Troubleshooting
| Message | Fix |
|---|---|
| Missing Authorization: Bearer header | No token presented. Set DEVOPS_API_KEY and pass it as the Authorization header, then restart the agent |
| No Azure DevOps token presented… | Same cause, seen from inside a tool call |
| No Azure DevOps organisation or project configured… | x-devops-org or x-devops-project is missing. Both are required — the server has no defaults. Add them, then restart the agent |
| Azure DevOps rejected the PAT (401)… | The token expired or was revoked. Reissue it and update DEVOPS_API_KEY |
| Azure DevOps refused the write (401)… | The PAT lacks vso.work_write — or has expired. If reads are failing too it’s expiry; otherwise reissue with Work Items → Read & write |
| Write tools are disabled in autonomous sessions. | Expected. Re-run with a person present |
| Work item N was not found in… | Wrong id, or the item lives in another organisation or project — check x-devops-org / x-devops-project |
| Team 'X' was not found in… | Set x-devops-team to a real team name, or pass team |
A 401 on a write is ambiguous
Section titled “A 401 on a write is ambiguous”Azure DevOps refuses a scope-insufficient write with an empty 401, not the 403 you’d expect, and answers an invalid PAT with HTTP 203 and an HTML sign-in page. Both are caught and named, but a 401 on a write alone cannot separate “wrong scope” from “expired” — which is why that message carries the disambiguator. If your reads are failing too, it’s expiry.
Nothing connects at all
Section titled “Nothing connects at all”MCP server lists are read at session startup. After editing your config, fully restart the agent session — not just the chat — and confirm the server shows connected in the agent’s MCP settings.