--- title: It Could Work! But Should We Build It? | daily.dev description: A developer designed, but deliberately did not deploy, a system letting ChatGPT read and write Azure DevOps work items through an unapproved integration. The... canonical: https://daily.dev/posts/it-could-work-but-should-we-build-it--fck1wfkki twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: It Could Work! But Should We Build It? | daily.dev og:description: A developer designed, but deliberately did not deploy, a system letting ChatGPT read and write Azure DevOps work items through an unapproved integration. The... og:url: https://daily.dev/posts/it-could-work-but-should-we-build-it--fck1wfkki og:image: https://api.daily.dev/og/posts/Fck1WfKKi.png og:image:alt: It Could Work! But Should We Build It? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # It Could Work! But Should We Build It? **[We Are .NET](https://daily.dev/sources/wearedotnet)** · 11 min read · 0 upvotes · 0 comments ## Summary A developer designed, but deliberately did not deploy, a system letting ChatGPT read and write Azure DevOps work items through an unapproved integration. The plan combined Microsoft's Azure DevOps MCP server, OpenAI's Secure MCP Tunnel, and a Personal Access Token, proposed to be hosted in an Azure Container App with no public ingress. He built and inspected the Docker image (tunnel-client v0.0.15, @azure-devops/mcp 2.10.0) but stopped before connecting it live. Asked to rate IT's reaction, ChatGPT gave it 8/10 on a 'Pissed-Off IT Scale', since an always-on container using his personal PAT and an unapproved AI tool would create a trust model nobody authorized. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the Azure DevOps MCP server's PAT authentication mode expect the token to be formatted? It does not take the raw personal access token. The @azure-devops/mcp package's PERSONAL_ACCESS_TOKEN environment variable expects the base64 encoding of a nonempty username followed by a colon and the PAT, such as running printf '%s' 'ado-mcp:YOUR_PAT' | base64 -w 0. This differs from using a PAT directly against the Azure DevOps REST API, where the Basic auth username can be left empty. _Developers wiring up Azure DevOps MCP integrations can save setup headaches by tracking these auth quirks on daily.dev._ ### Can OpenAI's Secure MCP Tunnel run more than one instance against the same tunnel ID for high availability? No. The tunnel-client configuration documentation states only one active tunnel-client process can use a tunnel ID at a time when launching a stdio MCP server, because each instance keeps its own MCP child process and session state. Running two instances risks a session-initializing request reaching one instance while a later tool call reaches the other, so deployments must avoid overlapping replicas during rollouts. _Anyone architecting a tunneled stdio MCP deployment can weigh these tradeoffs by following MCP infrastructure discussions on daily.dev._ ### Is it safe to use a personal access token as the identity for an always-on AI integration service? No, this is discouraged. Microsoft's PAT guidance explicitly advises against using PATs as long-term credentials for production applications and services, since the credential belongs to an individual while an unattended container would run continuously under their identity and privileges, making actions hard to attribute to the actual caller. _Teams deciding how to authenticate AI coding integrations can keep up with credential best practices via daily.dev._ ## Similar posts on daily.dev - [Azure DevOps Remote MCP Server Lands in Microsoft Foundry, Giving AI Agents Direct Access to Your DevOps Data](https://daily.dev/posts/azure-devops-remote-mcp-server-lands-in-microsoft-foundry-giving-ai-agents-direct-access-to-your-de-ratpbscbj) · DevOps.com · 1 upvotes · 0 comments - [Azure DevOps Remote MCP Server Reaches GA, Without Support for Claude, ChatGPT, or Cursor](https://daily.dev/posts/azure-devops-remote-mcp-server-reaches-ga-without-support-for-claude-chatgpt-or-cursor-8ihvsd0no) · InfoQ · 0 upvotes · 0 comments - [How to Add MCP Servers to ChatGPT](https://daily.dev/posts/how-to-add-mcp-servers-to-chatgpt-awxv0wlfn) · Docker · 2 upvotes · 0 comments --- Tags: [#chatgpt](https://daily.dev/tags/chatgpt), [#mcp](https://daily.dev/tags/mcp), [#oauth](https://daily.dev/tags/oauth), [#azure-devops](https://daily.dev/tags/azure-devops) [View this post on daily.dev](https://daily.dev/posts/it-could-work-but-should-we-build-it--fck1wfkki) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"It Could Work! But Should We Build It?","url":"https://daily.dev/posts/it-could-work-but-should-we-build-it--fck1wfkki","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/it-could-work-but-should-we-build-it--fck1wfkki"},"datePublished":"2026-10-30T09:18:29.571Z","dateModified":"2026-10-30T09:20:36.827Z","description":"A developer designed, but deliberately did not deploy, a system letting ChatGPT read and write Azure DevOps work items through an unapproved integration. The...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"We Are .NET","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"We Are .NET","logo":"https://media.daily.dev/image/upload/s--BsnVOa3i--/f_auto/v1718347410/logos/wearedotnet","url":"https://daily.dev/sources/wearedotnet"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/it-could-work-but-should-we-build-it--fck1wfkki","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"chatgpt,mcp,oauth,azure-devops","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"We Are .NET","item":"https://daily.dev/sources/wearedotnet"},{"@type":"ListItem","position":3,"name":"It Could Work! But Should We Build It?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/it-could-work-but-should-we-build-it--fck1wfkki#faq","mainEntity":[{"@type":"Question","name":"How does the Azure DevOps MCP server's PAT authentication mode expect the token to be formatted?","acceptedAnswer":{"@type":"Answer","text":"It does not take the raw personal access token. The @azure-devops/mcp package's PERSONAL_ACCESS_TOKEN environment variable expects the base64 encoding of a nonempty username followed by a colon and the PAT, such as running printf '%s' 'ado-mcp:YOUR_PAT' | base64 -w 0. This differs from using a PAT directly against the Azure DevOps REST API, where the Basic auth username can be left empty. Developers wiring up Azure DevOps MCP integrations can save setup headaches by tracking these auth quirks on daily.dev."}},{"@type":"Question","name":"Can OpenAI's Secure MCP Tunnel run more than one instance against the same tunnel ID for high availability?","acceptedAnswer":{"@type":"Answer","text":"No. The tunnel-client configuration documentation states only one active tunnel-client process can use a tunnel ID at a time when launching a stdio MCP server, because each instance keeps its own MCP child process and session state. Running two instances risks a session-initializing request reaching one instance while a later tool call reaches the other, so deployments must avoid overlapping replicas during rollouts. Anyone architecting a tunneled stdio MCP deployment can weigh these tradeoffs by following MCP infrastructure discussions on daily.dev."}},{"@type":"Question","name":"Is it safe to use a personal access token as the identity for an always-on AI integration service?","acceptedAnswer":{"@type":"Answer","text":"No, this is discouraged. Microsoft's PAT guidance explicitly advises against using PATs as long-term credentials for production applications and services, since the credential belongs to an individual while an unattended container would run continuously under their identity and privileges, making actions hard to attribute to the actual caller. Teams deciding how to authenticate AI coding integrations can keep up with credential best practices via daily.dev."}}]} ```