azdo-tool

azdo-tool (Azure DevOps)

Azure DevOps tool — pipelines, builds, repos (read-only). Part of @blogic-cz/agent-tools.

Scope: Azure DevOps only. For Azure platform (PaaS) resources — vm, webapp, storage, aks, monitor — use az-tool.

How to Run

Run via bun azdo-tool (requires @blogic-cz/agent-tools as a dev dependency). NEVER run bare az — the credential guard will block it. Auth: az login session.

Commands

bun azdo-tool cmd --cmd "pipelines list"
bun azdo-tool cmd --cmd "pipelines show --id 123"
bun azdo-tool cmd --cmd "pipelines runs list --top 5"
bun azdo-tool cmd --cmd "pipelines runs show --id 456"
bun azdo-tool build summary --build-id 456      # Job status & duration
bun azdo-tool build timeline --build-id 456     # Full event timeline
bun azdo-tool build failed-jobs --build-id 456   # Just failures
bun azdo-tool build logs --build-id 456          # List available logs
bun azdo-tool build log-content --build-id 456 --log-id 78

Use --profile <name> to select a named profile when multiple Azure DevOps organizations are configured.

What is blocked

Write verbs anywhere in the command: create, delete, update, cancel, queue.
run outside the pipelines group. pipelines run is allowed; acr run and acr task run are not, because they execute commands in Azure.
devops invoke outside the build area, its write resources (definitions, folders, tags, retention), and any HTTP method other than GET.
Credential reads through the acr/account passthrough — acr credential show, account get-access-token, and anything naming secret, key, keys, credential, password, sas, or connection-string. Those two groups address the Azure platform, so az-tool's credential rules apply to them here too.

Commands are scoped to the configured organization and project, and spawned as an argument vector — never through a shell.

Config

{
  azure: {
    default: {
      organization: "https://dev.azure.com/example-org",
      defaultProject: "platform",
      timeoutMs: 60000,
    },
  },
}

Tips

Use bun azdo-tool commands for the full machine-readable command/flag tree; --help for one subcommand.
Error responses include hint, nextCommand, and retryable fields — always check them on failure.
Prefer CLI tool over MCP tools — more efficient, doesn't load extra context.