Configure Agency MCP tools

[JeffreyCA]

Summary

This PR adds repository-scoped Agency configuration for Microsoft contributors. It preconfigures the Azure DevOps MCP for the azure-sdk organization and the Kusto MCP for the shared DevCli telemetry database.

Access and data handling

• The configuration contains service scopes and endpoints, not credentials.
• Microsoft Entra authentication and existing Azure DevOps and Kusto permissions continue to control access.
• Contributor guidance directs agents to use the tools only for authorized work and to follow the repository's telemetry privacy and data-classification requirements.

Testing

• Parsed agency.toml with Python's TOML parser.
• Confirmed the configured Azure DevOps MCP is scoped to the azure-sdk organization.
• Confirmed a read-only Kusto connectivity query succeeds against the DevCli database.
• Ran the repository spell checker and git diff --check.

[azure-pipelines]

Azure Pipelines:
21 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
21 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds repository-scoped Agency configuration for authorized Microsoft contributor access to Azure DevOps and Kusto MCP tools.

Changes:

• Configures Azure DevOps and Kusto MCP integrations.
• Documents Agency usage and pipeline investigation guidance.
• Adds file-specific spelling exceptions.

Show a summary per file

File	Description
agency.toml	Defines repository MCP configuration.
README.md	Links contributors to Agency configuration.
cli/azd/AGENTS.md	Documents MCP usage and pipeline guidance.
.vscode/cspell.misc.yaml	Allows Agency configuration terminology.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Balanced

[Richard Park (richardpark-msft)]

Do the MCPs have any way to configure them so they are in read-only mode?

[Richard Park (richardpark-msft)]

(curious about my earlier comment, but it's really only applicable if you explicitly launch agency)

[JeffreyCA]

Do the MCPs have any way to configure them so they are in read-only mode?

There doesn't seem to be an official way through agency.toml, but the ADO MCP server does support a read-only header. I've submitted feedback to the Agency team internally to inquire about this and will keep it as-is for now.