Testing for Insecure MCP Servers

ID:	AdoSTG-AI-03

If you need help assessing the security of your Azure DevOps or organization, we offer a wide range of security services. So, always feel free to reach out at: Sales@enterprisesoftproducts.com

NOTICE: The Azure DevOps - Security Testing Guide (Ado-STG) is currently in BETA; this means that there might be substantial changes and some parts may contain errors or not be fully implemented.

0 - Summary

Potential MCP-enabled task found with untrusted input and token access; this potentially means that the MCP connection can be abused to gain remote code execution or exfiltrate sensitive information.

MCP servers in Azure DevOps mainly serve to retrieve and analyze data from ADO projects.

In their documentation Microsoft [001] describes this as a two-step process:

Data retrieval (MCP Server)
AI analysis (Your AI assistant)

The general risk here is that MCP servers or exposed tokens can be abused by attackers to compromise accounts.

1 - Test Objectives

Identify the use of MCP servers in pipelines and assess if untrusted input is passed to the pipeline, and if the pipeline has token access

2 - How to Test

2.1 - Identifying MCP indicators

MCP servers can usually be identified by the word "MCP" in the pipeline YAML file.

For example, to have an MCP client, the official MCP documentation [002] has the following example for implementation.

1import asyncio 
2import sys 
3 
4from mcp import Client, StdioServerParameters 
5from mcp.client.stdio import stdio_client 
6from mcp_types import TextContent 
7 
8from anthropic import Anthropic 
9from dotenv import load_dotenv 
10 
11load_dotenv() # load environment variables from .env 
12 
13MODEL = "claude-opus-5" 
14anthropic = Anthropic()

Likewise, the Microsoft documentation [003] also contains "mcp":

1{ 
2 "servers": { 
3   "ado-remote-mcp": { 
4       "url": "https://mcp.dev.azure.com/{organization}", 
5       "type": "http", 
6       "headers": { 
7           "X-MCP-Toolsets": "repos,wiki,wit" 
8           } 
9       } 
10  }, 
11 "inputs": [] 
12}

Simply grepping for the word "mcp" should have very few false positives and help identify where MCP clients are in use.

2.2 - Identifying Token Access

Once an MCP-enabled pipeline has been found, we can check for token access. The easiest way to achieve this is to look for known dangerous tokens:

1SYSTEM_ACCESSTOKEN, 
2System.AccessToken, 
3AZURE_DEVOPS_EXT_PAT

2.3 - Identifying Untrusted Input

Lastly, we can check for untrusted input being passed to the MCP server from the pipeline.

The following list contains user-controlled ADO contexts:

1"Build.SourceVersionMessage", # Commit message (user-controlled) 
2"Build.SourceBranchName", # Short branch name (user-controlled via PR) 
3"Build.SourceBranch", # Full branch ref e.g. refs/heads/feature/foo 
4"Build.RequestedFor", # Display name of person who triggered build 
5"Build.RequestedForEmail", # Email of person who triggered build 
6"System.PullRequest.SourceBranch", # PR source branch name 
7"System.PullRequest.TargetBranch", # PR target branch name

3 - Remediation

Disable MCP functionality in AI tasks or ensure pipeline tokens are not provided. If MCP is necessary, restrict to trusted inputs only.

4 - References

https://learnmicrosoftcom/en-us/azure/devops/mcp-server/remote-mcp-server?view=azure-devops
https://modelcontextprotocolio/docs/2026-07-28/develop/build-client
https://githubcom/praetorian-inc/trajan/blob/main/pkg/azuredevops/detections/ai/ai.go