Copilot Studio MCP
NPM · COPILOT-STUDIO-MCP
Build, test, ship and maintain Microsoft Copilot Studio agents from the editor
Available components
Last scanned (5 hours ago)
Scores higher than 55% of npm servers
Category AI and Machine Learning
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects @azure/msal-node 6.0.1, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 59 of 154 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 19 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 35890 tokens (~242/item across 148 items; 148 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage95
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 86% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 16 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "cs_logout" implies "remove" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 149 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Checks we ran (16)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Security disclosure
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 0
- Security disclosure: unverified → fail ▼ functional
- 4 Nov 26 0
- Security disclosure: fail → unverified ▼ functional
- 29 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 28 Oct 26 0
- Stability: 0.97 → pass security
- Security disclosure: fail → unverified ▼ functional
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −5
- CVE-2026-109461 affects this package: high ▼ security
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 21 Oct 26 0
- Stability: 0.97 → pass security
- 20 Oct 26 0
- Stability: pass → 0.97 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/copilot-studio-mcp@0.1.8
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-xcx6-jx8p-x3h5 | CVE-2026-109461 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | yes |
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 154 packages
| Packages resolved | 154 |
|---|---|
| Deprecated | 1 |
| Stale | 58 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
cs_set_solution_version Set the solution version in Solution.xml ~230
Update the version in a local unpacked solution's Solution.xml, explicitly or by strategy (gittags, filetracking, solution). Local file change only. Runs 'pac solution version' with the active pac auth profile.
| Name | Type | Req | Description |
|---|---|---|---|
| background | boolean | – | Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. |
| buildVersion | string | – | Build version |
| cwd | string | – | Working directory for pac (for project commands: the solution project folder) |
| filename | string | – | Tracker CSV for the filetracking strategy |
| profile | string | – | pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. |
| revisionVersion | string | – | Revision version |
| solutionPath | string | – | Unpacked solution folder or Solution.xml |
| strategy | string | – | Version strategy (see pac solution version help) |
| timeoutSeconds | number | – | Default 600 |
No output schema declared.
No examples provided.
cs_set_tool_preset Choose how many tools are offered ~161
Answer 'there are too many tools': narrow, or restore, the tool list for the rest of this session. The full list is 146 tools and about 50k tokens of schema, which crowds a smaller model's context and makes it choose worse. Presets: core (the loop that builds an agent and gets it live), authoring (local files only), admin (tenant administration), solutions (moving solutions between environments), full (everything). Read-only: it changes nothing in any environment and no tool is lost, only hidden. Ask the user before calling it.
| Name | Type | Req | Description |
|---|---|---|---|
| keep | array | – | Extra tool names to keep on top of the preset |
| preset | string | yes | Which set to offer for the rest of this session |
No output schema declared.
No examples provided.
cs_snapshot_environment Snapshot an environment ~244
Capture one environment into a folder for comparison or history: solution version, every agent cloned with pac copilot clone (agents/<name>), and, when signed in, flows, connection references, environment variables and publish state. Read-only for the environment.
| Name | Type | Req | Description |
|---|---|---|---|
| agents | array | – | Agent schema names or ids to clone; default: every agent pac copilot list returns |
| clientId | string | – | Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. |
| dir | string | yes | Snapshot folder (recreated) |
| environment | string | yes | Environment id or URL |
| includeDataverse | boolean | – | Default true: flows, connection references, environment variables and publish state via Dataverse (needs cs_login; skipped silently otherwise) |
| label | string | yes | Short name such as DEV, TEST, ACC, PROD |
| maxAgents | number | – | Default 20 |
| solution | string | – | Solution unique name to record version/managed state for |
| tenantId | string | – | Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. |
No output schema declared.
No examples provided.
cs_solution_online_version Read or set the online solution version ~260
Without solutionVersion: read the version of a solution in the environment. With it: set that version (mutating). Runs 'pac solution online-version' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise). Only some inputs mutate; see the parameter descriptions.
| Name | Type | Req | Description |
|---|---|---|---|
| background | boolean | – | Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. |
| confirm | boolean | – | Required to actually perform a change in a live environment. Without it the tool returns a dry run. |
| cwd | string | – | Working directory for pac (for project commands: the solution project folder) |
| environment | string | – | Environment id or URL; default: the environment of the active pac auth profile |
| profile | string | – | pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. |
| solutionName | string | yes | Solution unique name |
| solutionVersion | string | – | New version to set; omit to read |
| timeoutSeconds | number | – | Default 600 |
No output schema declared.
No examples provided.
cs_status Agent provisioning status ~91
pac copilot status for an agent id.
| Name | Type | Req | Description |
|---|---|---|---|
| botId | string | – | Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. |
| environmentId | string | – | Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_summarize_transcripts Summarise how the agent is doing in production ~263
Aggregate over recent sessions: how they ended, the escalation rate, average turns, how many never matched a topic, the topics and tools that actually fire, and the questions behind the sessions that went badly. Read-only. This is the input for deciding what to fix next, and for cs_create_test_set_csv fromTranscripts.
| Name | Type | Req | Description |
|---|---|---|---|
| botId | string | – | Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. |
| clientId | string | – | Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. |
| days | number | – | Window in days (default: everything returned) |
| environmentId | string | – | Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. |
| tenantId | string | – | Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. |
| top | number | – | Maximum sessions to read (default 100, max 500) |
| topN | number | – | How many topics/tools/questions to list (default 10) |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_sync_solution Sync a solution project from the environment ~312
Re-export the solution and update an existing unpacked solution folder or .cdsproj with the environment's current state. Read-only for the environment. Runs 'pac solution sync' with the active pac auth profile.
| Name | Type | Req | Description |
|---|---|---|---|
| async | boolean | – | Run the operation asynchronously |
| background | boolean | – | Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. |
| cwd | string | – | Working directory for pac (for project commands: the solution project folder) |
| environment | string | – | Environment id or URL; default: the environment of the active pac auth profile |
| include | string | – | Settings to include in the export (pac solution export --include values) |
| localize | boolean | – | Extract string resources into .resx files |
| map | string | – | Mapping XML file for component folders |
| maxAsyncWaitTime | number | – | Max asynchronous wait time in minutes (default 60) |
| packageType | string | – | Unmanaged, Managed or Both (default Both) |
| profile | string | – | pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. |
| solutionFolder | string | – | Unpacked solution folder (Other/Solution.xml root) or .cdsproj folder; default: cwd |
| timeoutSeconds | number | – | Default 3600 |
No output schema declared.
No examples provided.
cs_test_set_from_transcripts Build an evaluation test set from real conversations ~316
Write the portal's import CSV from questions people actually asked, most frequent first, instead of guessing from the workspace. onlyFailed (default true) keeps the sessions that escalated, went unanswered or were abandoned, which are the ones worth turning into regression cases. Read-only apart from writing the file; import it once in the portal, then cs_run_evaluation automates the runs.
| Name | Type | Req | Description |
|---|---|---|---|
| botId | string | – | Agent (bot) id. Defaults to workspace sync metadata or CPS_AGENT_ID. |
| clientId | string | – | Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. |
| days | number | – | Only sessions from the last N days |
| environmentId | string | – | Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. |
| maxCases | number | – | Maximum cases in the CSV (portal limit is 100) |
| onlyFailed | boolean | – | Default true: only sessions that escalated, went unresolved or were abandoned |
| outputPath | string | – | Default <workspace>/../<agent>-transcript-testset.csv |
| tenantId | string | – | Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. |
| top | number | – | Maximum sessions to read (default 100, max 500) |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_update_agent Update the agent's settings ~508
Edit agent.mcs.yml (standard harness): instructions, display name, conversation starters, model hint, and the settings the portal groups under responses and generative AI: response instructions (wording and formatting), response mode, conversation history, capability toggles (web browsing, code interpreter, image generation, Teams / SharePoint / email / meeting / people search), whether the model may use its own general knowledge, content moderation level, file analysis and semantic search. The first call writes nothing: it returns the change - the current lines against the proposed ones, and the instruction character count against the 8000 the product allows - and the file is written on a second call with confirm: true. Local file change; cs_push applies it. For GitHub Copilot harness (cli-copilot) workspaces the instructions go into settings.mcs.yml.
| Name | Type | Req | Description |
|---|---|---|---|
| addConversationStarters | array | – | – |
| appendInstructions | string | – | Add a paragraph to the instructions |
| appendResponseInstructions | string | – | Add a line to the response formatting, within the same 500 characters |
| capabilities | object | – | Capability toggles; only the ones you pass are changed |
| confirm | boolean | – | Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. |
| contentModeration | string | – | – |
| conversationStarters | array | – | – |
| defaultResponseMode | string | – | Response mode: Auto, ThinkDeeper (more reasoning, slower) or QuickResponse |
| displayName | string | – | – |
| history | string | – | Whether the agent sees conversation history |
| historyMessages | number | – | How many past user messages to include (with history: conversation) |
| instructions | string | – | Replace the instructions |
| isFileAnalysisEnabled | boolean | – | – |
| isSemanticSearchEnabled | boolean | – | – |
| modelNameHint | string | – | Model hint, e.g. GPT5Chat |
| responseInstructions | string | – | How answers should be worded and formatted (Settings > Responses > Response formatting in the portal), separate from the main instructions. Capped at 500 characters. |
| useModelKnowledge | boolean | – | Whether the model may answer from its own general knowledge as well as the knowledge sources |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_update_connection Update a service-principal Dataverse connection ~274
Rotate the app registration or secret behind a service-principal Dataverse connection. Runs 'pac connection update' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise).
| Name | Type | Req | Description |
|---|---|---|---|
| applicationId | string | yes | App registration (client) id |
| background | boolean | – | Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. |
| clientSecret | string | yes | New client secret (masked in logs) (masked in logs and results) |
| confirm | boolean | – | Required to actually perform a change in a live environment. Without it the tool returns a dry run. |
| connectionId | string | yes | Connection id (cs_list_connections) |
| cwd | string | – | Working directory for pac (for project commands: the solution project folder) |
| environment | string | – | Environment id or URL; default: the environment of the active pac auth profile |
| profile | string | – | pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. |
| tenantId | string | yes | Entra tenant id |
| timeoutSeconds | number | – | Default 600 |
No output schema declared.
No examples provided.
cs_update_flow Update a cloud flow ~435
Change a flow's name, description or definition in the environment. Pass 'steps' (and optionally 'trigger') to rebuild the definition the way cs_build_flow_definition does, or 'definition' for a ready-made one; either replaces properties.definition inside the existing clientdata and keeps the connection references. 'clientData' replaces the whole document. Read the current one with cs_get_flow includeDefinition first. Managed flows cannot be edited in place; edit them in their source environment or through a solution. Changes a live environment: requires confirm: true.
| Name | Type | Req | Description |
|---|---|---|---|
| clientData | object | – | The whole clientdata document; overrides 'definition' |
| clientId | string | – | Entra app (client) id for MSAL. Defaults to CPS_CLIENT_ID, then the first-party VS Code id. |
| confirm | boolean | – | Required to actually perform a change in a live environment. Without it the tool returns a dry run. |
| connectionReferencePrefix | string | – | Prefix for generated connection reference names, usually your publisher prefix |
| connectionReferences | object | – | Connection reference entries to add or explicitly replace; existing entries are otherwise preserved |
| dataverseUrl | string | – | Dataverse URL; default: from the workspace or the environment |
| definition | object | – | Power Automate definition object (properties.definition), instead of steps |
| description | string | – | – |
| environmentId | string | – | Power Platform environment id (GUID). Defaults to workspace sync metadata or CPS_ENVIRONMENT_ID. |
| flowId | string | yes | Flow (workflow) id |
| name | string | – | – |
| outputs | array | – | What the flow answers with (agent-callable and HTTP flows) |
| steps | array | – | Steps in order; each waits for the previous one to succeed |
| tenantId | string | – | Entra tenant id. Defaults to the workspace sync metadata, then CPS_TENANT_ID. |
| trigger | – | – | Default: 'agent' (When an agent calls the flow) |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_update_settings Update settings.mcs.yml ~161
Set values in settings.mcs.yml by dot path, e.g. {"configuration.settings.GenerativeActionsEnabled": true}. Do not change authoringModel/recognizer/template. The first call changes nothing: it returns the files it would write, as a diff against what is there now, for the user to approve. Call it again with the same arguments plus confirm: true to write them.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Required to write the change to the file. Without it the tool returns a preview - the changed lines against the current ones, and the character count - and writes nothing. |
| patch | object | yes | – |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
cs_upgrade_solution Apply a staged solution upgrade ~270
Complete a managed solution upgrade that was imported as a staged upgrade (pac solution import --stage-and-upgrade or the portal's 'Stage for upgrade'). Runs 'pac solution upgrade' with the active pac auth profile. Mutates a live environment: requires confirm: true (a dry run otherwise).
| Name | Type | Req | Description |
|---|---|---|---|
| async | boolean | – | Run the operation asynchronously |
| background | boolean | – | Run in the background and return a jobId immediately, for a command that takes longer than the client will wait. Poll cs_job_status. |
| confirm | boolean | – | Required to actually perform a change in a live environment. Without it the tool returns a dry run. |
| cwd | string | – | Working directory for pac (for project commands: the solution project folder) |
| environment | string | – | Environment id or URL; default: the environment of the active pac auth profile |
| maxAsyncWaitTime | number | – | Max asynchronous wait time in minutes (default 60) |
| profile | string | – | pac auth profile to run as: the admin account for tenant commands. Defaults to CPS_ADMIN_PROFILE for admin commands and CPS_PAC_PROFILE otherwise, then the active profile. cs_init lists the profiles. |
| solutionName | string | yes | Solution unique name |
| timeoutSeconds | number | – | Default 3600 |
No output schema declared.
No examples provided.
cs_validate Validate workspace YAML ~124
Structural validation of every component file against the Copilot Studio authoring schema (kinds, unknown/missing properties, duplicate ids, placeholders, Power Fx prefixes, variable scopes) plus cross-file checks (connection references, topic redirects). Answers 'is anything broken in these files?'; it only reads them and sends nothing anywhere. cs_push runs it itself and blocks on errors.
| Name | Type | Req | Description |
|---|---|---|---|
| file | string | – | Validate a single file (relative to workspace) |
| workspace | string | – | Path to (or inside) the agent workspace. Defaults to CPS_WORKSPACE or the current directory. |
No output schema declared.
No examples provided.
How do I install the Copilot Studio MCP server?
Copilot Studio MCP runs locally as an npm package, launched with npx -y copilot-studio-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · copilot-studio-mcp
claude mcp add jgt87-copilot-studio-mcp -- npx -y copilot-studio-mcp
What is the Copilot Studio MCP server?
Copilot Studio MCP is listed in the public MCP registry as io.github.jgt87/copilot-studio-mcp. Build, test, ship and maintain Microsoft Copilot Studio agents from the editor. This page covers its npm package (copilot-studio-mcp).
Is the Copilot Studio MCP server safe to use?
Copilot Studio MCP scores 77 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Copilot Studio MCP server expose?
Copilot Studio MCP exposes 148 tools: cs_init, cs_login, cs_login_status, cs_logout, cs_set_tool_preset, and 143 more. Their descriptions and schemas cost roughly 35,203 tokens of context every time the server is loaded.
Is the Copilot Studio MCP server still maintained?
Copilot Studio MCP is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Copilot Studio MCP server under?
Copilot Studio MCP declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the Copilot Studio MCP server?
VerifyMCP ran 16 checks on Copilot Studio MCP, covering Malware scan, Known CVEs, Install scripts, Dependency health and 12 more. Endpoint Security and Transport & Reachability do not apply to an npm package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.