Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Copilot Studio MCP

NPM · COPILOT-STUDIO-MCP

Build, test, ship and maintain Microsoft Copilot Studio agents from the editor

Available components

0 this week 77 Trust /100

Last scanned (5 hours ago)

Scores higher than 55% of npm servers

Category AI and Machine Learning

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security81
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known high-severity CVE affects @azure/msal-node 6.0.1, a direct dependency. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 59 of 154 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability76
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 35890 tokens (~242/item across 148 items; 148 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
  • No destabilizing schema changes in the last 30 days.Pass
Tool Coverage95
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 86% of tool parameters carry a description.Partial
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 16 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "cs_logout" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 149 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
What we tested

Checks we ran (16)

  • Malware scan
  • Known CVEs
  • Install scripts
  • Dependency health
  • Source repository
  • Provenance
  • License
  • Maintenance
  • Security disclosure
  • Schema quality
  • Stability
  • Tool coverage
  • Injection markers
  • Destructive annotations
  • Judged manipulation
  • MCP protocol

Does not apply to this package (2)

  • Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
  • Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.

The score does not measure everything. What the score does not measure →

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 0
    • Security disclosure: unverified → fail ▼ functional
  • 4 Nov 26 0
    • Security disclosure: fail → unverified ▼ functional
  • 29 Oct 26 0
    • Security disclosure: unverified → fail ▼ functional
  • 28 Oct 26 0
    • Stability: 0.97 → pass security
    • Security disclosure: fail → unverified ▼ functional
  • 27 Oct 26 0
    • Stability: pass → 0.97 functional
  • 24 Oct 26 −5
    • CVE-2026-109461 affects this package: high ▼ security
    • CVE-2023-54404 affects this package: high ▼ security
    • Known CVEs: pass → fail ▼ security
  • 21 Oct 26 0
    • Stability: 0.97 → pass security
  • 20 Oct 26 0
    • Stability: pass → 0.97 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/copilot-studio-mcp@0.1.8

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Vulnerabilities 2 findings
ID CVE Severity Vector Fix available
GHSA-xcx6-jx8p-x3h5 CVE-2026-109461 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yes
GHSA-mrhx-c7xc-m3w5 CVE-2023-54404 high CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 154 packages
Packages resolved 154
Deprecated 1
Stale 58
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 148 exposed · ~35,203 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
cs_set_solution_version ~230

Update the version in a local unpacked solution's Solution.xml, explicitly or by strategy (gittags, filetracking, solution). Local file change only. Runs 'pac solution version' with the active pac auth profile.

NameTypeReqDescription
backgroundboolean–Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status.
buildVersionstring–Build version
cwdstring–Working directory for pac (for project commands: the solution project folder)
filenamestring–Tracker CSV for the filetracking strategy
profilestring–pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles.
revisionVersionstring–Revision version
solutionPathstring–Unpacked solution folder or Solution.xml
strategystring–Version strategy (see pac solution version help)
timeoutSecondsnumber–Default 600

No output schema declared.

No examples provided.

cs_set_tool_preset ~161

Answer 'there are too many tools': narrow, or restore, the tool list for the rest of this session. The full list is 146 tools and about 50k tokens of schema, which crowds a smaller model's context and makes it choose worse. Presets: core (the loop that builds an agent and gets it live), authoring (local files only), admin (tenant administration), solutions (moving solutions between environments), full (everything). Read-only: it changes nothing in any environment and no tool is lost, only hidden. Ask the user before calling it.

NameTypeReqDescription
keeparray–Extra tool names to keep on top of the preset
presetstringyesWhich set to offer for the rest of this session

No output schema declared.

No examples provided.

cs_snapshot_environment ~244

Capture one environment into a folder for comparison or history: solution version, every agent cloned with pac copilot clone (agents/<name>), and, when signed in, flows, connection references, environment variables and publish state. Read-only for the environment.

NameTypeReqDescription
agentsarray–Agent schema names or ids to clone; default: every agent pac copilot list returns
clientIdstring–Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id.
dirstringyesSnapshot folder (recreated)
environmentstringyesEnvironment id or URL
includeDataverseboolean–Default true: flows, connection references, environment variables and publish state via Dataverse (needs cs_login; skipped silently otherwise)
labelstringyesShort name such as DEV, TEST, ACC, PROD
maxAgentsnumber–Default 20
solutionstring–Solution unique name to record version/managed state for
tenantIdstring–Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID.

No output schema declared.

No examples provided.

cs_solution_online_version ~260

Without solutionVersion: read the version of a solution in the environment. With it: set that version (mutating). Runs 'pac solution online-version' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Only some inputs mutate; see the parameter descriptions.

NameTypeReqDescription
backgroundboolean–Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status.
confirmboolean–Required to actually perform a change in a live environment. Without it the tool returns a dry run.
cwdstring–Working directory for pac (for project commands: the solution project folder)
environmentstring–Environment id or URL; default: the environment of the active pac auth profile
profilestring–pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles.
solutionNamestringyesSolution unique name
solutionVersionstring–New version to set; omit to read
timeoutSecondsnumber–Default 600

No output schema declared.

No examples provided.

cs_status ~91

pac copilot status for an agent id.

NameTypeReqDescription
botIdstring–Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID.
environmentIdstring–Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID.
workspacestring–Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory.

No output schema declared.

No examples provided.

cs_summarize_transcripts ~263

Aggregate over recent sessions: how they ended, the escalation rate, average turns, how many never matched a topic, the topics and tools that actually fire, and the questions behind the sessions that went badly. Read-only. This is the input for deciding what to fix next, and for cs_create_test_set_csv fromTranscripts.

NameTypeReqDescription
botIdstring–Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID.
clientIdstring–Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id.
daysnumber–Window in days (default: everything returned)
environmentIdstring–Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID.
tenantIdstring–Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID.
topnumber–Maximum sessions to read (default 100, max 500)
topNnumber–How many topics/tools/questions to list (default 10)
workspacestring–Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory.

No output schema declared.

No examples provided.

cs_sync_solution ~312

Re-export the solution and update an existing unpacked solution folder or .cdsproj with the environment's current state. Read-only for the environment. Runs 'pac solution sync' with the active pac auth profile.

NameTypeReqDescription
asyncboolean–Run the operation asynchronously
backgroundboolean–Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status.
cwdstring–Working directory for pac (for project commands: the solution project folder)
environmentstring–Environment id or URL; default: the environment of the active pac auth profile
includestring–Settings to include in the export (pac solution export --include values)
localizeboolean–Extract string resources into .resx files
mapstring–Mapping XML file for component folders
maxAsyncWaitTimenumber–Max asynchronous wait time in minutes (default 60)
packageTypestring–Unmanaged, Managed or Both (default Both)
profilestring–pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles.
solutionFolderstring–Unpacked solution folder (Other/Solution.xml root) or .cdsproj folder; default: cwd
timeoutSecondsnumber–Default 3600

No output schema declared.

No examples provided.

cs_test_set_from_transcripts ~316

Write the portal's import CSV from questions people actually asked, most frequent first, instead of guessing from the workspace. onlyFailed (default true) keeps the sessions that escalated, went unanswered or were abandoned, which are the ones worth turning into regression cases. Read-only apart from writing the file; import it once in the portal, then cs_run_evaluation automates the runs.

NameTypeReqDescription
botIdstring–Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID.
clientIdstring–Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id.
daysnumber–Only sessions from the last N days
environmentIdstring–Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID.
maxCasesnumber–Maximum cases in the CSV (portal limit is 100)
onlyFailedboolean–Default true: only sessions that escalated, went unresolved or were abandoned
outputPathstring–Default <workspace>/../<agent>-transcript-testset.csv
tenantIdstring–Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID.
topnumber–Maximum sessions to read (default 100, max 500)
workspacestring–Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory.

No output schema declared.

No examples provided.

cs_update_agent ~508

Edit agent.mcs.yml (standard harness): instructions, display name, conversation starters, model hint, and the settings the portal groups under responses and generative AI: response instructions (wording and formatting), response mode, conversation history, capability toggles (web browsing, code interpreter, image generation, Teams / SharePoint / email / meeting / people search), whether the model may use its own general knowledge, content moderation level, file analysis and semantic search. The first call writes nothing: it returns the change - the current lines against the proposed ones, and the instruction character count against the 8000 the product allows - and the file is written on a second call with confirm: true. Local file change; cs_push applies it. For GitHub Copilot harness (cli-copilot) workspaces the instructions go into settings.mcs.yml.

NameTypeReqDescription
addConversationStartersarray––
appendInstructionsstring–Add a paragraph to the instructions
appendResponseInstructionsstring–Add a line to the response formatting, within the same 500 characters
capabilitiesobject–Capability toggles; only the ones you pass are changed
confirmboolean–Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing.
contentModerationstring––
conversationStartersarray––
defaultResponseModestring–Response mode: Auto, ThinkDeeper (more reasoning, slower) or QuickResponse
displayNamestring––
historystring–Whether the agent sees conversation history
historyMessagesnumber–How many past user messages to include (with history: conversation)
instructionsstring–Replace the instructions
isFileAnalysisEnabledboolean––
isSemanticSearchEnabledboolean––
modelNameHintstring–Model hint, e.g. GPT5Chat
responseInstructionsstring–How answers should be worded and formatted (Settings > Responses > Response formatting in the portal), separate from the main instructions. Capped at 500 characters.
useModelKnowledgeboolean–Whether the model may answer from its own general knowledge as well as the knowledge sources
workspacestring–Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory.

No output schema declared.

No examples provided.

cs_update_connection ~274

Rotate the app registration or secret behind a service-principal Dataverse connection. Runs 'pac connection update' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise).

NameTypeReqDescription
applicationIdstringyesApp registration (client) id
backgroundboolean–Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status.
clientSecretstringyesNew client secret (masked in logs) (masked in logs and results)
confirmboolean–Required to actually perform a change in a live environment. Without it the tool returns a dry run.
connectionIdstringyesConnection id (cs_list_connections)
cwdstring–Working directory for pac (for project commands: the solution project folder)
environmentstring–Environment id or URL; default: the environment of the active pac auth profile
profilestring–pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles.
tenantIdstringyesEntra tenant id
timeoutSecondsnumber–Default 600

No output schema declared.

No examples provided.

cs_update_flow ~435

Change a flow's name, description or definition in the environment. Pass 'steps' (and optionally 'trigger') to rebuild the definition the way cs_build_flow_definition does, or 'definition' for a ready-made one; either replaces properties.definition inside the existing clientdata and keeps the connection references. 'clientData' replaces the whole document. Read the current one with cs_get_flow includeDefinition first. Managed flows cannot be edited in place; edit them in their source environment or through a solution. Changes a live environment: requires confirm: true.

NameTypeReqDescription
clientDataobject–The whole clientdata document; overrides 'definition'
clientIdstring–Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id.
confirmboolean–Required to actually perform a change in a live environment. Without it the tool returns a dry run.
connectionReferencePrefixstring–Prefix for generated connection reference names, usually your publisher prefix
connectionReferencesobject–Connection reference entries to add or explicitly replace; existing entries are otherwise preserved
dataverseUrlstring–Dataverse URL; default: from the workspace or the environment
definitionobject–Power Automate definition object (properties.definition), instead of steps
descriptionstring––
environmentIdstring–Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID.
flowIdstringyesFlow (workflow) id
namestring––
outputsarray–What the flow answers with (agent-callable and HTTP flows)
stepsarray–Steps in order; each waits for the previous one to succeed
tenantIdstring–Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID.
trigger––Default: 'agent' (When an agent calls the flow)
workspacestring–Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory.

No output schema declared.

No examples provided.

cs_update_settings ~161

Set values in settings.mcs.yml by dot path, e.g. {"configuration.settings.GenerativeActionsEnabled": true}. Do not change authoringModel/recognizer/template. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them.

NameTypeReqDescription
confirmboolean–Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing.
patchobjectyes–
workspacestring–Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory.

No output schema declared.

No examples provided.

cs_upgrade_solution ~270

Complete a managed solution upgrade that was imported as a staged upgrade (pac solution import --stage-and-upgrade or the portal's 'Stage for upgrade'). Runs 'pac solution upgrade' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise).

NameTypeReqDescription
asyncboolean–Run the operation asynchronously
backgroundboolean–Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status.
confirmboolean–Required to actually perform a change in a live environment. Without it the tool returns a dry run.
cwdstring–Working directory for pac (for project commands: the solution project folder)
environmentstring–Environment id or URL; default: the environment of the active pac auth profile
maxAsyncWaitTimenumber–Max asynchronous wait time in minutes (default 60)
profilestring–pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles.
solutionNamestringyesSolution unique name
timeoutSecondsnumber–Default 3600

No output schema declared.

No examples provided.

cs_validate ~124

Structural validation of every component file against the Copilot Studio authoring schema (kinds, unknown/missing properties, duplicate ids, placeholders, Power Fx prefixes, variable scopes) plus cross-file checks (connection references, topic redirects). Answers 'is anything broken in these files?'; it only reads them and sends nothing anywhere. cs_push runs it itself and blocks on errors.

NameTypeReqDescription
filestring–Validate a single file (relative to workspace)
workspacestring–Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory.

No output schema declared.

No examples provided.

Install

How do I install the Copilot Studio MCP server?

Copilot Studio MCP runs locally as an npm package, launched with npx -y copilot-studio-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · copilot-studio-mcp

# add to Claude Code
claude mcp add jgt87-copilot-studio-mcp -- npx -y copilot-studio-mcp
Common questions

What is the Copilot Studio MCP server?

Copilot Studio MCP is listed in the public MCP registry as io.github.jgt87/copilot-studio-mcp. Build, test, ship and maintain Microsoft Copilot Studio agents from the editor. This page covers its npm package (copilot-studio-mcp).

Is the Copilot Studio MCP server safe to use?

Copilot Studio MCP scores 77 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Copilot Studio MCP server expose?

Copilot Studio MCP exposes 148 tools: cs_init, cs_login, cs_login_status, cs_logout, cs_set_tool_preset, and 143 more. Their descriptions and schemas cost roughly 35,203 tokens of context every time the server is loaded.

Is the Copilot Studio MCP server still maintained?

Copilot Studio MCP is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Copilot Studio MCP server under?

Copilot Studio MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

What did VerifyMCP test on the Copilot Studio MCP server?

VerifyMCP ran 16 checks on Copilot Studio MCP, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.