Investigate: 1ES target MCP service connection mapping — legacy artifact?

[jamesadevine]

Context

During the documentation fixes in #232 (fixing #227), we updated prompts to clarify that the 1ES target uses mcp-servers: entries "mapped to service connections." However, this may itself be a legacy agency-era concept that no longer applies now that both targets use MCPG.

Question

The 1ES target has a service-connection: field on MCP configs (src/compile/types.rs:711) and the create prompt's Step 8 note says:

1ES target: Custom containerized MCPs are mapped to service connections.

With MCPG now handling all MCP routing on both targets, is this service connection mapping still used? Or is it a leftover from the pre-MCPG agency platform that should be removed?

Evidence

• McpOptions.service_connection field exists in src/compile/types.rs:711-712
• No references to service_connection found in src/compile/onees.rs (the 1ES compiler)
• No 1es.*mcp cross-references found in the compile module
• The 1ES template (templates/1es-base.yml) would need to be checked for how MCPs are actually wired

Desired Outcome

1. Confirm whether service-connection: on MCP configs is still functional for the 1ES target
2. If not: remove the field from McpOptions, update docs/prompts, remove any dead code
3. If yes: document how it interacts with MCPG and ensure the prompt guidance is accurate

[jamesadevine]

Analysis: service-connection: is dead code — confirmed legacy artifact

TL;DR

The service-connection: field on MCP configs is parsed but never read. Both the standalone and 1ES targets use identical MCPG-based MCP routing. This field, along with several documentation references, should be cleaned up.

---

Evidence

1. Field exists but is never consumed

McpOptions.service_connection is defined at src/compile/types.rs:711-712:

/// Service connection name (1ES only, auto-generated if not specified)
#[serde(default, rename = "service-connection")]
pub service_connection: Option<String>,

A global search for service_connection in compilation logic (onees.rs, standalone.rs, common.rs) shows zero reads of this field. The only references to service_connection in common.rs (lines 885-926) are for ARM service connections (permissions.read/permissions.write for ADO token auth) — a completely separate concept.

2. Both targets use identical MCPG flow

The 1ES compiler (onees.rs:54) calls the exact same generate_mcpg_config() function as standalone:

let mcpg_config = generate_mcpg_config(front_matter, &ctx, &extensions)?;

And injects {{ mcpg_config }} into the 1ES template (onees.rs:74):

("{{ mcpg_config }}".into(), mcpg_config_json),

The 1ES base template (templates/1es-base.yml) wires MCPs through MCPG Docker with --network host, identically to standalone — no service connection references anywhere in the template.

3. {{ mcp_configuration }} marker doesn't exist

AGENTS.md documents {{ mcp_configuration }} as a 1ES-specific template marker that generates service connection references like:

my-mcp:
  serviceConnection: mcp-my-mcp-service-connection

But this marker is not present in templates/1es-base.yml and is not handled in onees.rs. The actual marker used by both targets is {{ mcpg_config }}.

4. generate_mcpg_config() ignores the field

The function at common.rs:1490-1665 processes container:, url:, env:, headers:, allowed:, mounts:, args:, entrypoint:, entrypoint_args: — but never touches service_connection.

---

Incorrect documentation (5 locations)

File	Line	Incorrect Claim
AGENTS.md	1564	Documents service-connection: as a functional MCP config field
prompts/create-ado-agentic-workflow.md	177	1ES target table says "MCPs via service connections"
prompts/create-ado-agentic-workflow.md	219	Step 8 note: "only built-ins with service connections"
prompts/update-ado-agentic-workflow.md	253	"only built-in MCPs with service connections"
AGENTS.md	(1ES markers section)	Documents {{ mcp_configuration }} marker that doesn't exist

---

Recommended cleanup

1. Remove service_connection field from McpOptions struct (types.rs:710-712)
2. Remove service-connection: documentation from AGENTS.md:1564
3. Remove {{ mcp_configuration }} marker documentation from AGENTS.md (1ES markers section)
4. Fix prompts/create-ado-agentic-workflow.md:177,219 — both targets use MCPG for MCPs
5. Fix prompts/update-ado-agentic-workflow.md:253 — same correction
6. Clarify the distinction between ARM service connections (for ADO tokens, still active) and MCP service connections (dead code)