feat(ado-proxy): add credential-isolated Azure DevOps reads - #1824

Merged

jamesadevine merged 44 commits into

mainfrom

devinejames/mcpg-az

Aug 6, 2026

Commits on Jul 31, 2026

fix(compile): correct az devops authentication claims in prompt and docs

jamesadevine
and
Copilot
committed
b0cb523
feat(ado-proxy): add credential-isolated Azure DevOps policy proxy

jamesadevine
and
Copilot
committed
cdc2316
test(ado-script): budget for Vite transform time in the test timeout

jamesadevine
and
Copilot
committed
87516f9
fix(compile): guard the front-matter capability enum against the proxy catalog

jamesadevine
and
Copilot
committed
61f5acc

Commits on Aug 1, 2026

docs(ado-proxy): revise design for per-client ingress; add SPS discovery route

jamesadevine
and
Copilot
committed
8f99b90
test(ado-proxy): prove --add-host redirection and that SPS is avoidable

jamesadevine
and
Copilot
committed
e80596f
fix(ado-proxy): rewrite resource-area locationUrl instead of filtering it

jamesadevine
and
Copilot
committed
2045f05

Commits on Aug 2, 2026

refactor(ado-proxy): read interception certificates from stdin

jamesadevine
and
Copilot
committed
f78b2b3
feat(ado-proxy): accept direct TLS alongside the CONNECT path

jamesadevine
and
Copilot
committed
13e1535
docs(ado-proxy): mount the MCP package; record the credential-delivery constraint

jamesadevine
and
Copilot
committed
622dac0
feat(ado-proxy): deliver the bearer on stdin and bound the run to its lifetime

jamesadevine
and
Copilot
committed
db3282b
refactor(ado-proxy): carry interception material as versioned JSON

jamesadevine
and
Copilot
committed
e4cd6c9
feat(ado-proxy): add the policy-engine container lifecycle

jamesadevine
and
Copilot
committed
1ea098c

Commits on Aug 3, 2026

feat(ado-proxy): attach the policy engine to the AWF network

jamesadevine
and
Copilot
committed
bcdf79f
feat(ado-proxy): route the Azure DevOps MCP through the policy engine

jamesadevine
and
Copilot
committed
cafb187
fix(ado-proxy): isolate the MCP network so it cannot route past the engine

jamesadevine
and
Copilot
committed
3a91f3e
feat(ado-proxy): add the az wrapper and fix the CA for strict verifiers

jamesadevine
and
Copilot
committed
156ea00
feat(ado-proxy): install the az wrapper into the agent sandbox

jamesadevine
and
Copilot
committed
8019fd8
feat(ado-proxy): tell the agent what az can actually do, and allow az rest

jamesadevine
and
Copilot
committed
db31f8c

Commits on Aug 4, 2026

fix(ado-proxy): populate the policy from config, restoring repository reads

jamesadevine
and
Copilot
committed
2634dfa
feat(ado-proxy): resolve scope through an organization-relative index

jamesadevine
and
Copilot
committed
a241805
test(ado-proxy): prove organization-relative scope resolution

jamesadevine
and
Copilot
committed
4e4987a
feat(ado-proxy): emit explicit cross-organization read scopes

jamesadevine
and
Copilot
committed
d7e4bc3
feat(ado-proxy): accept structured permissions.read policies

jamesadevine
and
Copilot
committed
4fbf8ae
fix(ado-proxy): require a read token source when proxying ADO

jamesadevine
and
Copilot
committed
45995cf
feat(ado-proxy): derive repository-only scopes from repos

jamesadevine
and
Copilot
committed
ff3d613
test(ado-proxy): prove scoped reads across compiler and bundle

jamesadevine
and
Copilot
committed
157c14b
docs(ado-proxy): document scoped credential-isolated reads

jamesadevine
and
Copilot
committed
ed4c14e
feat(ado-proxy): enable the scoped proxy runtime

jamesadevine
and
Copilot
committed
c90e7a9

Commits on Aug 5, 2026

docs(ado-proxy): finalize shipped behavior and contributor guidance

jamesadevine
and
Copilot
committed
c527ff2
Merge remote-tracking branch 'origin/main' into devinejames/mcpg-az
jamesadevine
committed
fafef14
test(ado-proxy): add candidate runner smoke coverage

jamesadevine
and
Copilot
committed
b548b79
fix(ado-proxy): detach the proxy lifecycle and publish diagnostics

jamesadevine
and
Copilot
committed
3ee4442
fix(ado-proxy): publish the interception CA as world-readable

jamesadevine
and
Copilot
committed
1f31bb9
fix(ado-proxy): accept the MCP project-list query shape

jamesadevine
and
Copilot
committed
4f14cca
fix(ado-proxy): give wrapped az a writable config directory

jamesadevine
and
Copilot
committed
92239f2
test(ado-proxy): exercise runtime denials on the ADO runner

jamesadevine
and
Copilot
committed
507a7a8
fix(ado-proxy): gate proxy and wrapped az on read permission

jamesadevine
and
Copilot
committed
881f7c7
test(smoke): remove obsolete unproxied azure-cli case

jamesadevine
and
Copilot
committed
a3f1122
feat(audit): analyze ado-proxy runtime diagnostics

jamesadevine
and
Copilot
committed
78a90d8
docs(audit): document ado-proxy diagnostics

jamesadevine
and
Copilot
committed
e5e8279
fix(audit): handle real artifact download layouts

jamesadevine
and
Copilot
committed
57aed65

Commits on Aug 6, 2026

Merge remote-tracking branch 'origin/main' into devinejames/mcpg-az
Copilot
authored
b1e5f2a
refactor(compile): separate ADO org script from YAML layout

jamesadevine
and
Copilot
committed
38d6885