--- title: "Connect Azure DevOps to ChatGPT: Audit PRs and Branch Policies" slug: connect-azure-devops-to-chatgpt-audit-prs-and-branch-policies date: 2026-11-04 author: Yuvraj Muley categories: ["AI & Agents"] excerpt: "Learn how to connect Azure DevOps to ChatGPT using a managed MCP server. Automate PR audits, branch policy compliance, and repository governance workflows." tldr: Connect Azure DevOps to ChatGPT securely via Truto's auto-generated MCP server. This guide shows how to expose ADO pull requests and branch policies to AI agents to automate repository governance. canonical: https://truto.one/blog/connect-azure-devops-to-chatgpt-audit-prs-and-branch-policies/ --- # Connect Azure DevOps to ChatGPT: Audit PRs and Branch Policies If you are responsible for maintaining repository security, you know that keeping track of active pull requests, reviewer approvals, and branch policies across dozens of repositories is a full-time job. To automate these audits, you need a [Model Context Protocol (MCP) server](https://truto.one/what-is-mcp-and-mcp-servers-and-how-do-they-work/) that acts as the translation layer between ChatGPT's tool calls and the Azure DevOps REST APIs. If your team uses Claude, check out our guide on [connecting Azure DevOps to Claude](https://truto.one/connect-azure-devops-to-claude-track-prs-and-reviewer-feedback/) or explore our broader architectural overview on [connecting Azure DevOps to AI Agents](https://truto.one/connect-azure-devops-to-ai-agents-manage-prs-and-policy-compliance/). Giving a Large Language Model (LLM) read and write access to Azure DevOps (ADO) is a significant engineering undertaking. You have to navigate a highly nested API architecture, manage complex UUID-based policy configurations, and map cryptic integer-based reviewer votes to natural language. You can either spend weeks building and maintaining custom server code to map these endpoints, or use a [managed integration platform like Truto](https://truto.one/best-mcp-server-platform-for-ai-agents-connecting-to-enterprise-saas/) to dynamically generate a secure, authenticated MCP server URL. This guide breaks down exactly how to use Truto to generate an MCP server for Azure DevOps, connect it natively to ChatGPT, and execute complex compliance workflows using natural language. > Stop writing boilerplate API integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds. > > [Talk to us](https://truto.one/book-a-demo/) ## The Engineering Reality of the Azure DevOps API A [custom MCP server](https://truto.one/the-hands-on-guide-to-building-mcp-servers-for-ai-agents-2026/) is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, implementing it against the [Azure DevOps API](https://truto.one/connect-azure-devops-to-ai-agents-manage-prs-and-policy-compliance/) reveals several unique domain constraints that break standard CRUD assumptions. If you decide to build a custom MCP server for Azure DevOps, you own the entire schema mapping lifecycle. Here are the specific integration challenges that make ADO difficult for AI agents: ### Strict Hierarchical Routing Unlike flat SaaS platforms where you can simply query `/users` or `/tickets`, almost all Azure DevOps resources require strict, multi-level hierarchical routing. An API call often requires the Organization name, the Project name, and the Repository ID in the path. An LLM must correctly extract and pass these exact string combinations in every request. If your MCP server does not explicitly enforce required path parameters in its JSON Schema definitions, ChatGPT will hallucinate the hierarchy and return 404 errors. ### Obscure Reviewer Vote Integers When querying PR reviewers in ADO, the API does not return a simple "approved" or "rejected" string. It returns a vote integer. Your LLM needs to understand that `10` is approved, `5` is approved with suggestions, `0` is no vote, `-5` is waiting for author, and `-10` is rejected. Exposing this raw API to an AI requires injecting explicit instructions into the tool description so the model can correctly interpret compliance states. ### Opaque Policy Configuration Schemas Branch policies in ADO (like requiring a minimum number of reviewers or enforcing build validation) are not simple boolean flags on a repository object. They are separate entities returned by the Policy Configurations API. Each policy type is identified by a specific UUID (e.g., `fa4e907d-c16b-4a4c-9dfa-4906e5d171dd` for minimum reviewers). The LLM has to first fetch the configurations, cross-reference the UUIDs, and parse a deeply nested `settings` JSON object to understand what rules are actually applied to a branch. ## Generating and Connecting the Azure DevOps MCP Server To bypass these architectural hurdles, Truto [dynamically generates MCP tools](https://truto.one/auto-generated-mcp-tools-for-ai-agents-a-2026-architecture-guide/) based on the API's actual documentation and schemas. The platform handles the underlying API execution, pagination normalization, and authentication, exposing a standardized JSON-RPC 2.0 endpoint. Here is exactly how to create the MCP server and connect it to ChatGPT. ### Step 1: Connect Azure DevOps to Truto Before generating an MCP server, you must authenticate Azure DevOps as an Integrated Account within Truto. This isolates the credentials and scopes the eventual MCP server to a single tenant instance. Once connected, note your `integrated_account_id`. This ID will be used to scope the MCP server. ### Step 2: Create the MCP Server Truto allows you to generate the MCP server either through the dashboard UI or programmatically via the API. **Option A: Via the Truto UI** 1. Navigate to the **Integrated Accounts** page for your Azure DevOps connection. 2. Click the **MCP Servers** tab. 3. Click **Create MCP Server**. 4. Configure the server name, select any necessary method or tag filters (e.g., limiting to "read" methods for security). 5. Click Save and copy the generated MCP server URL (it will look like `https://api.truto.one/mcp/`). **Option B: Via the Truto API** For programmatic generation, you can make a `POST` request to the Truto API. This is ideal if you are dynamically provisioning AI agents for your own customers. ```bash curl -X POST https://api.truto.one/integrated-account//mcp \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "name": "ADO PR Audit Server", "config": { "methods": ["read"], "tags": ["pull_requests", "policy"] } }' ``` The response contains the secure URL needed to connect the LLM client: ```json { "id": "abc-123", "name": "ADO PR Audit Server", "config": { "methods": ["read"], "tags": ["pull_requests", "policy"] }, "expires_at": null, "url": "https://api.truto.one/mcp/a1b2c3d4e5f67890" } ``` ### Step 3: Connect the MCP Server to ChatGPT With the server URL generated, you can register it with your LLM framework. **Option A: Via the ChatGPT UI** 1. Open ChatGPT and navigate to **Settings -> Apps -> Advanced settings**. 2. Ensure **Developer mode** is enabled. 3. Under Custom Connectors, click **Add a new server**. 4. Provide a name (e.g., "Azure DevOps (Truto)"). 5. Paste the Truto MCP URL into the Server URL field and save. ChatGPT will automatically execute an initialization handshake and discover the available tools. **Option B: Via Manual Config (SSE Transport)** If you are running your own agent framework or a client like Claude Desktop or Cursor, you can configure the MCP connection manually using the Server-Sent Events (SSE) transport wrapper. Create an `mcp.json` config file: ```json { "mcpServers": { "azure-devops": { "command": "npx", "args": [ "-y", "@modelcontextprotocol/server-sse", "--url", "https://api.truto.one/mcp/" ] } } } ``` ### Core Architecture: The Flat Input Namespace When ChatGPT calls a tool, it generates a single JSON object containing all the arguments. Truto's MCP router dynamically splits these arguments into query parameters and body parameters using the enhanced JSON schemas derived from the API documentation. If an argument exists in the query schema, it is routed to the query string; if it exists in the body schema, it is sent in the payload. In the rare case of a naming collision, the query schema takes precedence. This abstract layer means the LLM does not need to understand the nuances of REST parameter formatting. ## Azure DevOps Hero Tools By default, Truto derives tool definitions directly from the integration's documented resources. Here are the highest-leverage tools exposed to ChatGPT for PR and policy audits. ### 1. List All Pull Requests **Tool name:** `list_all_azure_dev_ops_pull_requests` Retrieves a list of pull requests in a specified Git repository. By default, this only returns active pull requests. If your agent needs to audit historical PRs, it must explicitly pass `searchCriteria.status=all`. > "Get all active pull requests in the 'frontend-web' repository for the 'ecommerce-core' project." ### 2. Get Single Pull Request **Tool name:** `get_single_azure_dev_ops_pull_request_by_id` Fetches the complete details of a specific pull request by its ID. This is critical for retrieving the PR description, target branch, and exact creation timestamps. > "Fetch the details for pull request ID 4592 in the 'ecommerce-core' project. I need to know which branch it is targeting." ### 3. List Pull Request Reviewers **Tool name:** `list_all_azure_dev_ops_pull_request_reviewers` Retrieves the list of reviewers assigned to a specific pull request, including their vote status. The tool description instructs the LLM on how to interpret the vote integers (10 = approved, -10 = rejected). > "Check the reviewers for pull request 4592. Are there any outstanding rejections or 'waiting for author' statuses?" ### 4. List Policy Configurations **Tool name:** `list_all_azure_dev_ops_policy_configurations` Fetches all branch policy configurations for a project. This returns a collection of policies (like minimum approvers or build validation rules) and the specific repository/branch scopes they apply to. > "List all the branch policy configurations currently active in the 'ecommerce-core' project." ### 5. Get Single Policy Configuration **Tool name:** `get_single_azure_dev_ops_policy_configuration_by_id` Retrieves the deeply nested settings object for a specific policy configuration ID. This allows the AI to determine exactly how many reviewers are required or which specific build pipelines must pass. > "Look up policy configuration ID 152. Does it enforce a minimum of 2 reviewers, and does it require the author to wait for approval?" To view the complete inventory of available API operations and their JSON schemas, visit the [Azure DevOps integration page](https://truto.one/integrations/detail/azuredevops). ## Workflows in Action Once connected, ChatGPT can orchestrate complex, multi-step queries to audit your repository posture. Here are two real-world examples. ### Scenario 1: Active PR Security Audit A Tech Lead needs to quickly understand the compliance state of all active pull requests in a critical repository. > "Check all active pull requests in the 'auth-service' repository. For each PR, get the list of reviewers. Summarize any PRs that have a 'rejected' vote (-10) or have been open for more than 7 days without an 'approved' vote (10)." **Tool Execution Sequence:** 1. `list_all_azure_dev_ops_pull_requests` (Passes `repositoryId='auth-service'`, retrieves 5 active PRs). 2. `list_all_azure_dev_ops_pull_request_reviewers` (Called iteratively for each of the 5 PR IDs to fetch reviewer votes). 3. ChatGPT cross-references the creation dates and vote integers, producing a clean markdown summary of blocked or stalled PRs. ```mermaid sequenceDiagram participant User participant ChatGPT as ChatGPT (Client) participant Truto as Truto MCP Server participant ADO as Azure DevOps API User->>ChatGPT: "Audit active PRs in auth-service..." ChatGPT->>Truto: list_all_azure_dev_ops_pull_requests Truto->>ADO: GET /git/repositories/auth-service/pullrequests ADO-->>Truto: PR list payload Truto-->>ChatGPT: JSON result ChatGPT->>Truto: list_all_azure_dev_ops_pull_request_reviewers Truto->>ADO: GET /git/repositories/auth-service/pullrequests/{id}/reviewers ADO-->>Truto: Reviewers payload Truto-->>ChatGPT: JSON result ChatGPT-->>User: Markdown summary of blocked PRs ``` ### Scenario 2: Branch Protection Posture Check A DevOps Admin needs to verify that the main branch of a project is properly protected against unauthorized pushes. > "Audit the branch policies for the 'payment-gateway' project. Find the policy configuration that handles minimum reviewers for the 'main' branch. How many reviewers are required, and can the submitter approve their own PR?" **Tool Execution Sequence:** 1. `list_all_azure_dev_ops_policy_configurations` (Passes `project='payment-gateway'`). 2. ChatGPT filters the list to find the policy scoped to `refs/heads/main` matching the minimum reviewer UUID type. 3. `get_single_azure_dev_ops_policy_configuration_by_id` (Passes the specific `configurationId` found in step 1). 4. ChatGPT parses the nested `settings` object to extract `minimumApproverCount` and `allowDownvotes`, then answers the admin. ## Security and Access Control Because Truto's MCP servers are authenticated by the URL token itself, they are designed to be tightly scoped. You have granular control over what an LLM can execute: * **Method Filtering:** By passing `"methods": ["read"]` during server creation, you prevent the LLM from executing `create`, `update`, or `delete` operations, ensuring the agent can only audit, not alter, repository data. * **Tag Filtering:** Limit the server's surface area to specific operational domains by passing `"tags": ["pull_requests", "policy"]`. Operations related to work items or pipelines are completely hidden from the LLM. * **API Token Auth (`require_api_token_auth`):** For enterprise security, you can configure the MCP server to require a valid Truto API token in the `Authorization` header. This ensures that even if the MCP URL is leaked in logs, unauthorized clients cannot execute tools. * **Server Expiration (`expires_at`):** You can assign an ISO datetime to the server configuration. The platform's edge storage automatically purges the token upon expiration, immediately revoking LLM access - ideal for granting temporary audit access to a contractor's agent. ## Rate Limits and Production Reliability When writing automated agent loops, it is easy to accidentally exhaust vendor API limits. Azure DevOps enforces strict rate limiting, particularly for complex nested queries. **Factual note on rate limits:** Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream Azure DevOps API returns an HTTP 429 Too Many Requests error, Truto passes that error directly back to the caller. Truto normalizes the upstream rate limit information into standardized headers (`ratelimit-limit`, `ratelimit-remaining`, `ratelimit-reset`) per the IETF specification. The caller (or the agent orchestration framework) is entirely responsible for detecting the error, reading the reset headers, and implementing appropriate retry and exponential backoff logic. ## Wrap-up Building an AI agent to audit Azure DevOps pull requests and branch policies requires more than just API keys. You need a secure proxy layer that translates complex hierarchical routing, obscure enums, and nested policy schemas into clean, LLM-friendly tools. By leveraging Truto's dynamic MCP server generation, you eliminate the need to write custom integration code, drastically reducing the time it takes to give ChatGPT secure, audited access to your enterprise repositories. > Stop writing boilerplate API integration code. Let Truto generate secure, managed MCP servers for your AI agents in seconds. > > [Talk to us](https://truto.one/book-a-demo/)