outside the MCP configuration\n\nThe direct PAT shown above is the simplest first setup. If the MCP\nconfiguration is stored as readable text, keep the PAT in an external\nenvironment variable instead.\n\nFirst make `AZURE_DEVOPS_SERVER_PAT` available to the process that launches the\nMCP application. For example, when starting that application from a terminal:\n\nWindows PowerShell:\n\n```powershell\n$env:AZURE_DEVOPS_SERVER_PAT = \"YOUR_PAT\"\n```\n\nmacOS or Linux:\n\n```bash\nexport AZURE_DEVOPS_SERVER_PAT=\"YOUR_PAT\"\n```\n\nThen change only the PAT line in the MCP configuration:\n\n```json\n{\n  \"ENRIAZURE_PAT\": \"${AZURE_DEVOPS_SERVER_PAT}\"\n}\n```\n\nEnriAzure accepts both forms:\n\n- a direct PAT string; or\n- an exact `${VARIABLE_NAME}` reference.\n\nIf the MCP application expands the reference itself, EnriAzure receives the\nPAT. If the application passes the reference literally, EnriAzure resolves it\nfrom the environment inherited when the process starts.\n\n## Select collections and projects\n\nThe Server address identifies the installation, not a particular collection or\nproject. EnriAzure can work with multiple collections and projects from one\nprocess.\n\nThe model can discover them by using:\n\n1. `server` with action `list_collections`;\n2. `project` with action `list`.\n\nYou do not have to configure a default collection or project. If most requests\nuse the same ones, add these optional values to the MCP server's `env` object:\n\n```json\n{\n  \"ENRIAZURE_DEFAULT_COLLECTION\": \"DefaultCollection\",\n  \"ENRIAZURE_DEFAULT_PROJECT\": \"ExampleProject\"\n}\n```\n\nThey are conveniences, not restrictions. A tool call can explicitly select a\ndifferent collection or project.\n\nSome advanced official operations also accept `scope_level`:\n\n- `instance`: the complete Azure DevOps Server installation;\n- `collection`: one project collection;\n- `project`: one project;\n- `team`: one team inside a project;\n- `auto`: infer the scope from the provided values and optional defaults.\n\nEnriAzure accepts only the scope levels supported by the selected Server API.\n\n## What the LLM can manage\n\n| Area          | Examples                                                                     |\n| ------------- | ---------------------------------------------------------------------------- |\n| Server        | Collections and available Server resource areas                              |\n| Projects      | Projects, teams, team members, areas, and iterations                         |\n| Git           | Repositories, branches, refs, files, commits, pushes, and pull requests      |\n| Work tracking | Work items, comments, queries, boards, backlogs, sprints, and capacity       |\n| Pipelines     | YAML pipelines, classic builds, runs, logs, artifacts, and timelines         |\n| Deployments   | Environments, deployment groups, targets, checks, approvals, and permissions |\n| Libraries     | Variable Groups, individual variables, secrets, and Secure Files             |\n| Agents        | Agent pools, agents, and project queues                                      |\n| Releases      | Classic definitions, releases, stages, deployments, and interventions        |\n| Artifacts     | Feeds, views, permissions, packages, versions, retention, and recycle bins   |\n| Collaboration | Wikis, pages, policies, service hooks, endpoints, and notifications          |\n| Testing       | Test Plans, suites, cases, runs, results, and configurations                 |\n| Search        | Code, work item, and wiki search                                             |\n\nUseful requests include:\n\n- “List the collections and projects available on this Azure DevOps Server.”\n- “Show me the repositories, active branches, and open pull requests in this\n  project.”\n- “Show me the failed pipelines and their logs.”\n- “Find the cause of the latest failed deployment and identify the resource\n  that blocked it.”\n- “Review the checks, approvals, and agents blocking the deployment.”\n- “List the pending approvals assigned to this user and show their pipeline\n  context.”\n- “Rerun this failed deployment check and monitor its new result.”\n- “Queue this pipeline with these variables and monitor it until it finishes.”\n- “List the incomplete work items in the current sprint.”\n- “Create the next sprint, assign it to this team, and configure its capacity.”\n- “Create a branch and a pull request for this change.”\n- “Update this deployment variable without changing the others.”\n- “Create a secret Variable Group entry without exposing its value in the\n  result.”\n- “Review the Variable Groups without revealing secrets.”\n- “Show me unavailable agents and queued jobs waiting for an agent.”\n- “Run this pipeline and tell me whether the deployment completed successfully.”\n- “List failed tests from the latest run and show their error details.”\n- “Review the latest classic release and explain which stage needs attention.”\n- “List packages in this feed that are deprecated or waiting for cleanup.”\n- “Update this wiki page with the final deployment procedure.”\n\n## Variable Group and secret safety\n\nAzure DevOps updates a Variable Group as one complete object even when only one\nvariable changes. EnriAzure reads and merges the group so an individual update\ndoes not accidentally remove sibling variables, project references, read-only\nflags, or existing masked secrets.\n\nFor an existing secret variable:\n\n- omit `value` to keep its current secret;\n- provide a new value to replace it;\n- provide `\"\"` only when you intentionally want an empty value.\n\nWhen Azure DevOps returns a hidden secret as `null` or asterisks, EnriAzure does\nnot interpret that as a request to erase it. Secret values and other\ncredential-shaped fields are removed again before results reach the model.\n\nSecure File contents can be uploaded, but EnriAzure does not download their\ncontents into model context.\n\n## Troubleshooting\n\n### The MCP application cannot start EnriAzure\n\nRun `node --version` and `npm --version`. Install Node.js 24 or newer if either\ncommand is missing. On Windows, change `npx` to `npx.cmd`.\n\n### The package cannot be downloaded\n\nConfirm that the computer can reach npmjs.com. If the network uses a proxy,\nconfigure npm according to the organization's network policy. A global\ninstallation can be used when the MCP application is not allowed to download a\npackage at startup.\n\n### The Server address is rejected\n\nUse the Server instance root, such as `https://server.example.test` or\n`https://server.example.test/tfs`. Do not include a collection, project, REST\npath, query string, username, or password.\n\n### Authentication returns `401` or `403`\n\nCheck that the PAT:\n\n- came from this Azure DevOps Server;\n- has not expired or been revoked;\n- belongs to a user who can access the target resource;\n- includes the required read or manage permissions.\n\nAzure DevOps Server PAT authentication can also fail when IIS Basic\nAuthentication is enabled for the Server site.\n\n### Collections or projects are missing\n\nRemove incorrect default values and ask the model to list collections first,\nthen projects. A collection and project do not have to share the same name.\n\n### The LLM cannot create, update, or delete\n\nCheck both permission layers:\n\n1. `ENRIAZURE_WRITE_POLICY` must allow the action.\n2. The PAT owner and PAT scopes must allow the same action in Azure DevOps.\n\nCreate and update operations require `write` or `full`. Delete and removal\noperations require `full`.\n\n### HTTPS reports a certificate error\n\nNo extra setting is needed when HTTPS works normally. Only if EnriAzure reports\na certificate error for a Server that uses an internal certificate authority,\nadd one of these values to the MCP server's `env` object:\n\n- `\"NODE_OPTIONS\": \"--use-system-ca\"` when the computer already trusts that\n  internal authority;\n- `\"NODE_EXTRA_CA_CERTS\": \"C:\\\\certificates\\\\organization-ca.pem\"` when the\n  Server administrator provides its public CA certificate in PEM format.\n\nRestart the MCP application after changing the configuration. Never use\n`NODE_TLS_REJECT_UNAUTHORIZED=0`, because it disables certificate verification.\n\n### A response is too large\n\nThis limit applies to one Server response, not to a project or the total data\nEnriAzure can access. Ask for a narrower date range, filter, or page. If the\ncomplete response is intentionally larger, increase\n`ENRIAZURE_MAX_RESPONSE_SIZE_MB`.\n\n## Further information\n\n- [Capability matrix](docs/CAPABILITIES.md)\n- [Official API coverage](docs/OFFICIAL_API_COVERAGE.md)\n","readmeFilename":"README.md","_rev":"1-00513befc61f2ff2c278ca909afad4d6"}