Enhance Azure DevOps Pull Request Agent to support both direct Anthropic API and Microsoft Foundry providers, updating environment variable handling and documentation accordingly.

Author: ChgoChad

.azdo/azure-pipeline.yaml

@@ -7,7 +7,7 @@ pool:
   name: '<value>'
 
 variables:
-- group: 'PullRequestAgentSecrets' # Variable group containing secrets like ANTHROPIC_API_KEY
+- group: 'PullRequestAgentSecrets' # Contains provider secrets (ANTHROPIC_API_KEY or Foundry vars)
 
 stages:
   - stage: Build
@@ -21,6 +21,17 @@ stages:
           inputs:
             containerRegistry: $(DOCKER_SERVICECONNECTION_NAME)
             command: 'run'
+            # === Provider Configuration (choose ONE) ===
+            # Option A: Direct Anthropic API
+            #   -e ANTHROPIC_API_KEY=$(ANTHROPIC_API_KEY)
+            # Option B: Microsoft Foundry (API key auth)
+            #   -e CLAUDE_CODE_USE_FOUNDRY=1
+            #   -e ANTHROPIC_FOUNDRY_RESOURCE=$(ANTHROPIC_FOUNDRY_RESOURCE)
+            #   -e ANTHROPIC_FOUNDRY_API_KEY=$(ANTHROPIC_FOUNDRY_API_KEY)
+            # Option B alt: Microsoft Foundry (Entra ID auth — no API key)
+            #   -e CLAUDE_CODE_USE_FOUNDRY=1
+            #   -e ANTHROPIC_FOUNDRY_RESOURCE=$(ANTHROPIC_FOUNDRY_RESOURCE)
+            # =============================================
             arguments: >-
               --name pr-agent-container
               -e ANTHROPIC_API_KEY=$(ANTHROPIC_API_KEY)

AGENTS.md

@@ -57,7 +57,7 @@ This file provides context and rules for AI-assisted coding platforms (GitHub Co
 # Restore and build
 dotnet build src/ADOPullRequestAgent/ADOPullRequestAgent.csproj
 
-# Run (requires ANTHROPIC_API_KEY env var set)
+# Run (requires provider env vars — see Environment Variables below)
 dotnet run --project src/ADOPullRequestAgent -- \
   --ado-token "<token>" \
   --pull-request-id <id> \
@@ -73,16 +73,27 @@ docker build -t ado-pr-agent .
 
 ## Environment Variables
 
+The agent supports two Claude Code providers, selected at runtime. Set one group:
+
 | Variable | Required | Description |
 |---|---|---|
-| `ANTHROPIC_API_KEY` | Yes | Anthropic API key — used by Claude Code CLI for authentication |
+| **Direct Anthropic API** | | |
+| `ANTHROPIC_API_KEY` | Conditional | Anthropic API key — required when using direct Anthropic API |
+| **Microsoft Foundry** | | |
+| `CLAUDE_CODE_USE_FOUNDRY` | Conditional | Set to `1` to enable Microsoft Foundry provider |
+| `ANTHROPIC_FOUNDRY_RESOURCE` | Conditional | Foundry resource name — used when Foundry is enabled |
+| `ANTHROPIC_FOUNDRY_API_KEY` | Conditional | Foundry API key — used when Foundry is enabled with API key auth |
+| `ANTHROPIC_DEFAULT_SONNET_MODEL` | No | Optional model deployment name override for Foundry |
+| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | No | Optional model deployment name override for Foundry |
+| **Internal** | | |
 | `ADO_MCP_AUTH_TOKEN` | Runtime | Azure DevOps access token — set internally by `PullRequestAgent` for the MCP server; passed via `--ado-token` CLI arg |
 
 ## Key Architecture Decisions
 
 - **Claude Code CLI invocation:** `PullRequestAgent.RunAsync()` shells out to `claude -p` (non-interactive mode) via `System.Diagnostics.Process`. It builds an MCP config JSON at runtime with two MCP servers (Azure DevOps for PR data, Microsoft Learn for best practices) and passes the system prompt via `--system-prompt-file`.
 - **System prompt:** The review persona and checklist live in `pullreview.prompt`, which is loaded at runtime. Edits to the review behavior should target this file, not C# code.
 - **MCP server configuration:** The Azure DevOps MCP server is configured in a JSON file passed to `--mcp-config`. The ADO authentication token is passed through the `env` field in the MCP config, keeping it out of command-line arguments.
+- **Provider selection:** The agent supports both direct Anthropic API and Microsoft Foundry as Claude Code providers, selected at runtime via environment variables. The `ConfigureProviderEnvironment` method in `PullRequestAgent.cs` detects `CLAUDE_CODE_USE_FOUNDRY=1` for Foundry mode, otherwise falls back to `ANTHROPIC_API_KEY`.
 - **Output:** The review is written to stdout and optionally to `pull_request_<id>_review.md` in the specified output directory. Claude also saves structured review files (`review/code_review.md` and optionally `review/code_review_summary.md`) as instructed by the system prompt.
 
 ## Guidelines for AI Assistants

Dockerfile

@@ -41,6 +41,10 @@ RUN npm install -g @anthropic-ai/claude-code
 # Pre-install the Azure DevOps MCP package globally so npx doesn't download it at runtime
 RUN npm install -g @azure-devops/mcp@latest
 
+# (Optional) Install Azure CLI for Microsoft Foundry with Entra ID authentication.
+# Uncomment the line below if using Foundry with Entra ID auth instead of API key auth.
+RUN curl -sL https://aka.ms/InstallAzureCLIDeb | bash
+
 COPY --from=build /app/publish .
 
 # Create writable directories for the non-root user

README.md

@@ -47,7 +47,9 @@ The review output is a Markdown report that can be saved to a file or posted dir
 - [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet/10.0)
 - [Node.js](https://nodejs.org/) (for the Azure DevOps MCP server via `npx`)
 - [Claude Code CLI](https://docs.anthropic.com/en/docs/claude-code) installed (`npm install -g @anthropic-ai/claude-code`)
-- An **Anthropic API key** (set as `ANTHROPIC_API_KEY` environment variable)
+- **One** of the following authentication providers:
+  - **Direct Anthropic API** — an Anthropic API key (set as `ANTHROPIC_API_KEY`)
+  - **Microsoft Foundry** — a Foundry resource with API key (`ANTHROPIC_FOUNDRY_API_KEY`) or Entra ID auth (`az login`)
 - An **Azure DevOps access token** with read access to the target repository and pull requests
 
 ## Getting started
@@ -63,9 +65,21 @@ cd ADOPullRequestAgent
 
 ### 2. Set environment variables
 
+Choose **one** provider:
+
 ```bash
-# Required by Claude Code CLI
+# Option A: Direct Anthropic API
 export ANTHROPIC_API_KEY="<your-anthropic-api-key>"
+
+# Option B: Microsoft Foundry (API key auth)
+export CLAUDE_CODE_USE_FOUNDRY=1
+export ANTHROPIC_FOUNDRY_RESOURCE="<your-foundry-resource-name>"
+export ANTHROPIC_FOUNDRY_API_KEY="<your-foundry-api-key>"
+
+# Option B alt: Microsoft Foundry (Entra ID auth — no API key needed)
+export CLAUDE_CODE_USE_FOUNDRY=1
+export ANTHROPIC_FOUNDRY_RESOURCE="<your-foundry-resource-name>"
+az login  # authenticate with Azure first
 ```
 
 ### 3. Obtain an Azure DevOps token
@@ -115,6 +129,8 @@ Build and run the agent as a container:
 
 ```bash
 docker build -t ado-pr-agent .
+
+# Option A: Direct Anthropic API
 docker run --rm \
   -e ANTHROPIC_API_KEY="<your-api-key>" \
   -v /path/to/local/clone:/sources \
@@ -126,6 +142,21 @@ docker run --rm \
   --repository-name <repo> \
   --model "claude-sonnet-4-20250514" \
   --sources-directory /sources
+
+# Option B: Microsoft Foundry
+docker run --rm \
+  -e CLAUDE_CODE_USE_FOUNDRY=1 \
+  -e ANTHROPIC_FOUNDRY_RESOURCE="<your-resource-name>" \
+  -e ANTHROPIC_FOUNDRY_API_KEY="<your-foundry-api-key>" \
+  -v /path/to/local/clone:/sources \
+  ado-pr-agent \
+  --ado-token "<ado-token>" \
+  --pull-request-id <pr-id> \
+  --organization-name <org> \
+  --project-name <project> \
+  --repository-name <repo> \
+  --model "claude-sonnet-4-6" \
+  --sources-directory /sources
 ```
 
 ## Azure DevOps pipeline integration
@@ -144,16 +175,24 @@ The agent is designed to run as a **build validation policy** on pull requests.
 
 ### Required pipeline variables
 
-These should be configured in a variable group (e.g., `Claude-Code`):
+These should be configured in a variable group (e.g., `PullRequestAgentSecrets`):
 
 | Variable | Description |
 |---|---|
-| `ANTHROPIC_API_KEY` | Anthropic API key for Claude Code CLI |
 | `ACR_NAME` | Azure Container Registry name |
 | `DOCKER_SERVICECONNECTION_NAME` | ACR service connection |
 | `ADO_ORGANIZATION_NAME` | Azure DevOps organization |
 | `MODEL_NAME` | The Claude model to use (e.g., `claude-sonnet-4-20250514`) |
 
+**Provider variables** (choose one set):
+
+| Variable | Provider | Description |
+|---|---|---|
+| `ANTHROPIC_API_KEY` | Direct Anthropic | Anthropic API key |
+| `CLAUDE_CODE_USE_FOUNDRY` | Foundry | Set to `1` to enable Foundry mode |
+| `ANTHROPIC_FOUNDRY_RESOURCE` | Foundry | Foundry resource name |
+| `ANTHROPIC_FOUNDRY_API_KEY` | Foundry | Foundry API key (if not using Entra ID) |
+
 > [!NOTE]
 > The pipeline uses `$(System.AccessToken)` for Azure DevOps authentication, so no additional ADO PAT is required when running within a pipeline.
 

src/ADOPullRequestAgent/PullRequestAgent.cs

@@ -114,7 +114,7 @@ private string BuildMcpConfig(string organizationName)
                     },
                     ["microsoft-learn"] = new
                     {
-                        type = "url",
+                        type = "sse",
                         url = "https://learn.microsoft.com/api/mcp"
                     }
                 }
@@ -135,7 +135,8 @@ private List<string> BuildClaudeArguments(string systemPromptPath, string mcpCon
                 "--model", _agentOptions.Model,
                 "--system-prompt-file", systemPromptPath,
                 "--mcp-config", mcpConfigPath,
-                "--no-session-persistence"
+                "--no-session-persistence",
+                "--allowedTools", "mcp__azure-devops__*,mcp__microsoft-learn__*,Bash(git *),Bash(cat *),Read,Write,Glob,Grep,Edit"
             };
 
             if (_agentOptions.MaxTurns.HasValue)
@@ -170,15 +171,10 @@ private List<string> BuildClaudeArguments(string systemPromptPath, string mcpCon
                 WorkingDirectory = _agentOptions.SourcesDirectory
             };
 
-            // Pass ANTHROPIC_API_KEY from current environment
-            var anthropicApiKey = Environment.GetEnvironmentVariable("ANTHROPIC_API_KEY");
-            if (string.IsNullOrWhiteSpace(anthropicApiKey))
-            {
-                throw new InvalidOperationException("ANTHROPIC_API_KEY environment variable is not set. This is required for Claude Code CLI.");
-            }
-            startInfo.Environment["ANTHROPIC_API_KEY"] = anthropicApiKey;
+            // Configure the Claude Code provider (direct Anthropic API or Microsoft Foundry)
+            ConfigureProviderEnvironment(startInfo, logger);
 
-            // Pass ADO token for the MCP server
+            // Pass ADO token for the MCP server (provider-independent)
             startInfo.Environment["ADO_MCP_AUTH_TOKEN"] = _adoMcpAuthenticationToken;
 
             foreach (var arg in arguments)
@@ -235,6 +231,63 @@ private List<string> BuildClaudeArguments(string systemPromptPath, string mcpCon
             return (process.ExitCode, stdout, stderr);
         }
 
+        /// <summary>
+        /// Detects the configured Claude Code provider and sets the appropriate environment variables
+        /// on the process start info. Supports direct Anthropic API and Microsoft Foundry.
+        /// </summary>
+        /// <param name="startInfo">The process start info to configure with provider environment variables.</param>
+        /// <param name="logger">Logger for recording which provider is selected.</param>
+        /// <exception cref="InvalidOperationException">
+        /// Thrown when no provider is configured (neither ANTHROPIC_API_KEY nor CLAUDE_CODE_USE_FOUNDRY is set).
+        /// </exception>
+        private static void ConfigureProviderEnvironment(ProcessStartInfo startInfo, ILogger logger)
+        {
+            var useFoundry = Environment.GetEnvironmentVariable("CLAUDE_CODE_USE_FOUNDRY");
+            var anthropicApiKey = Environment.GetEnvironmentVariable("ANTHROPIC_API_KEY");
+
+            if (string.Equals(useFoundry, "1", StringComparison.Ordinal))
+            {
+                // Microsoft Foundry mode — forward all relevant Foundry env vars
+                startInfo.Environment["CLAUDE_CODE_USE_FOUNDRY"] = "1";
+
+                string[] foundryVars =
+                [
+                    "ANTHROPIC_FOUNDRY_RESOURCE",
+                    "ANTHROPIC_FOUNDRY_BASE_URL",
+                    "ANTHROPIC_FOUNDRY_API_KEY",
+                    "ANTHROPIC_DEFAULT_SONNET_MODEL",
+                    "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+                    "ANTHROPIC_DEFAULT_OPUS_MODEL"
+                ];
+
+                foreach (var name in foundryVars)
+                {
+                    var value = Environment.GetEnvironmentVariable(name);
+                    if (!string.IsNullOrWhiteSpace(value))
+                    {
+                        startInfo.Environment[name] = value;
+                    }
+                }
+
+                var resource = Environment.GetEnvironmentVariable("ANTHROPIC_FOUNDRY_RESOURCE") ?? "(not set)";
+                logger.LogInformation("Using Microsoft Foundry provider (resource: {Resource})", resource);
+            }
+            else if (!string.IsNullOrWhiteSpace(anthropicApiKey))
+            {
+                // Direct Anthropic API mode
+                startInfo.Environment["ANTHROPIC_API_KEY"] = anthropicApiKey;
+                logger.LogInformation("Using direct Anthropic API provider");
+            }
+            else
+            {
+                throw new InvalidOperationException(
+                    "No Claude Code provider configured. Set one of the following:" + Environment.NewLine +
+                    "  - ANTHROPIC_API_KEY for direct Anthropic API access" + Environment.NewLine +
+                    "  - CLAUDE_CODE_USE_FOUNDRY=1 with ANTHROPIC_FOUNDRY_RESOURCE for Microsoft Foundry access" + Environment.NewLine +
+                    "See README.md for details.");
+            }
+        }
+
         /// <summary>
         /// Attempts to delete a file, suppressing any exceptions.
         /// </summary>