# Copilot Studio MCP (npm · copilot-studio-mcp) Build, test, ship and maintain Microsoft Copilot Studio agents from the editor - Trust score: 72/100 (medium) - Change this week: +4 - Registry status: active - Liveness: live - Owner verified: no - Last scored: 2026-09-20 ## Components - npm · `copilot-studio-mcp`: 72/100 (this document), [markdown](https://verifymcp.io/servers/jgt87-copilot-studio-mcp/copilot-studio-mcp.md), [page](https://verifymcp.io/servers/jgt87-copilot-studio-mcp/copilot-studio-mcp) ## Channel facts - Registry: `npm` - Package: `copilot-studio-mcp` - Version: `0.1.7` - Transport: `stdio` ## Trust breakdown How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog) Scored 2026-09-20. - **Supply Chain Security**: 98/100 - No malware found by supply-chain analysis. - No known CVEs affecting this package version or its production dependencies. - No install/post-install scripts declared. - 60 of 157 dependencies flagged as unhealthy (1 deprecated). - **Provenance & Transparency**: 45/100 - Source repository is publicly reachable at the declared URL. - Provenance check failed: no build-provenance attestation is published. - Clear OSI-approved license (MIT). - Actively maintained (last published 5 days ago). - Disclosure check failed: no security disclosure policy was found in the source repository. - **Schema Quality & AI Usability**: 76/100 - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name). - AI-judged instruction clarity (excellent). - Context-footprint check failed: tool/resource definitions use about 34022 tokens (~239/item across 142 items; 142 tools + 0 resources), over budget; trim descriptions and params. - Usage-examples check failed: none of the tools include examples. - **Stability & Change Management**: 30/100 - Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses. - **Tool Coverage**: 95/100 - 100% of tools have a non-trivial description (not blank, and not just the tool's name). - 85% of tool parameters carry a description. - **Tool Safety**: 75/100 - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured. - 0 of 16 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "cs_logout" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. - An AI judge read all 143 captured unit(s) of tool text and found none that tries to manipulate the model reading it. - **Capabilities**: 100/100 - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28. ## Install ### How do I install the Copilot Studio MCP server? Copilot Studio MCP runs locally as an npm package, launched with npx -y copilot-studio-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation. ### Claude ```bash claude mcp add jgt87-copilot-studio-mcp -- npx -y copilot-studio-mcp ``` ### Cursor ```json { "mcpServers": { "jgt87-copilot-studio-mcp": { "command": "npx", "args": [ "-y", "copilot-studio-mcp" ] } } } ``` ### VS Code ```json { "servers": { "jgt87-copilot-studio-mcp": { "command": "npx", "args": [ "-y", "copilot-studio-mcp" ] } } } ``` ### Codex ```bash codex mcp add jgt87-copilot-studio-mcp -- npx -y copilot-studio-mcp ``` ### opencode ```json { "$schema": "https://opencode.ai/config.json", "mcp": { "jgt87-copilot-studio-mcp": { "type": "local", "command": [ "npx", "-y", "copilot-studio-mcp" ], "enabled": true } } } ``` ### OpenClaw ```bash openclaw mcp add jgt87-copilot-studio-mcp --command npx --arg -y --arg copilot-studio-mcp ``` ### Hermes ```yaml mcp_servers: jgt87-copilot-studio-mcp: command: "npx" args: ["-y", "copilot-studio-mcp"] ``` ### Netclaw ```json { "McpServers": { "jgt87-copilot-studio-mcp": { "Transport": "stdio", "Command": "npx", "Arguments": [ "-y", "copilot-studio-mcp" ] } } } ``` ### Vellum ```bash assistant mcp add jgt87-copilot-studio-mcp -t stdio -c npx -a -y copilot-studio-mcp ``` ### Other ```json { "mcpServers": { "jgt87-copilot-studio-mcp": { "command": "npx", "args": [ "-y", "copilot-studio-mcp" ] } } } ``` ## Changelog Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims. ### 2026-09-19 (score 72, +1) No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes. ### 2026-09-17 (score 71, 0) - [functional regression] Security disclosure: unverified → fail ### 2026-09-16 (score 71, +1) - [functional regression] Security disclosure: fail → unverified ### 2026-09-15 (score 70, +15) - [security improvement] Malware scan: unverified → pass ### 2026-09-14 (score 55, −13) - [security regression] Malware scan: pass → unverified - [security regression] Tool safety: pass → unverified - [security] Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. - [functional regression] Capabilities: pass → unverified - [functional regression] Tool coverage: 100 → unverified - [functional regression] Schema quality: 100 → unverified - [functional improvement] Stability: unverified → 0.10 - [functional] Package version: 0.1.6 → 0.1.7 ### 2026-09-13 (score 68, +15) - [security improvement] Malware scan: unverified → pass ### 2026-09-11 (score 53) First indexed and scored. ## MCP tools (142) ### `cs_init` (~186 tokens) Start a session Check whether this machine is ready to work: the pac CLI and .NET, which pac auth profile is active, which cloud resources have a usable token, the environment variables, the write policy in force, and the agent workspace it found, ending with the next steps for that workspace. Read-only. Call it once at the start of a session, and again when a tool fails and you need to know whether the CLI, the credentials or the workspace is the reason. It reports the state of the machine and nothing else: when the user asked for something specific - an agent, a flow, a solution, an environment, instructions - call the tool for that thing instead. cs_create_agent scaffolds or creates an agent; cs_guide explains a task. Input parameters: - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_login` (~401 tokens) Sign in (MSAL) Acquire a Microsoft Entra token for the cloud tools (evaluations, environments, agents, publish, chat, drift). mode 'interactive' (default) starts a browser sign-in and returns within waitSeconds: status 'ok' when it completed, otherwise status 'pending' with the sign-in URL. If no browser opened, show the user that URL to open on the machine running this server; the page redirects to localhost and the login completes in the background (check cs_login_status or call any cloud tool). mode 'device_code' returns a code to enter at microsoft.com/devicelogin (some tenants block this flow). Not needed for pac commands, which use 'pac auth create'. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `dataverseUrl` (string): Required when scope is dataverse, e.g. https://org.crm.dynamics.com - `mode` (string): Default interactive - `openBrowser` (boolean): interactive: try to open the browser from the server (default true). Set false when the server runs where no browser can appear. - `scope` (string): Which resource to pre-authorise. Default powerplatform (evaluations); 'flow' is the Power Automate service used by the flow-run tools; 'graph' reads the Microsoft 365 agent catalogue and 'graph_write… - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `waitSeconds` (number): interactive: how long to wait for the sign-in before returning 'pending' (default 15; keep it below the client's tool timeout) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_login_status` (~137 tokens) Sign-in status Answer 'am I signed in?' for the cloud tools: the cached MSAL accounts, and whether a browser or device-code sign-in is still pending, with its URL or code; optionally wait for it to complete. For the separate pac sign-in, cs_auth_who. Input parameters: - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `wait` (boolean): Block until the pending sign-in completes (up to 10 minutes) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_logout` (~43 tokens) Sign out Remove cached MSAL accounts for the tenant. Input parameters: - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. ### `cs_set_tool_preset` (~161 tokens) Choose how many tools are offered Answer 'there are too many tools': narrow, or restore, the tool list for the rest of this session. The full list is 142 tools and about 50k tokens of schema, which crowds a smaller model's context and makes it choose worse. Presets: core (the loop that builds an agent and gets it live), authoring (local files only), admin (tenant administration), solutions (moving solutions between environments), full (everything). Read-only: it changes nothing in any environment and no tool is lost, only hidden. Ask the user before calling it. Input parameters: - `keep` (array): Extra tool names to keep on top of the preset - `preset` (string, required): Which set to offer for the rest of this session ### `cs_list_environments` (~88 tokens) List environments List Power Platform environments the signed-in user can access (BAP API), with Dataverse URLs. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. ### `cs_list_agents` (~195 tokens) List agents List Copilot Studio agents in an environment. via 'pac' uses 'pac copilot list' (needs a pac auth profile); via 'dataverse' queries the bots table with the MSAL token. Default auto: pac when available, else dataverse. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `dataverseUrl` (string) - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `ownerOnly` (boolean) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `via` (string) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_create_agent` (~408 tokens) Create a new agent pac copilot init: create a new agent workspace on disk. Without 'environment' it is a local scaffold (no sign-in). With 'environment' it also creates the live agent and connects the workspace (needs pac auth profile and confirm: true). With 'solutionName' the agent is created inside that solution (existing unmanaged solution, or a new one with createSolution: true) via init, pack, import and clone; without it, pac puts the agent in a solution named after the agent. authoringMode 'classic' is the standard harness (topics, evaluations); 'cli-copilot' is the GitHub Copilot harness. Input parameters: - `authoringMode` (string) - `background` (boolean): Run in the background and return a jobId immediately, then poll cs_job_status. MCP clients cut a tool call off after about 60 seconds; this operation can take much longer, and without this the work i… - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `createSolution` (boolean): Create solutionName if it does not exist - `environment` (string): Environment id or URL to bootstrap into (creates a live agent) - `instructions` (string) - `name` (string, required): Agent display name - `projectDir` (string): Folder for the agent's files, new or empty. Omit it to be offered one named after the agent. - `publisherPrefix` (string): Publisher prefix, 2-8 lowercase letters or digits: it becomes part of every component's schema name and must match the publisher of the solution the agent lands in. Omit it to be shown the publishers… - `schemaName` (string) - `solutionName` (string): Unique name of the solution to create the agent in (requires environment) - `template` (string): classic only ### `cs_clone_agent` (~134 tokens) Clone an agent to disk pac copilot clone: download an existing agent into a sync-connected workspace (a subfolder named after the agent under outputDir). Needs a pac auth profile. Records a sync stamp (.mcs/cs-sync.json) that cs_check_drift and the cs_push preflight compare against. Input parameters: - `bot` (string): Agent id (GUID) or schema name; omit to be shown the agents in the environment - `componentCollections` (array) - `displayName` (string): Folder name override - `environment` (string): Environment id or URL; default active profile - `outputDir` (string) ### `cs_pull` (~98 tokens) Pull remote changes pac copilot pull: three-way merge of server changes into the local workspace (also downloads knowledge files). Run before editing and before pushing. Records a sync stamp (.mcs/cs-sync.json) so cs_check_drift can tell later portal changes from yours; commit the workspace afterwards to keep a reviewable history. Input parameters: - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_push` (~217 tokens) Push local changes Send local file changes up into the agent's draft in Copilot Studio - topics, knowledge files, flows, connection references - so the draft matches your workspace (pac copilot push). This is the tool for 'upload', 'send my changes up' and 'sync my edits'. It only moves files into the draft; cs_publish is the separate step afterwards. Validates YAML first and blocks on errors unless force. The dry run also reports components changed in Copilot Studio since the last sync (quick drift check, needs a cached cs_login); when one of those also changed locally the push is blocked unless force. Changes the agent in Copilot Studio: requires confirm: true. Input parameters: - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `force` (boolean): Push even if validation reports errors or portal changes conflict with local edits - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_pack` (~98 tokens) Pack workspace into a solution zip pac copilot pack: local-only packaging of the workspace into a Dataverse solution .zip (no sign-in). Also a cheap structural check of the workspace. outputPath must be outside the workspace. Input parameters: - `outputPath` (string) - `publisherPrefix` (string, required) - `solutionName` (string) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_import_solution` (~91 tokens) Import a solution zip pac solution import of a packed agent (from cs_pack) into an environment. Mutates the environment: requires confirm: true. Input parameters: - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `environment` (string) - `forceOverwrite` (boolean) - `path` (string, required) - `publishChanges` (boolean) ### `cs_publish` (~336 tokens) Publish the agent Make the agent's current draft visible to real users on its channels - the tool for 'go live', 'release it' and 'make my changes live'. It publishes what is already in Copilot Studio, so send local edits up with cs_push first. via 'pac' runs 'pac copilot publish'; via 'dataverse' calls the PvaPublish action with the MSAL token and polls until publishedon changes. Requires confirm: true. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, then poll cs_job_status. MCP clients cut a tool call off after about 60 seconds; this operation can take much longer, and without this the work i… - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `dataverseUrl` (string) - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `timeoutSeconds` (number) - `via` (string) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_status` (~91 tokens) Agent provisioning status pac copilot status for an agent id. Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_check_drift` (~274 tokens) Detect portal changes since the last sync Find changes made directly in Copilot Studio after the workspace was last cloned, pulled or pushed. mode 'quick' (default) reads the agent's component rows from Dataverse and compares them with the sync stamp: which topics, tools and knowledge sources changed, by whom, when, whether the agent settings changed and whether there are unpublished changes; needs a cached cs_login, no pac. mode 'full' runs pac copilot clone into a temporary folder and classifies every file as local-modified, remote-modified or both (conflict) against the stamp, with unified diffs. Both are read-only. Resolve drift with cs_pull (three-way merge), then commit. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `includeDiffs` (boolean): full: include unified diffs (default true) - `keepClone` (boolean): full: keep the temporary clone and return its path - `mode` (string) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_pac` (~137 tokens) Run any pac command Escape hatch: run 'pac ' directly. Read-only commands (list/who/status/help) run immediately; anything else needs confirm: true. 'profile' runs it as another pac auth profile, for example the tenant admin account. Input parameters: - `args` (array, required): Arguments after 'pac', e.g. ["env","list"] - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string) - `profile` (string): pac auth profile to run as (cs_init lists them) - `timeoutSeconds` (number) ### `cs_build_flow_definition` (~250 tokens) Build a flow definition from steps Compose a Power Automate cloud flow definition from a step spec, without touching any environment: a trigger (agent-callable by default, or manual, HTTP, schedule or a connector trigger) plus steps (connector operations, HTTP calls, conditions, loops, scopes, variables, compose, terminate, response, or raw JSON). Steps run in order. Returns the definition, the connection references it needs and any notes, and can write it to a file. Feed the same spec to cs_create_flow to create the flow, or cs_update_flow to replace an existing one. Use cs_list_connectors and cs_describe_connector to find connector ids, operation ids and their parameters first. Input parameters: - `connectionReferencePrefix` (string): Prefix for generated connection reference names, usually your publisher prefix - `description` (string) - `name` (string, required) - `outputFile` (string): Write the definition JSON here as well - `outputs` (array): What the flow answers with (agent-callable and HTTP flows) - `steps` (array): Steps in order; each waits for the previous one to succeed - `trigger`: Default: 'agent' (When an agent calls the flow) ### `cs_list_flows` (~265 tokens) List cloud flows Answer 'which flows are there?': every cloud flow in the environment with its state, owner and last change, so you can see what the agent's flow tools can call and what a solution import left switched off. Read-only. This is the inventory only. For one flow's contents use cs_get_flow; for its execution history use cs_list_flow_runs; for the cause of a failure use cs_explain_flow_run. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `dataverseUrl` (string): Dataverse URL; default: from the workspace or the environment - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `includeManaged` (boolean): Default true; false lists only unmanaged flows - `search` (string): Only flows whose name contains this text - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `top` (number): Maximum rows - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_get_flow` (~253 tokens) Read one cloud flow Answer 'what does this flow actually do?': one flow's trigger and action names, its connection references, and the whole Power Automate definition when 'includeDefinition' is set. Read-only. Use it before cs_update_flow, and to see why a flow cannot be switched on. For what happened on a particular run, use cs_list_flow_runs and cs_explain_flow_run instead. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `dataverseUrl` (string): Dataverse URL; default: from the workspace or the environment - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow (workflow) id; cs_list_flows shows it - `includeDefinition` (boolean): Include the full definition JSON (large) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_set_flow_state` (~258 tokens) Turn a cloud flow on or off Switch a flow on (Activated) or off (Draft). This is the step a solution import leaves for you: flows whose connection references were unbound at import time land switched off. A flow can only be turned on once its connections are bound and its definition is valid. Changes a live environment: requires confirm: true. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `dataverseUrl` (string): Dataverse URL; default: from the workspace or the environment - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow (workflow) id - `state` (string, required): on = Activated, off = Draft - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_update_flow` (~435 tokens) Update a cloud flow Change a flow's name, description or definition in the environment. Pass 'steps' (and optionally 'trigger') to rebuild the definition the way cs_build_flow_definition does, or 'definition' for a ready-made one; either replaces properties.definition inside the existing clientdata and keeps the connection references. 'clientData' replaces the whole document. Read the current one with cs_get_flow includeDefinition first. Managed flows cannot be edited in place; edit them in their source environment or through a solution. Changes a live environment: requires confirm: true. Input parameters: - `clientData` (object): The whole clientdata document; overrides 'definition' - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `connectionReferencePrefix` (string): Prefix for generated connection reference names, usually your publisher prefix - `connectionReferences` (object): Connection reference entries to add or explicitly replace; existing entries are otherwise preserved - `dataverseUrl` (string): Dataverse URL; default: from the workspace or the environment - `definition` (object): Power Automate definition object (properties.definition), instead of steps - `description` (string) - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow (workflow) id - `name` (string) - `outputs` (array): What the flow answers with (agent-callable and HTTP flows) - `steps` (array): Steps in order; each waits for the previous one to succeed - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `trigger`: Default: 'agent' (When an agent calls the flow) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_create_flow` (~459 tokens) Create a cloud flow Create a new Power Automate cloud flow, from a step spec (see cs_build_flow_definition: trigger plus connector, HTTP, condition, loop, variable and response steps) or from a ready-made definition, optionally straight into a solution. The flow is created switched off, because a flow can only be activated once its connection references are bound: bind them, then cs_set_flow_state on. To let an agent call it, use a trigger of type Request/kind Skills and add it as a tool with cs_add_tool type 'flow'. Changes a live environment: requires confirm: true. Input parameters: - `clientData` (object): The whole clientdata document, when you have one (from cs_get_flow of another flow, for example) - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `connectionReferencePrefix` (string): Prefix for generated connection reference names, usually your publisher prefix - `connectionReferences` (object): properties.connectionReferences, when you pass a definition rather than steps - `dataverseUrl` (string): Dataverse URL; default: from the workspace or the environment - `definition` (object): A ready-made Power Automate definition, instead of steps - `description` (string) - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `name` (string, required): Flow display name - `outputs` (array): What the flow answers with (agent-callable and HTTP flows) - `solution` (string): Unique name of the solution to create it in - `steps` (array): Steps in order; each waits for the previous one to succeed - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `trigger`: Default: 'agent' (When an agent calls the flow) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_delete_flow` (~270 tokens) Delete a cloud flow Remove a cloud flow from the environment for good. Read it with cs_get_flow first: any agent tool that calls this flow will be left pointing at nothing, and a flow that is still switched on has to be turned off with cs_set_flow_state before Dataverse will delete it. A managed flow cannot be deleted this way; uninstall the solution it came in. Changes a live environment and cannot be undone: requires confirm: true. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `dataverseUrl` (string): Dataverse URL; default: from the workspace or the environment - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow (workflow) id (cs_list_flows) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_list_flow_runs` (~247 tokens) List flow runs Answer 'when did this flow last run, and did it work?': the run history of one cloud flow, most recent first, with status, start and end time, duration and the error of a failed run. Read-only. Use it to find the run you care about, then cs_explain_flow_run on that run to learn why it failed. Uses the Power Automate service, which is a separate sign-in from Dataverse (cs_login scope 'flow'). Unverified against a live tenant. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow id (cs_list_flows) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `top` (number): Maximum runs to return - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_get_flow_run` (~188 tokens) Read one flow run One run of a cloud flow with its status, timing, trigger and error. Read-only. Uses the Power Automate service (cs_login scope 'flow'). Unverified against a live tenant. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow id (cs_list_flows) - `runId` (string, required): Run id (cs_list_flow_runs) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_run_flow` (~281 tokens) Start a flow run Start a run of a manually triggered cloud flow, with an optional payload. Only flows whose trigger is manual or agent-callable can be started this way; scheduled and event-driven flows run on their own. Whatever the flow does (sending mail, writing records) happens for real, so this changes a live environment: requires confirm: true. Uses the Power Automate service (cs_login scope 'flow'). Unverified against a live tenant. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow id (cs_list_flows) - `payload` (object): Body for the trigger - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `triggerName` (string): Trigger key inside the definition (cs_get_flow lists them); default 'manual' - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_explain_flow_run` (~317 tokens) Explain a failed flow run Why one run of a cloud flow failed, in terms of the action that broke and what it was given. For each failed action it resolves the real error message - a failed connector action carries no error of its own, so the message is fetched from the action's outputs - classifies the failure as a connector, expression or timeout problem, and returns the inputs it was called with plus the outputs of the actions that ran just before it. Read-only. Start here when cs_list_flow_runs shows a failure. Uses the Power Automate service (cs_login scope 'flow'). Unverified against a live tenant. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow id (cs_list_flows) - `includeInputs` (boolean): Fetch each failed action's inputs as well; default true - `runId` (string, required): Run id (cs_list_flow_runs) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `upstreamCount` (number): Succeeded actions to include with their outputs, ending at the first failure; default 3 - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_compare_flow_runs` (~321 tokens) Compare a failed flow run with one that worked Diff a failed run against a successful one to separate a data problem from a logic problem. Names the action where the two runs part company, lists every action whose status differs, and flags actions present in one run but not the other, which means the definition changed between them. With compareTriggerData it also reports which top-level keys of the trigger payload differ (key names only, never the values). The baseline defaults to the most recent successful run. Read-only. Uses the Power Automate service (cs_login scope 'flow'). Unverified against a live tenant. Input parameters: - `baselineRunId` (string): Run to compare against; default the most recent successful one - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `compareTriggerData` (boolean): Also compare what the trigger handed each run - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow id (cs_list_flows) - `runId` (string, required): The failed run (cs_list_flow_runs) - `searchRuns` (number): How far back to look for a successful baseline; default 50 - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_analyze_flow_health` (~278 tokens) Assess a flow's reliability How reliable a cloud flow is across its recent runs: failure rate, duration spread (median and 90th percentile), and which actions the failures concentrate on. The verdict distinguishes one broken step from failures spread across many actions, which points at a connection, throttling or an unreliable downstream system instead. Read-only. Use it before cs_explain_flow_run when the complaint is 'it fails sometimes' rather than 'it failed just now'. Uses the Power Automate service (cs_login scope 'flow'). Unverified against a live tenant. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow id (cs_list_flows) - `lastN` (number): Runs to examine; default 50 - `sampleFailures` (number): Failed runs to open for action-level attribution; default 5 - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_bind_flow_connection` (~401 tokens) Bind a flow's connection Point one of a flow's connection references at a real connection, which is the step that lets a flow be switched on. Picks the reference and the connection for you when there is only one of each, and asks when there is a choice. Handles both shapes: a flow that names a connection directly is edited in place, while a flow that came from a solution has its connectionreference row bound instead. Pass activate: true to turn the flow on in the same call once it is bound. Changes a live environment: requires confirm: true. Input parameters: - `activate` (boolean): Turn the flow on after binding; default false - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `connectionId` (string): The connection to bind (its name from cs_list_connections); default: the only usable one for this connector - `connector` (string): Connector id, e.g. shared_office365, to choose the reference by connector instead - `dataverseUrl` (string): Dataverse URL; default: from the workspace or the environment - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `flowId` (string, required): Flow (workflow) id (cs_list_flows) - `reference` (string): Which connection reference to bind; only needed when the flow has more than one - `search` (string): Narrow the candidate connections by display name or owner - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_list_auth_profiles` (~54 tokens) List pac auth profiles The pac authentication profiles on this machine, which one is active, and which account each belongs to. Use it to find the name of the admin profile to pass as 'profile' to the admin tools. Read-only. ### `cs_backup_tenant` (~347 tokens) Back up the tenant configuration to files Write the tenant's Power Platform configuration to local files for reference, diffing and source control: tenant settings, environments, DLP policies, environment groups, service principals, registered applications and app templates, plus per environment its details, solutions, agents, connections, security roles and platform backups. Read-only for the tenant; it only writes files. Runs as the admin account: pass 'profile' or set CPS_ADMIN_PROFILE. Each capture is independent, so a command the account cannot run is reported in 'skipped' and the rest still completes. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `dir` (string, required): Folder to write the backup into (created; existing files with the same names are overwritten) - `environments` (array): Environments to detail; default: every environment 'pac admin list' returns - `includeBackups` (boolean): Default true: the platform backups of each environment - `includeDataverse` (boolean): Default true: flows, connection references, environment variables and agents per environment, when a Dataverse sign-in is cached (cs_login) - `includeEnvironments` (boolean): Default true; false captures tenant level only - `includeRoles` (boolean): Default true: the security roles of each environment - `maxEnvironments` (number): Default 50 - `profile` (string): pac auth profile of the admin account; default CPS_ADMIN_PROFILE, then the active profile - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. ### `cs_admin_assign_users` (~432 tokens) Assign security roles to a roster of users Give many users their security roles in one environment, from a CSV roster or an inline list. pac assigns one user and one role per call, so a roster of ten developers with three roles each is thirty calls; this expands the roster and runs them under a single approval. Without confirm it returns the plan: every user-and-role pair it would attempt, so you can read the whole thing before any of it happens. Rows are independent, so a bad UPN or a role the environment does not have is reported and the rest still run. Changes a live environment: requires confirm: true. Runs as the admin account: pass 'profile' or set CPS_ADMIN_PROFILE. Prefer cs_admin_assign_group when the roster is really a group: that is one call per role however many people are in it, and new joiners inherit access. Unverified against a live tenant. Input parameters: - `assignments` (array): Roster inline instead of a CSV file - `background` (boolean): Run in the background and return a jobId immediately, then poll cs_job_status. MCP clients cut a tool call off after about 60 seconds; this operation can take much longer, and without this the work i… - `businessUnit` (string): Business unit for rows that do not name one - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `continueOnError` (boolean): Default true: one failed row does not abort the roster. false stops at the first failure. - `csv` (string): Path to a CSV roster. Header row needs a user column (user, upn, email) and a roles column (roles, role); several roles in one cell separated by comma, semicolon or pipe. Optional businessUnit and ap… - `environment` (string, required): Environment id or URL to assign the roles in - `profile` (string): pac auth profile of the admin account; default CPS_ADMIN_PROFILE, then the active profile ### `cs_list_org_agents` (~360 tokens) List agents in the Microsoft 365 catalogue Every agent in the organisation's Microsoft 365 catalogue, across environments, with the things Power Platform cannot see: who the agent is available to, where it is deployed, and whether an admin has blocked it. Defaults to agents built in Copilot Studio; pass platform: 'all' to include the Agent Builder and acquired apps. Read-only. Uses Microsoft Graph, a separate sign-in from Dataverse (cs_login scope 'graph'). Needs a Microsoft Agent 365 licence and is global-cloud only. Unverified against a live tenant. Input parameters: - `allPages` (boolean): Follow paging until the catalogue is exhausted (capped) - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `elementType` (string): Only packages containing this element type - `filter` (string): Extra raw OData $filter, combined with the options above - `host` (string): Only agents surfaced in this host - `modifiedSince` (string): ISO instant; only packages modified after it, e.g. 2026-01-01T00:00:00Z - `platform` (string): Build platform. Default 'Copilot Studio'; 'all' does not filter. - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `top` (number): Maximum packages per page - `version` (string): Graph version for reads. Default v1.0; beta may carry fields v1.0 does not. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_get_org_agent` (~238 tokens) Read one agent from the Microsoft 365 catalogue Full catalogue entry for one agent: metadata, element types, availability and deployment state, and whether it is blocked. The raw body is returned alongside the mapped fields, because the detail resource carries more than the list rows. Read-only (cs_login scope 'graph'). Needs a Microsoft Agent 365 licence and is global-cloud only. Unverified against a live tenant. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `id` (string, required): Package id from cs_list_org_agents, e.g. P_19ae1zz1-56bc-505a-3d42-156df75a4xxy - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `version` (string): Graph version for reads. Default v1.0; beta may carry fields v1.0 does not. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_block_org_agent` (~291 tokens) Block or unblock an agent for the organisation Block an agent so nobody in the organisation can use it, or lift an existing block. This is a governance action across the whole tenant, not a deployment one: it does not unpublish or delete the agent, and it affects every user at once. Changes a live tenant: requires confirm: true. Needs the CopilotPackages.ReadWrite.All permission and runs against Graph beta, the only version that exposes it (cs_login scope 'graph_write'). Needs a Microsoft Agent 365 licence and is global-cloud only. Unverified against a live tenant. Input parameters: - `blocked` (boolean, required): true blocks the agent for everyone, false lifts the block - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `id` (string, required): Package id from cs_list_org_agents, e.g. P_19ae1zz1-56bc-505a-3d42-156df75a4xxy - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_reassign_org_agent` (~255 tokens) Reassign an agent's owner Hand ownership of a catalogue agent to another user, by their Entra object id. Used when the owner leaves the organisation. Changes a live tenant: requires confirm: true. Needs CopilotPackages.ReadWrite.All and runs against Graph beta (cs_login scope 'graph_write'). Needs a Microsoft Agent 365 licence and is global-cloud only. Unverified against a live tenant. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `id` (string, required): Package id from cs_list_org_agents, e.g. P_19ae1zz1-56bc-505a-3d42-156df75a4xxy - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `userId` (string, required): Entra object id of the new owner - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_guide` (~394 tokens) How to use this server Explain how to do one part of Copilot Studio agent development with this server's tools: 'getting-started' (clone or create an agent and take it to a published, tested state), 'instructions' (write the agent's instructions, with AI Builder or by hand), 'knowledge' (add public site, SharePoint, Graph connector or file knowledge), 'tools' (find a connector operation, add the tool, bind its connection), 'topics' (deterministic conversations: triggers and the node types), 'flows' (build a cloud flow, bind its connections, run it, and work out why a run failed), 'evaluations' (test sets, runs and results, plus local conversation tests), 'publish-and-test' (publish the agent and chat with it), 'drift' (changes made in the portal since the last sync, and how to merge them), 'transcripts' (what real users asked, how those sessions ended, and turning the failures into a test set), 'solutions' (pull a solution, redeploy it elsewhere, compare environments), 'administration' (tenant administration with a separate admin account, and backing the tenant configuration up to files), 'troubleshooting' (the errors this server can return, and what each one means). Read the relevant topic when you do not know which tools a job needs or what order they go in; it names the tool for each step and the manual portal steps that cannot be automated. It only explains - it changes nothing and does no work, so when the user asked for something to be built, written or run, call the tool that does it rather than this one. Also returns next steps for the workspace at hand. Input parameters: - `topic` (string): Default getting-started - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_extract_agent_template` (~264 tokens) Extract an agent template Write a reusable YAML template from an existing agent (its topics, settings and components), for cs_create_agent_from_template in another environment or solution. Runs 'pac copilot extract-template' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `bot` (string, required): Agent id or schema name - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `overwrite` (boolean): Overwrite the file if it exists - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `templateFile` (string, required): Path of the YAML template to write - `templateName` (string): Template name (default kickStartTemplate) - `templateVersion` (string): Template version X.Y.Z (default 1.0.0) - `timeoutSeconds` (number): Default 600 ### `cs_create_agent_from_template` (~289 tokens) Create an agent from a template Create a new agent in a solution from a template produced by cs_extract_agent_template. Runs 'pac copilot create' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `displayName` (string, required): Display name of the new agent - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `schemaName` (string, required): Schema (unique) name of the new agent, e.g. contoso_HelpDesk - `solution` (string, required): Unique name of the solution to create the agent in - `templateFile` (string, required): Template YAML from cs_extract_agent_template - `timeoutSeconds` (number): Default 900 ### `cs_extract_translations` (~278 tokens) Extract translation files Export the localisable strings of one or all agents as .resx or .json files, from the environment or from an unpacked solution folder. Runs 'pac copilot extract-translation' with the active pac auth profile. Input parameters: - `all` (boolean): Write files for every supported language, not only the primary one - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `bot` (string): Agent id or schema name; omit for every agent - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `format` (string): resx (default) or json - `outDir` (string): Output directory - `overwrite` (boolean): Overwrite existing files - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `sourceDir` (string): Unpacked solution folder to read instead of the environment - `timeoutSeconds` (number): Default 900 ### `cs_merge_translations` (~308 tokens) Merge translation files Import translated .resx or .json files back into one or more agents (environment or unpacked solution folder). whatIf previews the merge without writing. Runs 'pac copilot merge-translation' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Only some inputs mutate; see the parameter descriptions. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `files` (array, required): Translation files; glob patterns allowed - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `solution` (string): Solution unique name - `sourceDir` (string): Unpacked solution folder to update instead of the environment - `timeoutSeconds` (number): Default 900 - `verbose` (boolean): More diagnostic output - `whatIf` (boolean): Report what would change without changing anything ### `cs_quarantine_agent` (~246 tokens) Quarantine or release an agent Put an agent in quarantine (users cannot talk to it) or release it. Admin operation. Runs 'pac copilot quarantine' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `botId` (string, required): Agent id (GUID) - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `quarantine` (boolean): true to quarantine (default), false to release - `timeoutSeconds` (number): Default 600 ### `cs_init_solution_project` (~188 tokens) Create a solution project Scaffold a Dataverse solution project (.cdsproj) on disk for source-controlled solution development. Runs 'pac solution init' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `outputDirectory` (string): Output directory (default: cwd) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `publisherName` (string, required): Publisher name - `publisherPrefix` (string, required): Publisher customization prefix - `timeoutSeconds` (number): Default 600 ### `cs_clone_solution` (~298 tokens) Clone a solution into a project Export a solution from the environment and unpack it into a solution project folder (source-control layout). Read-only for the environment. Runs 'pac solution clone' with the active pac auth profile. Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `include` (string): Settings to include in the export (pac solution export --include values) - `localize` (boolean): Extract string resources into .resx files - `map` (string): Mapping XML file for component folders - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `name` (string, required): Solution unique name - `outputDirectory` (string): Output directory - `packageType` (string): Unmanaged, Managed or Both (default Both) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 3600 ### `cs_sync_solution` (~312 tokens) Sync a solution project from the environment Re-export the solution and update an existing unpacked solution folder or .cdsproj with the environment's current state. Read-only for the environment. Runs 'pac solution sync' with the active pac auth profile. Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `include` (string): Settings to include in the export (pac solution export --include values) - `localize` (boolean): Extract string resources into .resx files - `map` (string): Mapping XML file for component folders - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `packageType` (string): Unmanaged, Managed or Both (default Both) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `solutionFolder` (string): Unpacked solution folder (Other/Solution.xml root) or .cdsproj folder; default: cwd - `timeoutSeconds` (number): Default 3600 ### `cs_check_solution` (~386 tokens) Run Solution Checker Analyse solution zip files with the Power Apps Checker service (Solution Checker or AppSource Certification rule set) and write the results locally. Use as a quality gate before cs_deploy_solution. Runs 'pac solution check' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Only some inputs mutate; see the parameter descriptions. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `clearCache` (boolean): Clear the tenant's checker enforcement cache - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `excludedFiles` (array): Files to exclude from the analysis - `geo` (string): Checker service geography - `outputDirectory` (string): Where to write the results - `path` (string): Solution zip file(s); glob allowed - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `ruleLevelOverride` (string): JSON file with rule level overrides - `ruleSet` (string): 'Solution Checker' (default), 'AppSource Certification' or a rule set id - `saveResults` (boolean): Store the results in the environment (Solution Health Hub) - `solutionUrl` (string): SAS URL of a solution zip instead of path - `timeoutSeconds` (number): Default 1800 ### `cs_publish_customizations` (~247 tokens) Publish all customizations Publish every unpublished customization in the environment (the 'Publish all customizations' button). Runs 'pac solution publish' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 3600 ### `cs_set_solution_version` (~230 tokens) Set the solution version in Solution.xml Update the version in a local unpacked solution's Solution.xml, explicitly or by strategy (gittags, filetracking, solution). Local file change only. Runs 'pac solution version' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `buildVersion` (string): Build version - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `filename` (string): Tracker CSV for the filetracking strategy - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `revisionVersion` (string): Revision version - `solutionPath` (string): Unpacked solution folder or Solution.xml - `strategy` (string): Version strategy (see pac solution version help) - `timeoutSeconds` (number): Default 600 ### `cs_solution_online_version` (~260 tokens) Read or set the online solution version Without solutionVersion: read the version of a solution in the environment. With it: set that version (mutating). Runs 'pac solution online-version' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Only some inputs mutate; see the parameter descriptions. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `solutionName` (string, required): Solution unique name - `solutionVersion` (string): New version to set; omit to read - `timeoutSeconds` (number): Default 600 ### `cs_upgrade_solution` (~270 tokens) Apply a staged solution upgrade Complete a managed solution upgrade that was imported as a staged upgrade (pac solution import --stage-and-upgrade or the portal's 'Stage for upgrade'). Runs 'pac solution upgrade' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `solutionName` (string, required): Solution unique name - `timeoutSeconds` (number): Default 3600 ### `cs_add_solution_component` (~325 tokens) Add a component to a solution Add an existing component (an agent, flow, connection reference, environment variable, table ...) to an unmanaged solution by schema name or id and component type code. Runs 'pac solution add-solution-component' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `addRequiredComponents` (boolean): Also add the components it depends on - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `component` (string, required): Schema name or id of the component - `componentType` (string, required): Component type code or name (e.g. 29 for a flow / workflow, 10088 for a connection reference, 380 for an environment variable definition) - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `solutionName` (string, required): Solution unique name - `timeoutSeconds` (number): Default 600 ### `cs_add_solution_reference` (~186 tokens) Add a project reference to a solution project Reference another project (plug-in, PCF, ...) from a .cdsproj so it is packed into the solution. Run in the solution project folder (cwd). Local file change only. Runs 'pac solution add-reference' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `path` (string, required): Path of the referenced project - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_add_solution_license` (~202 tokens) Add license plan files to a solution project Attach license plan definition and mapping CSV files to a solution project (ISV licensing). Run in the solution project folder (cwd). Local file change only. Runs 'pac solution add-license' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `planDefinitionFile` (string, required): CSV: Service ID, Display name, More info URL - `planMappingFile` (string, required): CSV: Service ID, Component name - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_list_pipelines` (~191 tokens) List Power Platform pipelines List the pipelines that can deploy from an environment, or the stages of one pipeline. Read-only. Runs 'pac pipeline list' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `pipeline` (string): Pipeline name or id to show its stages - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_deploy_pipeline` (~298 tokens) Deploy through a Power Platform pipeline Start a pipeline deployment of a solution to a stage (the alternative to cs_deploy_solution when the tenant uses Power Platform pipelines). stageId comes from cs_list_pipelines. Runs 'pac pipeline deploy' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `currentVersion` (string, required): Current solution version - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `newVersion` (string, required): Version to deploy as - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `solutionName` (string, required): Solution unique name - `stageId` (string, required): Deployment stage id (cs_list_pipelines with pipeline) - `timeoutSeconds` (number): Default 3600 - `wait` (boolean): Wait until the deployment finishes ### `cs_create_connection` (~324 tokens) Create a service-principal Dataverse connection Create a Dataverse connection that authenticates with an app registration (application id + client secret) so flows and tools owned by a pipeline do not depend on a person. This is the only connection kind pac can create; connector connections (SharePoint, Outlook, MCP servers ...) are still authorised in the portal. Runs 'pac connection create' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `applicationId` (string, required): App registration (client) id - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `clientSecret` (string, required): Client secret; prefer a secret from a vault, it is masked in logs (masked in logs and results) - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `name` (string, required): Connection display name - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `tenantId` (string, required): Entra tenant id - `timeoutSeconds` (number): Default 600 ### `cs_update_connection` (~274 tokens) Update a service-principal Dataverse connection Rotate the app registration or secret behind a service-principal Dataverse connection. Runs 'pac connection update' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `applicationId` (string, required): App registration (client) id - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `clientSecret` (string, required): New client secret (masked in logs) (masked in logs and results) - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `connectionId` (string, required): Connection id (cs_list_connections) - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `tenantId` (string, required): Entra tenant id - `timeoutSeconds` (number): Default 600 ### `cs_delete_connection` (~229 tokens) Delete a connection Delete a connection by id. Flows and tools bound to it stop working until rebound. Runs 'pac connection delete' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `connectionId` (string, required): Connection id (cs_list_connections) - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_create_auth_profile` (~519 tokens) Create a pac auth profile Create a pac authentication profile. Non-interactive: service principal (applicationId + clientSecret + tenant), certificate, managed identity, or GitHub / Azure DevOps federation. Interactive (a person signing in, which is the usual way to add an admin account): pass name, environment and background: true - pac opens its own browser, the call returns a jobId at once, and cs_job_status reports when the profile exists. Without background this blocks until the sign-in finishes and the client will usually give up first. Device code needs a terminal: this server gives pac no stdin. Runs 'pac auth create' with the active pac auth profile. Input parameters: - `applicationId` (string): App registration (client) id - `azureDevOpsFederated` (boolean): Azure DevOps federated credential (needs tenant and applicationId) - `background` (boolean): Run in the background and return a jobId immediately. Use this for interactive sign-in: pac opens a browser and waits, which would otherwise outlive the client's call timeout. Poll cs_job_status. - `certificateDiskPath` (string): Certificate file for certificate auth - `certificatePassword` (string): Certificate password (masked in logs) (masked in logs and results) - `clientSecret` (string): Client secret (masked in logs) (masked in logs and results) - `cloud` (string): Cloud instance (Public, UsGov, UsGovHigh, UsGovDod, China) - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `deviceCode` (boolean): Use the device-code flow for interactive sign-in (blocks until done) - `environment` (string): Default environment for the profile (id, URL, unique or partial name) - `githubFederated` (boolean): GitHub federated credential (needs tenant and applicationId) - `managedIdentity` (boolean): Use the default Azure identity - `name` (string): Profile name (max 30 characters) - `password` (string): Password (masked in logs) (masked in logs and results) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `tenant` (string): Tenant id (required with applicationId) - `timeoutSeconds` (number): Default 600 - `username` (string): User name for username/password auth (not recommended) ### `cs_select_auth_profile` (~172 tokens) Select the active pac auth profile Make a pac auth profile the active one, by index (cs_init lists them) or name. Runs 'pac auth select' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `index` (number): Profile index - `name` (string): Profile name - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_auth_who` (~146 tokens) Show the active pac auth profile Who pac is signed in as, and against which environment. Runs 'pac auth who' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_delete_auth_profile` (~167 tokens) Delete a pac auth profile Remove a pac auth profile by index or name (local credential store only). Runs 'pac auth delete' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `index` (number): Profile index - `name` (string): Profile name - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_list_environments` (~229 tokens) List environments (admin) Every environment in the tenant with its type, region and state, as the admin centre lists them. Filters by name, type or installed application. Runs 'pac admin list' with the active pac auth profile. Input parameters: - `application` (string): Only environments with this application installed - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Only environments whose name or id contains this text - `name` (string): Only environments whose name contains this text - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 - `type` (string): Only environments of this type (Production, Sandbox, Trial, Developer, Teams) ### `cs_admin_environment_status` (~153 tokens) Operations in progress Status of the tenant operations that are still running (copies, restores, resets, deletions). Runs 'pac admin status' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_list_tenant_settings` (~197 tokens) Read tenant settings The tenant-wide Power Platform settings (governance, sharing, support, licensing). With settingsFile, pac writes them as JSON to that path; that file is the reference copy to keep in source control. Runs 'pac admin list-tenant-settings' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `settingsFile` (string): Write the settings to this .json file - `timeoutSeconds` (number): Default 600 ### `cs_admin_update_tenant_settings` (~270 tokens) Update tenant settings Change tenant-wide settings, either from a settings file or one setting at a time (for example powerPlatform.governance.disableDeveloperEnvironmentCreationByNonAdminUsers). Affects the whole tenant: requires confirm: true. Runs 'pac admin update-tenant-settings' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `settingName` (string): Single setting path - `settingValue` (string): Value for that setting - `settingsFile` (string): A .json file of settings (from cs_admin_list_tenant_settings) - `timeoutSeconds` (number): Default 600 ### `cs_admin_list_dlp_policies` (~162 tokens) List DLP policies Data loss prevention policies in the tenant: the connector groups that decide which connectors an agent or flow may combine. Runs 'pac admin dlp-policy list' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_show_dlp_policy` (~179 tokens) Show one DLP policy One data loss prevention policy in full: its connector classification and the environments it applies to. Runs 'pac admin dlp-policy show' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `policyName` (string, required): Policy id (GUID); cs_admin_list_dlp_policies shows it - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_list_environment_groups` (~152 tokens) List environment groups Environment groups in the tenant (the grouping used for managed-environment rules). Runs 'pac admin list-groups' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_add_environment_to_group` (~233 tokens) Add an environment to a group Put an environment into an environment group, which applies that group's rules to it. Changes tenant configuration: requires confirm: true. Runs 'pac admin add-group' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id, url, unique or partial name - `environmentGroup` (string, required): Environment group name or id - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_list_security_roles` (~199 tokens) List security roles Security roles in an environment, optionally including child roles: what cs_admin_assign_user and cs_admin_assign_group can grant. Runs 'pac admin list-roles' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `businessUnit` (string): Filter by business unit name or id - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL - `includeChildRoles` (boolean): Include child roles - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_list_service_principals` (~186 tokens) List service principals with Dataverse access Entra applications that have an application user in Dataverse: who can act without a person signing in. Runs 'pac admin list-service-principal' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `filter` (string): Application name starts-with filter - `max` (number): Maximum applications (default 20) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_list_applications` (~147 tokens) List registered Entra applications Entra applications registered with the tenant for Power Platform. Runs 'pac admin application list' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_register_application` (~216 tokens) Register an Entra application Register an Entra application with the tenant so it can be used by Power Platform. Changes tenant configuration: requires confirm: true. Runs 'pac admin application register' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `applicationId` (string, required): Application (client) id - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_unregister_application` (~207 tokens) Unregister an Entra application Remove an Entra application's tenant registration. Changes tenant configuration: requires confirm: true. Runs 'pac admin application unregister' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `applicationId` (string, required): Application (client) id - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_list_app_templates` (~169 tokens) List Dynamics 365 app templates The Dynamics 365 application templates that can be installed when creating an environment, per region. Runs 'pac admin list-app-templates' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `region` (string): Region name (default unitedstates) - `timeoutSeconds` (number): Default 600 ### `cs_admin_list_backups` (~168 tokens) List environment backups Backups of an environment, with their labels and dates: what cs_admin_restore_environment can restore. Runs 'pac admin list-backups' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_backup_environment` (~231 tokens) Back up an environment Take a manual backup of an environment (the platform's own backup, not the file backup cs_backup_tenant writes). Changes a live environment: requires confirm: true. Runs 'pac admin backup' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL - `label` (string, required): Backup label - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 3600 ### `cs_admin_set_backup_retention` (~275 tokens) Set the backup retention period Set how many days backups of an environment are kept (7, 14, 21 or 28). Changes a live environment: requires confirm: true. Runs 'pac admin set-backup-retention-period' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `days` (number, required): 7, 14, 21 or 28 - `environment` (string): Environment id or URL - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_restore_environment` (~309 tokens) Restore an environment from a backup Restore a backup into the same or another environment. Overwrites the target's data and customisations: requires confirm: true. Runs 'pac admin restore' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `name` (string): Name for the restored environment - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `selectedBackup` (string, required): Backup date as mm/dd/yyyy hh:mm, or 'latest' - `skipAuditData` (boolean): Do not restore audit data - `sourceEnvironment` (string): Environment the backup came from - `targetEnvironment` (string): Environment to restore into (defaults to the source) - `timeoutSeconds` (number): Default 14400 ### `cs_admin_copy_environment` (~295 tokens) Copy one environment over another Copy a source environment onto a target environment. Everything in the target is replaced: requires confirm: true. Runs 'pac admin copy' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `name` (string): Name for the target environment - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `skipAuditData` (boolean): Do not copy audit data - `sourceEnvironment` (string): Environment to copy from - `targetEnvironment` (string): Environment to overwrite - `timeoutSeconds` (number): Default 14400 - `type` (string): Copy type (for example MinimalCopy, FullCopy) ### `cs_admin_create_environment` (~364 tokens) Create an environment Create a Dataverse environment in the tenant. Consumes tenant capacity: requires confirm: true. Runs 'pac admin create' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `currency` (string): Currency (default USD) - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `domain` (string): Domain part of the environment URL - `inputFile` (string): JSON file with the arguments - `language` (string): Language (default English) - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `name` (string): Environment name - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `region` (string): Region (default unitedstates) - `securityGroupId` (string): Entra security group id (required for a Teams environment) - `templates` (array): Dynamics 365 templates to deploy - `timeoutSeconds` (number): Default 7200 - `type` (string, required): Production, Sandbox, Trial, Developer or Teams - `user` (string): User to assign to the environment (object id or UPN) ### `cs_admin_delete_environment` (~255 tokens) Delete an environment Delete an environment from the tenant, with everything in it: agents, solutions, flows and data. Irreversible beyond the platform's own backup retention: requires confirm: true. Runs 'pac admin delete' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 7200 ### `cs_admin_reset_environment` (~314 tokens) Reset an environment Reset an environment to an empty Dataverse instance. Everything in it is deleted: requires confirm: true. Runs 'pac admin reset' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `currency` (string): Currency - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `domain` (string): Domain part of the URL - `environment` (string): Environment id or URL - `inputFile` (string): JSON file with the arguments - `language` (string): Language - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `name` (string): New name - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `purpose` (string): Description of the environment's intent - `templates` (array): Dynamics 365 templates - `timeoutSeconds` (number): Default 7200 ### `cs_admin_set_runtime_state` (~275 tokens) Set environment administration mode Put an environment into administration mode (only admins can use it) or back, and control background operations. Changes a live environment: requires confirm: true. Runs 'pac admin set-runtime-state' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `async` (boolean): Run the operation asynchronously - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `backgroundOperations` (string): Background operations state - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string, required): Environment id or URL - `maxAsyncWaitTime` (number): Max asynchronous wait time in minutes (default 60) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `runtimeState` (string, required): AdminMode or Enabled - `timeoutSeconds` (number): Default 600 ### `cs_admin_set_governance_config` (~434 tokens) Enable or edit managed environments Turn managed environments on ('Standard') or off ('Basic') for an environment and set its governance options: sharing limits, solution checker mode, maker onboarding. Changes tenant governance: requires confirm: true. Runs 'pac admin set-governance-config' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `checkerRuleOverrides` (string): Solution checker rule overrides - `cloudFlowsLimit` (number): How many people makers may share solution cloud flows with - `cloudFlowsMode` (string): Sharing limit mode for solution cloud flows - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `disableGroupSharing` (boolean): Disable sharing with groups - `environment` (string, required): Environment id or URL - `excludeAnalysis` (boolean): Exclude this environment from the weekly usage digest - `includeInsights` (boolean): Show insights on the admin centre home page - `limitSharingMode` (string): Sharing limit mode - `makerOnboardingMarkdown` (string): Maker onboarding markdown - `makerOnboardingUrl` (string): Maker onboarding URL - `maxLimitUserSharing` (number): How many people makers may share canvas apps with - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `protectionLevel` (string, required): Standard enables managed environments, Basic disables them - `solutionCheckerMode` (string): Solution checker validation mode (None, Warn, Block) - `suppressValidationEmails` (boolean): Do not send validation emails - `timeoutSeconds` (number): Default 600 ### `cs_admin_assign_user` (~280 tokens) Assign a user to an environment Give a user (or an application user) a security role in an environment. Changes a live environment: requires confirm: true. Runs 'pac admin assign-user' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `applicationUser` (boolean): The user is an application (service principal) - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `businessUnit` (string): Business unit id - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `role` (string, required): Security role name or id (cs_admin_list_security_roles) - `timeoutSeconds` (number): Default 600 - `user` (string, required): Object id or UPN, or the application id for an application user ### `cs_admin_assign_group` (~308 tokens) Assign a group to an environment Give an Entra group a security role in an environment through a Dataverse team. Changes a live environment: requires confirm: true. Runs 'pac admin assign-group' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `businessUnit` (string): Business unit id - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL - `group` (string, required): Entra group object id - `groupName` (string, required): Name of the Dataverse team to create - `membershipType` (string, required): Membership type (MembersAndGuests, Members, Owners, Guests) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `role` (string, required): Security role name or id - `teamType` (string, required): Team type (Owner, Access, AadSecurityGroup, AadOfficeGroup) - `timeoutSeconds` (number): Default 600 ### `cs_admin_create_service_principal` (~258 tokens) Create an application user Register an Entra application and give it an application user with a security role in an environment: the headless identity a pipeline signs in as. Changes a live environment: requires confirm: true. Runs 'pac admin create-service-principal' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL - `name` (string): Application name to create in Entra - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `role` (string): Security role (default System Administrator) - `timeoutSeconds` (number): Default 600 ### `cs_admin_self_elevate` (~223 tokens) Self-elevate to System Administrator Give yourself the System Administrator role in an environment. Needs Global, Power Platform or Dynamics 365 admin. Changes a live environment: requires confirm: true. Runs 'pac admin self-elevate' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_admin_query` (~218 tokens) Run a tenant resource query Run a tenant-level resource query (the admin centre's own query language) and optionally write the results to a file as JSON, list or CSV. Runs 'pac admin query' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `outputFile` (string): Where to save the results - `outputType` (string): Json, List or Grid (default Grid) - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `query` (string): Resource query JSON as a string - `queryFile` (string): File containing the query JSON - `timeoutSeconds` (number): Default 600 ### `cs_env_list` (~173 tokens) List environments (pac) Environments visible to the active pac auth profile. The pac-based alternative to cs_list_environments, which needs a cs_login. Runs 'pac env list' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `filter` (string): Only environments whose name contains this text - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_env_who` (~171 tokens) Show environment details (pac) Organisation id, URL, version and the signed-in user for an environment. Runs 'pac env who' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_env_fetch` (~211 tokens) Run a FetchXML query Run a FetchXML query against Dataverse through pac (read-only), e.g. to inspect bot or botcomponent rows without an MSAL sign-in. Runs 'pac env fetch' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string): Environment id or URL; default: the environment of the active pac auth profile - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 - `xml` (string): FetchXML query text - `xmlFile` (string): File containing the FetchXML query ### `cs_env_select` (~165 tokens) Select the default environment for the pac profile Set the environment that pac commands use when none is passed (local profile setting). Runs 'pac env select' with the active pac auth profile. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. - `cwd` (string): Working directory for pac (for project commands: the solution project folder) - `environment` (string, required): Environment id, URL, unique or partial name - `profile` (string): pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. - `timeoutSeconds` (number): Default 600 ### `cs_describe_workspace` (~69 tokens) Describe the workspace Inventory of an agent workspace: settings, instructions, topics (with trigger phrases), knowledge sources, tools, flows, triggers, variables, connection references, sync metadata. Input parameters: - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_validate` (~124 tokens) Validate workspace YAML Structural validation of every component file against the Copilot Studio authoring schema (kinds, unknown/missing properties, duplicate ids, placeholders, Power Fx prefixes, variable scopes) plus cross-file checks (connection references, topic redirects). Answers 'is anything broken in these files?'; it only reads them and sends nothing anywhere. cs_push runs it itself and blocks on errors. Input parameters: - `file` (string): Validate a single file (relative to workspace) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_lookup_schema` (~94 tokens) Look up the YAML schema Inspect the Copilot Studio authoring schema: summarize or resolve a definition (e.g. Question, SearchAndSummarizeContent, KnowledgeSourceConfiguration), search by keyword, or list all kinds. Input parameters: - `depth` (number) - `listKinds` (boolean) - `name` (string) - `resolve` (boolean): Return the full resolved JSON instead of a summary - `search` (string) ### `cs_add_topic` (~244 tokens) Add a topic Create topics/.topic.mcs.yml from a declarative spec: trigger phrases (or a system trigger) plus message / question / condition / redirect / setVariable / searchKnowledge / http / invokeFlow / end / raw nodes. Validates the result. Push to apply. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `actions` (array, required) - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `description` (string) - `name` (string, required) - `overwrite` (boolean) - `priority` (number) - `triggerKind` (string): System trigger instead of phrases - `triggerPhrases` (array): User phrases that start the topic (OnRecognizedIntent) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_add_knowledge_source` (~300 tokens) Add a knowledge source Add knowledge as YAML: kind 'public-site' (Bing-scoped website, max 2 path levels), 'sharepoint' (direct folder URL), 'graph-connector' (Microsoft Graph connector via environment variable), or 'files' (copy documents into knowledge/files for upload on push). Dataverse, AI Search and SQL knowledge are portal-only. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `connectionEnvironmentVariable` (string) - `connectionName` (string) - `contentSourceDisplayName` (string) - `description` (string) - `files` (array): Absolute paths of documents (pdf, docx, txt, ...) - `includeSubPages` (boolean) - `kind` (string, required) - `name` (string, required) - `overwrite` (boolean) - `site` (string) - `triggerCondition` (string): Power Fx condition restricting when this source is searched - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_add_tool` (~529 tokens) Add a tool (connector, MCP server, flow, prompt, agent, or raw) Create actions/.mcs.yml. type 'connector': a connector operation (connectorId like shared_office365, operationId like SendEmailV2; use cs_list_connectors / cs_describe_connector to find them). type 'mcp': an MCP server exposed through a connector. type 'flow': a cloud flow by id. type 'prompt': an AI Builder prompt by model id (cs_list_prompts). type 'connected-agent': another Copilot Studio agent by schema name. type 'child-agent': a child agent's GPT component. type 'raw': any other TaskAction kind with the action object supplied. When the connector definition is cached, the operationId is checked and required inputs are filled from the catalog unless inputs are given. Connector and MCP tools need a connection that only the portal can authorise; the tool writes the connection-reference stub and returns the portal step. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `action` (object): type raw: full TaskAction object with kind - `aiModelId` (string): type prompt: AI Builder model id - `botSchemaName` (string): type connected-agent - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `connectionMode` (string): Invoker = end user's connection; Maker = the maker's shared connection - `connectionReference` (string): Existing logical name from connectionreferences.mcs.yml - `connectorId` (string): shared_ or a display name from the catalog - `description` (string, required): Also used as modelDescription unless overridden; the orchestrator routes on it - `flowId` (string) - `gptComponentSchemaName` (string): type child-agent - `inputs` (array) - `inputsFromCatalog` (boolean): Default true: when no inputs are given and the connector definition is cached, add automatic inputs for the operation's required parameters - `modelDescription` (string) - `name` (string, required) - `operationId` (string) - `outputs` (array) - `overwrite` (boolean) - `type` (string, required) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_edit_topic` (~281 tokens) Edit a topic Change an existing topic in place, keeping its comment header: rename, description, trigger phrases (set / add / remove), priority, append or insert nodes (same node spec as cs_add_topic), remove top-level nodes by id. Validates the file afterwards. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `addTriggerPhrases` (array) - `appendActions` (array) - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `description` (string) - `insertActions` (object) - `priority` (number|null): null removes the priority - `removeActionIds` (array): ids of top-level nodes (see cs_describe_workspace or the file) - `removeTriggerPhrases` (array) - `rename` (string) - `setTriggerPhrases` (array) - `topic` (string, required): Topic name, file stem or path - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_edit_tool` (~272 tokens) Edit a tool Change an existing tool file: name, description, modelDescription / modelDisplayName (what the orchestrator routes on), operationId, connection mode or reference, output mode, and inputs (set / add / remove). Validates afterwards. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `addInputs` (array) - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `connectionMode` (string) - `connectionReference` (string) - `description` (string) - `modelDescription` (string) - `modelDisplayName` (string) - `operationId` (string) - `outputMode` (string) - `removeInputs` (array): propertyNames to drop - `rename` (string) - `setInputs` (array) - `tool` (string, required): Tool name, file stem or path - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_edit_knowledge` (~204 tokens) Edit a knowledge source Change a knowledge source file: name, description, site URL, includeSubPages, trigger condition (null removes it), additional search terms. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `additionalSearchTerms` (string|null) - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `description` (string) - `includeSubPages` (boolean) - `knowledge` (string, required) - `rename` (string) - `site` (string) - `triggerCondition` (string|null) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_remove_component` (~146 tokens) Remove a component from the workspace Delete a topic, knowledge source, tool, trigger, variable or flow from the workspace files (the live agent changes on the next cs_push). For tools, the connection reference is dropped too unless another tool uses it. Reports topics that still redirect to a removed topic. Deletes files: requires confirm: true. Input parameters: - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `kind` (string, required) - `name` (string, required) - `pruneConnectionReference` (boolean) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_delete_agent` (~84 tokens) Delete an agent pac copilot delete: permanently delete an agent from the environment. Requires confirm: true. Input parameters: - `bot` (string, required): Agent id or schema name - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `environment` (string): Environment id or URL. Defaults to the active pac auth profile. ### `cs_delete_solution` (~97 tokens) Delete a solution pac solution delete: delete an unmanaged solution container (its components stay in the environment) or uninstall a managed one (its components are removed). Requires confirm: true. Input parameters: - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `environment` (string): Environment id or URL. Defaults to the active pac auth profile. - `name` (string, required): Solution unique name ### `cs_review_agent` (~148 tokens) Review the agent for common mistakes Judge whether the agent is any good and say what to improve, as a score out of 10 with a fix for each finding: instructions present and sized, escalation and fallback topics, trigger phrase count and overlap, tool descriptions and name collisions, unbound connections, authentication versus private knowledge, web browsing with internal sources, orchestration off with tools, duplicate names, credentials in YAML, pack-only workspace. Returns a score, findings with fixes, and optional Markdown. Input parameters: - `markdown` (boolean) - `reportPath` (string): Write the Markdown report here - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_list_connectors` (~235 tokens) List connectors available in an environment The environment's connector registry (the same list the portal's Add a tool shows): Microsoft-published and custom connectors, with an mcpLikely flag for MCP servers. Cached under .cs-catalog//connectors.json for offline use; with search and no sign-in, falls back to the offline seed of public connectors. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `customOnly` (boolean) - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `mcpOnly` (boolean) - `offline` (boolean): Use cache or seed only - `refresh` (boolean): Fetch again even if cached - `search` (string) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_describe_connector` (~236 tokens) Describe a connector's operations Fetch (or read from cache) a connector's OpenAPI definition and list its operations with operationId, parameters (required, type, description) and response fields; marks MCP-capable connectors (x-ms-agentic-protocol). Exactly what cs_add_tool needs. Cached under .cs-catalog//connectors/.json and used by cs_validate. Input parameters: - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `connector` (string, required): shared_ or a display name - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `includeInternal` (boolean) - `operation` (string): Filter operations by id or summary - `refresh` (boolean) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_list_prompts` (~69 tokens) List AI Builder prompts / models pac copilot model list: AI Builder models (including custom prompts) in the environment, with ids for cs_add_tool type 'prompt'. Input parameters: - `activeOnly` (boolean) - `environment` (string): Environment id or URL; default active pac profile - `search` (string) ### `cs_add_flow` (~262 tokens) Scaffold a cloud flow (experimental) EXPERIMENTAL: write workflows//metadata.yaml + workflow.json for a flow with the 'when an agent calls the flow' trigger and a response, optionally exposing it as a tool. Format follows the schema's CloudFlowDefinition and the Power Automate solution JSON; verify with cs_pack and in the portal after push. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `actions` (object): Extra Power Automate actions (name -> definition) inserted before the response - `addTool` (boolean): Also create actions/.mcs.yml invoking this flow - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `description` (string) - `inputs` (array) - `name` (string, required) - `outputs` (array) - `overwrite` (boolean) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_add_trigger` (~171 tokens) Add an event trigger Create trigger/.trigger.mcs.yml pointing at a cloud flow that starts the agent (WorkflowExternalTrigger). The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `description` (string) - `flowId` (string, required) - `name` (string, required) - `overwrite` (boolean) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_add_variable` (~177 tokens) Add a global variable Create variables/.variable.mcs.yml (GlobalVariableComponent, conversation scope). The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `aiVisibility` (string) - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `defaultValue` (string|number|boolean) - `description` (string) - `name` (string, required) - `overwrite` (boolean) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_update_agent` (~508 tokens) Update the agent's settings Edit agent.mcs.yml (standard harness): instructions, display name, conversation starters, model hint, and the settings the portal groups under responses and generative AI: response instructions (wording and formatting), response mode, conversation history, capability toggles (web browsing, code interpreter, image generation, Teams / SharePoint / email / meeting / people search), whether the model may use its own general knowledge, content moderation level, file analysis and semantic search. The first call writes nothing: it returns the change - the current lines against the proposed ones, and the instruction character count against the 8000 the product allows - and the file is written on a second call with confirm: true. Local file change; cs_push applies it. For GitHub Copilot harness (cli-copilot) workspaces the instructions go into settings.mcs.yml. Input parameters: - `addConversationStarters` (array) - `appendInstructions` (string): Add a paragraph to the instructions - `appendResponseInstructions` (string): Add a line to the response formatting, within the same 500 characters - `capabilities` (object): Capability toggles; only the ones you pass are changed - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `contentModeration` (string) - `conversationStarters` (array) - `defaultResponseMode` (string): Response mode: Auto, ThinkDeeper (more reasoning, slower) or QuickResponse - `displayName` (string) - `history` (string): Whether the agent sees conversation history - `historyMessages` (number): How many past user messages to include (with history: conversation) - `instructions` (string): Replace the instructions - `isFileAnalysisEnabled` (boolean) - `isSemanticSearchEnabled` (boolean) - `modelNameHint` (string): Model hint, e.g. GPT5Chat - `responseInstructions` (string): How answers should be worded and formatted (Settings > Responses > Response formatting in the portal), separate from the main instructions. Capped at 500 characters. - `useModelKnowledge` (boolean): Whether the model may answer from its own general knowledge as well as the knowledge sources - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_update_settings` (~161 tokens) Update settings.mcs.yml Set values in settings.mcs.yml by dot path, e.g. {"configuration.settings.GenerativeActionsEnabled": true}. Do not change authoringModel/recognizer/template. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them. Input parameters: - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `patch` (object, required) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_create_test_set_csv` (~144 tokens) Create an evaluation test set (CSV for import) Write the CSV the portal's Evaluation page imports (columns Question, Expected response; max 100 cases). Test sets cannot be created through the API, so this file is imported once in the portal; runs and results are then automated via cs_run_evaluation. suggestFromWorkspace derives cases from topics, starters and knowledge. Input parameters: - `cases` (array) - `maxSuggested` (number) - `outputPath` (string): Default /../-testset.csv - `suggestFromWorkspace` (boolean) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_list_test_sets` (~156 tokens) List evaluation test sets Power Platform API: test sets defined for the agent (standard harness). Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_run_evaluation` (~276 tokens) Run an evaluation Start an evaluation run for a test set (draft agent by default, or the published one). Optionally wait for completion and return the summary. Counts against the 20 runs per agent per 24h limit: requires confirm: true. Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `mcsConnectionId` (string): User profile connection id for authenticated knowledge/tools - `runName` (string) - `runOnPublishedBot` (boolean) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `testSetId` (string, required) - `timeoutSeconds` (number) - `wait` (boolean) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_get_evaluation_run` (~179 tokens) Get an evaluation run Status and per-case results of an evaluation run, with a pass/fail summary per test method. Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `includeRaw` (boolean) - `runId` (string, required) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_list_evaluation_runs` (~150 tokens) List evaluation runs Previous evaluation runs for the agent. Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_list_transcripts` (~269 tokens) List conversation transcripts Sessions people had with the published agent, newest first: when, how many turns, the first thing the user asked, which topics and tools fired, and how the session ended. Read-only. Needs a cached cs_login. Use it to find the session behind a bad answer, then cs_get_transcript for the full turn list. Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `days` (number): Only sessions from the last N days - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `outcome` (string): Only sessions that ended this way - `search` (string): Only sessions whose first user message contains this text - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `top` (number): Maximum sessions (default 100, max 500) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_get_transcript` (~193 tokens) Read one conversation transcript The full turn list of one session: who said what, in order, with the topic and tool attributed to each turn where the transcript records them. Read-only. Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `transcriptId` (string, required): conversationtranscriptid, from cs_list_transcripts - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_summarize_transcripts` (~263 tokens) Summarise how the agent is doing in production Aggregate over recent sessions: how they ended, the escalation rate, average turns, how many never matched a topic, the topics and tools that actually fire, and the questions behind the sessions that went badly. Read-only. This is the input for deciding what to fix next, and for cs_create_test_set_csv fromTranscripts. Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `days` (number): Window in days (default: everything returned) - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `top` (number): Maximum sessions to read (default 100, max 500) - `topN` (number): How many topics/tools/questions to list (default 10) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_test_set_from_transcripts` (~316 tokens) Build an evaluation test set from real conversations Write the portal's import CSV from questions people actually asked, most frequent first, instead of guessing from the workspace. onlyFailed (default true) keeps the sessions that escalated, went unanswered or were abandoned, which are the ones worth turning into regression cases. Read-only apart from writing the file; import it once in the portal, then cs_run_evaluation automates the runs. Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `days` (number): Only sessions from the last N days - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `maxCases` (number): Maximum cases in the CSV (portal limit is 100) - `onlyFailed` (boolean): Default true: only sessions that escalated, went unresolved or were abandoned - `outputPath` (string): Default /../-transcript-testset.csv - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `top` (number): Maximum sessions to read (default 100, max 500) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_chat` (~358 tokens) Chat with the published agent Send one utterance to the published agent and return its replies (and raw activities). Use conversationId to continue. If the agent answers with a sign-in card, signInUrl is returned. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately, then poll cs_job_status. MCP clients cut a tool call off after about 60 seconds; this operation can take much longer, and without this the work i… - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `conversationId` (string): Continue an earlier conversation from cs_chat - `dataverseUrl` (string) - `directLineSecret` (string) - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `maxMs` (number): How long to wait for replies, ms (default 25000, kept under the client call budget) - `schemaName` (string) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `tokenEndpoint` (string): Explicit DirectLine token endpoint - `transport` (string): auto detects the agent's authentication mode via Dataverse; directline for no-auth/manual-auth agents; sdk for Entra SSO agents - `utterance` (string, required) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_run_conversation_tests` (~401 tokens) Run local conversation tests Run a YAML test file (tests: name, utterance, expect, continueConversation) against the published agent through cs_chat and report pass/fail. expect asserts on wording (contains, containsAny, notContains, regex, minLength, noSignIn) and on what the agent did (usedTool, notUsedTool, usedTopic, notUsedTopic, citedKnowledge), so a test can tell a real tool call from an answer that merely sounds right. Every result reports the observed topic, tool and citations whether or not it asserted on them. The CLI-native complement to portal evaluations. Pass writeExample to create a starter file. Input parameters: - `botId` (string): Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `conversationId` (string): Continue an earlier conversation from cs_chat - `dataverseUrl` (string) - `directLineSecret` (string) - `environmentId` (string): Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. - `file` (string) - `schemaName` (string) - `stopOnFail` (boolean) - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. - `tests` (array) - `tokenEndpoint` (string): Explicit DirectLine token endpoint - `transport` (string): auto detects the agent's authentication mode via Dataverse; directline for no-auth/manual-auth agents; sdk for Entra SSO agents - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. - `writeExample` (string): Path to write an example test file, then return ### `cs_create_solution` (~179 tokens) Create an unmanaged solution Create a new unmanaged solution (and its publisher if missing) in an environment by packing an empty solution manifest and importing it with pac. Use it to prepare the container before cs_create_agent with solutionName. Requires confirm: true. Input parameters: - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `displayName` (string) - `environment` (string): Environment id or URL. Defaults to the active pac auth profile. - `publisherName` (string) - `publisherPrefix` (string, required): 2-8 lowercase characters, e.g. contoso - `uniqueName` (string, required): e.g. contoso_Agents - `workDir` (string): Where the manifest and zip are written (default /.cs-solutions/) ### `cs_generate_instructions` (~390 tokens) Generate agent instructions with an AI Builder prompt Write the agent's instructions for it - the system prompt that decides how it answers. Builds a brief from purpose, audience, tone, capabilities, boundaries and examples, send it to an AI Builder prompt or model (pac copilot model predict; pick one with cs_list_prompts), and return the generated instructions. With apply: true the text is written into the agent's instructions (agent.mcs.yml, or settings.mcs.yml for cli-copilot), and only with confirm: true as well - without it the generated text comes back with the change it would make and the character count, and nothing is written. Pass currentInstructions/changeRequest (or refine: true to read the workspace) to revise existing instructions instead. Input parameters: - `apply` (boolean): Write the result into the agent instructions (needs confirm: true as well) - `audience` (string) - `boundaries` (array) - `capabilities` (array): Default: derived from the workspace (topics, knowledge, tools) - `changeRequest` (string) - `confirm` (boolean): Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. - `environment` (string): Environment id or URL. Defaults to the active pac auth profile. - `examples` (array) - `inputMode` (string) - `language` (string) - `modelId` (string) - `modelName` (string): Full or partial AI Builder model / prompt name - `purpose` (string): What the agent is for; required unless refining - `refine` (boolean): Revise the workspace's current instructions using changeRequest - `tone` (string) - `workspace` (string): Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. ### `cs_list_solutions` (~57 tokens) List solutions pac solution list: solutions in an environment with version and managed flag. Needs a pac auth profile. Input parameters: - `environment` (string): Environment id or URL. Defaults to the active pac auth profile. - `includeSystem` (boolean) ### `cs_list_connections` (~63 tokens) List connections pac connection list: connections that exist in an environment (id, connector, owner). Use the ids to map connection references in a deployment settings file before cs_deploy_solution. Input parameters: - `environment` (string): Environment id or URL. Defaults to the active pac auth profile. ### `cs_describe_solution` (~121 tokens) Describe a solution Export a solution (unmanaged, async) and unpack it locally, then inventory everything inside: agents (with harness and component counts), bot components by kind, cloud flows, connection references, environment variables, custom connectors, other component folders. Read-only for the environment. Input parameters: - `environment` (string): Environment id or URL. Defaults to the active pac auth profile. - `name` (string, required): Solution unique name - `workDir` (string): Where to put the export and unpacked source (default /.cs-solutions/) ### `cs_pull_solution` (~188 tokens) Pull a whole solution locally Export the solution (unmanaged and optionally managed), unpack it to /src, write /solution.json, generate deployment-settings.json (connection references + environment variables to map), and clone every agent in the solution into /agents/ as a sync-connected workspace. This is the input for cs_deploy_solution. Input parameters: - `background` (boolean): Run in the background and return a jobId immediately. Use this when the export is large enough that the MCP client times the call out; poll with cs_job_status. - `cloneAgents` (boolean): Default true - `environment` (string): Environment id or URL. Defaults to the active pac auth profile. - `name` (string, required): Solution unique name - `packagetype` (string): Default Both: exports both zips, unpacks both - `targetDir` (string, required) ### `cs_create_deployment_settings` (~192 tokens) Create or update deployment settings pac solution create-settings: the JSON that maps every connection reference (to a connection id in the target environment) and environment variable (to a target value). Pass connectionReferences / environmentVariables to fill values; the result lists what is still unmapped. Input parameters: - `connectionReferences` (object): logicalName -> connectionId in the target environment - `copilotAgents` (object): agent schema name -> Entra security group id allowed to use the agent in the target - `environmentVariables` (object): schemaName -> value for the target - `regenerate` (boolean): Recreate the file even if it exists (mappings are lost) - `settingsFile` (string): Default /deployment-settings.json or next to the zip - `solutionDir` (string): Directory written by cs_pull_solution - `zip` (string): Solution zip (or use solutionDir from cs_pull_solution) ### `cs_pack_solution` (~53 tokens) Pack an unpacked solution folder pac solution pack: zip an unpacked source folder (after local edits) so it can be deployed. Input parameters: - `folder` (string, required) - `packagetype` (string) - `zip` (string, required) ### `cs_deploy_solution` (~253 tokens) Deploy a solution to another environment (1:1) pac solution import into the target environment using the deployment settings file, then publish every Copilot Studio agent from the solution. Source: a zip, or a solutionDir from cs_pull_solution (managed zip preferred when present unless unmanaged: true), or an unpacked srcFolder (packed first). Blocks when connection references or environment variables are unmapped unless allowUnmapped. Requires confirm: true. Input parameters: - `allowUnmapped` (boolean) - `confirm` (boolean): Required to actually perform a change in a live environment. Without it the tool returns a dry run. - `forceOverwrite` (boolean) - `maxAsyncWaitMinutes` (number) - `publishAgents` (boolean): Default true: pac copilot publish for each agent after import - `settingsFile` (string) - `skipLowerVersion` (boolean) - `solutionDir` (string) - `srcFolder` (string): Unpacked solution folder to pack and deploy - `stageAndUpgrade` (boolean) - `targetEnvironment` (string, required): Environment id or URL to deploy into - `unmanaged` (boolean): With solutionDir: deploy the unmanaged zip instead of the managed one - `zip` (string) ### `cs_job_status` (~126 tokens) Check a background job The state of a job started with background: true - running, succeeded or failed - with the phases it has reached and, once finished, the result the tool would have returned. Read-only. Jobs live in the server process, so a restart loses them; pass recordFile to read the copy the job wrote to disk instead. Input parameters: - `jobId` (string): Omit to list every job this server knows about - `recordFile` (string): Read a job record from disk (e.g. /pull-job.json) when the server has been restarted since ### `cs_snapshot_environment` (~244 tokens) Snapshot an environment Capture one environment into a folder for comparison or history: solution version, every agent cloned with pac copilot clone (agents/), and, when signed in, flows, connection references, environment variables and publish state. Read-only for the environment. Input parameters: - `agents` (array): Agent schema names or ids to clone; default: every agent pac copilot list returns - `clientId` (string): Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. - `dir` (string, required): Snapshot folder (recreated) - `environment` (string, required): Environment id or URL - `includeDataverse` (boolean): Default true: flows, connection references, environment variables and publish state via Dataverse (needs cs_login; skipped silently otherwise) - `label` (string, required): Short name such as DEV, TEST, ACC, PROD - `maxAgents` (number): Default 20 - `solution` (string): Solution unique name to record version/managed state for - `tenantId` (string): Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. ### `cs_compare_snapshots` (~181 tokens) Compare two snapshots Offline diff of two snapshot folders: solution version, per-agent YAML differences (noise such as ids, audit info and connection ids removed), flows, connection references, environment variables, unpublished changes. Writes /-vs-.md and .json. failOnDrift returns an error result when drift is found (for pipeline gates). Input parameters: - `a` (string, required): Snapshot folder (earlier stage, e.g. DEV) - `b` (string, required): Snapshot folder (later stage, e.g. TEST) - `failOnDrift` (boolean) - `ignoredKeys` (array) - `includeDiffs` (boolean): Default true: unified diffs in the report - `reportDir` (string): Default: parent of b - `strictVariables` (boolean): Treat differing environment variable values as drift ### `cs_compare_environments` (~248 tokens) Compare a DTAP chain Snapshot every environment in an ordered chain (e.g. DEV, TEST, ACC, PROD) and compare each adjacent pair. Returns one report per pair plus the first stage where drift appears. Snapshots go to /