MCP Tool Reference Critical Risk

mcp_ado_wit_work_item_unlink

Remove links from a work item

Part of the Azure DevOps MCP server. Enforce policies on this tool with Intercept, the open-source MCP proxy.

@azure-devops/mcp Destructive

WHEN AI AGENTS USE THIS TOOL

AI agents may call mcp_ado_wit_work_item_unlink to permanently remove or destroy resources in Azure DevOps. Without a policy, an autonomous agent could delete critical data in a loop with no way to undo the damage. Intercept blocks destructive tools by default and requires explicit human approval before enabling them.

WHY ENFORCE A POLICY ON MCP_ADO_WIT_WORK_ITEM_UNLINK

Without a policy, an AI agent could call mcp_ado_wit_work_item_unlink in a loop, permanently destroying resources in Azure DevOps. There is no undo for destructive operations. Intercept blocks this tool by default and only allows it when a human explicitly approves the action.

RECOMMENDED POLICY

Destructive tools permanently remove data. Block by default. Only enable with explicit approval workflows.

azure-devops.yaml 
tools:
  mcp_ado_wit_work_item_unlink:
    rules:
      - action: deny
        reason: "Blocked by default — enable with approval"

See the full Azure DevOps policy for all 84 tools.

DETAILS

Tool Name

mcp_ado_wit_work_item_unlink

Category

Destructive

MCP Server

Azure DevOps MCP Server

Risk Level

Critical

MORE AZURE DEVOPS TOOLS

mcp_ado_advsec_get_alerts Read
Retrieve Advanced Security alerts for a repository
mcp_ado_advsec_get_alert_details Read
Get detailed information about a specific security alert
mcp_ado_core_list_projects Read
List all projects in the organization
mcp_ado_core_list_project_teams Read
List teams within a project
mcp_ado_core_get_identity_ids Read
Retrieve identity IDs by search filter
mcp_ado_pipelines_get_builds Read
Retrieve a list of builds with optional filters
mcp_ado_pipelines_get_build_status Read
Get the status of a specific build
mcp_ado_pipelines_get_build_log Read
Retrieve complete logs for a build

View all 84 tools →

SIMILAR DESTRUCTIVE TOOLS ON OTHER SERVERS

delete_record Airtable
Remove a record
delete_session Appium
Delete the current session and clean up
appium_uninstallApp Appium
Uninstall an app from the device
deleteCompassComponent Atlassian Rovo
Delete a Compass component
deleteConfluencePage Atlassian Rovo
Delete a Confluence page
delete_resource AWS
Delete AWS resources

RELATED READING

FREQUENTLY ASKED QUESTIONS

What does the mcp_ado_wit_work_item_unlink tool do?

Remove links from a work item. It is categorised as a Destructive tool in the Azure DevOps MCP Server, which means it can permanently delete or destroy data. Block by default and require explicit approval.

How do I enforce a policy on mcp_ado_wit_work_item_unlink?

Add a rule in your Intercept YAML policy under the tools section for mcp_ado_wit_work_item_unlink. You can allow, deny, rate-limit, or validate arguments. Then run Intercept as a proxy in front of the Azure DevOps MCP server.

What risk level is mcp_ado_wit_work_item_unlink?

mcp_ado_wit_work_item_unlink is a Destructive tool with critical risk. Critical-risk tools should be blocked by default and only enabled with explicit human approval.

Can I rate-limit mcp_ado_wit_work_item_unlink?

Yes. Add a rate_limit block to the mcp_ado_wit_work_item_unlink rule in your Intercept policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block mcp_ado_wit_work_item_unlink completely?

Set action: deny in the Intercept policy for mcp_ado_wit_work_item_unlink. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides mcp_ado_wit_work_item_unlink?

mcp_ado_wit_work_item_unlink is provided by the Azure DevOps MCP server (@azure-devops/mcp). Intercept sits as a proxy in front of this server to enforce policies before tool calls reach the server.

ENFORCE POLICIES ON AZURE DEVOPS

Open source. One binary. Zero dependencies.

VIEW ON GITHUB Full Azure DevOps policy →