Copilot Studio MCP
NPM · COPILOT-STUDIO-MCP · SCANNED SEP 20
Build, test, ship and maintain Microsoft Copilot Studio agents from the editor
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 60 of 157 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 5 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 34022 tokens (~239/item across 142 items; 142 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management30
- Stability observed for 9 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 85% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 16 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "cs_logout" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 143 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Copilot Studio MCP server?
Copilot Studio MCP runs locally as an npm package, launched with npx -y copilot-studio-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · copilot-studio-mcp
claude mcp add jgt87-copilot-studio-mcp -- npx -y copilot-studio-mcp
{
"mcpServers": {
"jgt87-copilot-studio-mcp": {
"command": "npx",
"args": [
"-y",
"copilot-studio-mcp"
]
}
}
} {
"servers": {
"jgt87-copilot-studio-mcp": {
"command": "npx",
"args": [
"-y",
"copilot-studio-mcp"
]
}
}
} codex mcp add jgt87-copilot-studio-mcp -- npx -y copilot-studio-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"jgt87-copilot-studio-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"copilot-studio-mcp"
],
"enabled": true
}
}
} openclaw mcp add jgt87-copilot-studio-mcp --command npx --arg -y --arg copilot-studio-mcp
mcp_servers:
jgt87-copilot-studio-mcp:
command: "npx"
args: ["-y", "copilot-studio-mcp"] {
"McpServers": {
"jgt87-copilot-studio-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"copilot-studio-mcp"
]
}
}
} assistant mcp add jgt87-copilot-studio-mcp -t stdio -c npx -a -y copilot-studio-mcp
{
"mcpServers": {
"jgt87-copilot-studio-mcp": {
"command": "npx",
"args": [
"-y",
"copilot-studio-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 0
- Security disclosure: unverified → fail ▼ functional
- 16 Sept 26 +1
- Security disclosure: fail → unverified ▼ functional
- 15 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 14 Sept 26 −13
- Malware scan: pass → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Stability: Stability not yet verified: we do not have a sandbox capture of the MCP schema this version of the package serves yet. security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Stability: unverified → 0.10 ▲ functional
- Package version: 0.1.6 → 0.1.7 functional
- 13 Sept 26 +15
- Malware scan: unverified → pass ▲ security
- 11 Sept 26 53
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/copilot-studio-mcp@0.1.7
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 157 packages
| Packages resolved | 157 |
|---|---|
| Deprecated | 1 |
| Stale | 59 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cs_sync_solution Sync a solution project from the environment ~312
Re-export the solution and update an existing unpacked solution folder or .cdsproj with the environment's current state. Read-only for the environment. Runs 'pac solution sync' with the active pac auth profile.
| Name | Type | Req | Description |
|---|---|---|---|
| async | boolean | – | Run the operation asynchronously |
| background | boolean | – | Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. |
| cwd | string | – | Working directory for pac (for project commands: the solution project folder) |
| environment | string | – | Environment id or URL; default: the environment of the active pac auth profile |
| include | string | – | Settings to include in the export (pac solution export --include values) |
| localize | boolean | – | Extract string resources into .resx files |
| map | string | – | Mapping XML file for component folders |
| maxAsyncWaitTime | number | – | Max asynchronous wait time in minutes (default 60) |
| packageType | string | – | Unmanaged, Managed or Both (default Both) |
| profile | string | – | pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. |
| solutionFolder | string | – | Unpacked solution folder (Other/Solution.xml root) or .cdsproj folder; default: cwd |
| timeoutSeconds | number | – | Default 3600 |
No output schema declared.
No examples provided.
cs_test_set_from_transcripts Build an evaluation test set from real conversations ~316
Write the portal's import CSV from questions people actually asked, most frequent first, instead of guessing from the workspace. onlyFailed (default true) keeps the sessions that escalated, went unanswered or were abandoned, which are the ones worth turning into regression cases. Read-only apart from writing the file; import it once in the portal, then cs_run_evaluation automates the runs.
| Name | Type | Req | Description |
|---|---|---|---|
| botId | string | – | Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. |
| clientId | string | – | Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. |
| days | number | – | Only sessions from the last N days |
| environmentId | string | – | Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. |
| maxCases | number | – | Maximum cases in the CSV (portal limit is 100) |
| onlyFailed | boolean | – | Default true: only sessions that escalated, went unresolved or were abandoned |
| outputPath | string | – | Default <workspace>/../<agent>-transcript-testset.csv |
| tenantId | string | – | Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. |
| top | number | – | Maximum sessions to read (default 100, max 500) |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_update_agent Update the agent's settings ~508
Edit agent.mcs.yml (standard harness): instructions, display name, conversation starters, model hint, and the settings the portal groups under responses and generative AI: response instructions (wording and formatting), response mode, conversation history, capability toggles (web browsing, code interpreter, image generation, Teams / SharePoint / email / meeting / people search), whether the model may use its own general knowledge, content moderation level, file analysis and semantic search. The first call writes nothing: it returns the change - the current lines against the proposed ones, and the instruction character count against the 8000 the product allows - and the file is written on a second call with confirm: true. Local file change; cs_push applies it. For GitHub Copilot harness (cli-copilot) workspaces the instructions go into settings.mcs.yml.
| Name | Type | Req | Description |
|---|---|---|---|
| addConversationStarters | array | – | – |
| appendInstructions | string | – | Add a paragraph to the instructions |
| appendResponseInstructions | string | – | Add a line to the response formatting, within the same 500 characters |
| capabilities | object | – | Capability toggles; only the ones you pass are changed |
| confirm | boolean | – | Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. |
| contentModeration | string | – | – |
| conversationStarters | array | – | – |
| defaultResponseMode | string | – | Response mode: Auto, ThinkDeeper (more reasoning, slower) or QuickResponse |
| displayName | string | – | – |
| history | string | – | Whether the agent sees conversation history |
| historyMessages | number | – | How many past user messages to include (with history: conversation) |
| instructions | string | – | Replace the instructions |
| isFileAnalysisEnabled | boolean | – | – |
| isSemanticSearchEnabled | boolean | – | – |
| modelNameHint | string | – | Model hint, e.g. GPT5Chat |
| responseInstructions | string | – | How answers should be worded and formatted (Settings > Responses > Response formatting in the portal), separate from the main instructions. Capped at 500 characters. |
| useModelKnowledge | boolean | – | Whether the model may answer from its own general knowledge as well as the knowledge sources |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_update_connection Update a service-principal Dataverse connection ~274
Rotate the app registration or secret behind a service-principal Dataverse connection. Runs 'pac connection update' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise).
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | yes | App registration (client) id |
| background | boolean | – | Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. |
| clientSecret | string | yes | New client secret (masked in logs) (masked in logs and results) |
| confirm | boolean | – | Required to actually perform a change in a live environment. Without it the tool returns a dry run. |
| connectionId | string | yes | Connection id (cs_list_connections) |
| cwd | string | – | Working directory for pac (for project commands: the solution project folder) |
| environment | string | – | Environment id or URL; default: the environment of the active pac auth profile |
| profile | string | – | pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. |
| tenantId | string | yes | Entra tenant id |
| timeoutSeconds | number | – | Default 600 |
No output schema declared.
No examples provided.
cs_update_flow Update a cloud flow ~435
Change a flow's name, description or definition in the environment. Pass 'steps' (and optionally 'trigger') to rebuild the definition the way cs_build_flow_definition does, or 'definition' for a ready-made one; either replaces properties.definition inside the existing clientdata and keeps the connection references. 'clientData' replaces the whole document. Read the current one with cs_get_flow includeDefinition first. Managed flows cannot be edited in place; edit them in their source environment or through a solution. Changes a live environment: requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| clientData | object | – | The whole clientdata document; overrides 'definition' |
| clientId | string | – | Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. |
| confirm | boolean | – | Required to actually perform a change in a live environment. Without it the tool returns a dry run. |
| connectionReferencePrefix | string | – | Prefix for generated connection reference names, usually your publisher prefix |
| connectionReferences | object | – | Connection reference entries to add or explicitly replace; existing entries are otherwise preserved |
| dataverseUrl | string | – | Dataverse URL; default: from the workspace or the environment |
| definition | object | – | Power Automate definition object (properties.definition), instead of steps |
| description | string | – | – |
| environmentId | string | – | Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. |
| flowId | string | yes | Flow (workflow) id |
| name | string | – | – |
| outputs | array | – | What the flow answers with (agent-callable and HTTP flows) |
| steps | array | – | Steps in order; each waits for the previous one to succeed |
| tenantId | string | – | Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. |
| trigger | – | – | Default: 'agent' (When an agent calls the flow) |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_update_settings Update settings.mcs.yml ~161
Set values in settings.mcs.yml by dot path, e.g. {"configuration.settings.GenerativeActionsEnabled": true}. Do not change authoringModel/recognizer/template. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. |
| patch | object | yes | – |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_upgrade_solution Apply a staged solution upgrade ~270
Complete a managed solution upgrade that was imported as a staged upgrade (pac solution import --stage-and-upgrade or the portal's 'Stage for upgrade'). Runs 'pac solution upgrade' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise).
| Name | Type | Req | Description |
|---|---|---|---|
| async | boolean | – | Run the operation asynchronously |
| background | boolean | – | Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. |
| confirm | boolean | – | Required to actually perform a change in a live environment. Without it the tool returns a dry run. |
| cwd | string | – | Working directory for pac (for project commands: the solution project folder) |
| environment | string | – | Environment id or URL; default: the environment of the active pac auth profile |
| maxAsyncWaitTime | number | – | Max asynchronous wait time in minutes (default 60) |
| profile | string | – | pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. |
| solutionName | string | yes | Solution unique name |
| timeoutSeconds | number | – | Default 3600 |
No output schema declared.
No examples provided.
cs_validate Validate workspace YAML ~124
Structural validation of every component file against the Copilot Studio authoring schema (kinds, unknown/missing properties, duplicate ids, placeholders, Power Fx prefixes, variable scopes) plus cross-file checks (connection references, topic redirects). Answers 'is anything broken in these files?'; it only reads them and sends nothing anywhere. cs_push runs it itself and blocks on errors.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | – | Validate a single file (relative to workspace) |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
What is the Copilot Studio MCP server?
Copilot Studio MCP is listed in the public MCP registry as io.github.jgt87/copilot-studio-mcp. Build, test, ship and maintain Microsoft Copilot Studio agents from the editor. This page covers its npm package (copilot-studio-mcp).
Is the Copilot Studio MCP server safe to use?
Copilot Studio MCP scores 72 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Copilot Studio MCP server expose?
Copilot Studio MCP exposes 142 tools: cs_init, cs_login, cs_login_status, cs_logout, cs_set_tool_preset, and 137 more. Their descriptions and schemas cost roughly 33,335 tokens of context every time the server is loaded.
Is the Copilot Studio MCP server still maintained?
Copilot Studio MCP is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Copilot Studio MCP server under?
Copilot Studio MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.