Azure DevOps work items
File, query, read and manage Azure Boards work items from an AI agent, with the personal access token held server-side and never handed to the model. This suite is a ladder, and picking a rung is picking scope.
File only: azure-devops-workitem on its own. One pipe, one work item at a time, nothing read back. It runs on the free Deckhand plan and fits a developer logging bugs without leaving the code.
Read: azure-devops-query plus azure-devops-read. Two pipes rather than one, because Azure DevOps answers WIQL with a bare reference list of ids and refuses collection reads on its $batch endpoint, so the halves cannot be joined. Needs two pipe slots, a plan that stores full response bodies (Bosun), and a PAT scoped Work Items (Read) when nothing else in the suite is installed. Fits a developer checking their own assignments or a manager checking team progress.
Manage: those two plus azure-devops-manage. Three pipe slots (First Mate) and a PAT scoped Work Items (Read & write), for a PM or QA grooming the whole backlog.
Climbing swaps pipes rather than stacking them. A higher rung supersedes the lower one, so azure-devops-manage replaces azure-devops-workitem: delete the superseded pipe when you move up. Keeping every rung installed side by side needs more replay-target slots than the named plan provides.
Each rung repeats the whole suite's routing predicates in its own gotchas. That repetition is deliberate: if these share one capture endpoint, a binding that goes in unpredicated makes one fire trigger two pipes.
The credential never enters the model context: it lives in the FlurryPORT secret store, deliveries are signed server-side, and every send returns a receipt your agent can quote.
Install with your agent
npx flurryport mcp
Point your agent at the FlurryPORT MCP server (npx flurryport mcp) and ask it for the rung you need. Each member installs on its own, so you can climb the ladder one recipe at a time. Works from AI clients that can run a local process: desktop apps and terminal agents.
The rungs
Let your AI file Azure DevOps work items (bugs, tasks) the model never holds credentials for.
The simple free rung: file one work item, one pipe, no reading. Superseded by azure-devops-manage, so delete it when you climb to manage.
Query Azure DevOps work items with WIQL and read the matching ids back, without your AI ever holding the PAT.
WIQL in, matching work item ids out. Returns a reference list with no fields on it, so it always pairs with azure-devops-read.
Read fields for a batch of Azure DevOps work items by id: title, state, tags, priority, iteration.
Fields for a batch of ids. Exists as its own pipe because Azure DevOps refuses collection reads on its $batch endpoint.
Create and update Azure DevOps work items in one batched pipe: priority, state, tags, and sprint included.
Batch JSON Patch through the org-level $batch endpoint: creates and updates in one call.