Test: GitHub MCP Server built-in to Copilot Chat #279705
Description
refs: #254836
Complexity: 4
Some Context
This iteration we brought the GitHub Remote MCP Server definition into the Copilot Chat extension. This is nice because:
- There are features of Copilot like Copilot CLI & Copilot Cloud Agent that already leverage GH MCP built-in and they depend on it... but it's not available in VS Code's agent mode unless you manually install it there. Good for alignment and consistency as you delegate to other agents.
- we can re-use auth state so that the user doesn't have to see another auth prompt by adding GH MCP
- we can support Proxima (and other GH MCP skus) in a completely transparent way rather than the user having to manually configure which endpoint to use.
It's not quite ready to be enabled by default, read the known issues section below, but you can enable it on-demand and give it a try in its current state.
Prereq
First things first, enable the MCP Server:
"github.copilot.chat.githubMcpServer.enabled": trueDoing this, the GitHub MCP Server should automatically be enabled and checked in the tool picker in Agent mode.
Base case
Go ahead and ask it a question about issues in the repo or something.
If you have already done "big auth" which happens when you sign in to:
- GH PR
- GH Repos
- GH built-in "push" extension
- Copilot features that require/ask it like Copilot Cloud Agent, codesearch
You will notice that GH MCP "just works". No additional auth flow.
If you haven't done that "big auth" and instead did only "small auth" like:
- Signing in to Settings Sync
- Signing in to Copilot Chat for the first time
You will get an auth prompt for the "big auth", which is required for GH MCP since it wants details about your repo, etc. Subsequent reloads will not ask you for auth anymore.
Speaking of auth, if you sign out, the GH MCP Server connection should be closed (MCP: List Servers)... and when you sign in again, it should kick back in.
This is the simple case.
Additional things to try
GitHub MCP Configuration
GitHub MCP has a way to configure what tools comeback and also the behavior of the tools. When you manually installed GH MCP, the only way to really do this was to either modify the URL of the server or add certain headers in the headers section of the MCP Server config. We've abstracted away that detail by providing VS Code settings. There are 3 of them:
- toolsets (
"github.copilot.chat.githubMcpServer.toolsets"): let's you configure what tools come back. By defaultdefaultis used... but you can extend this by addingworkflows. These are documented on the GH MCP Server docs - readonly (
"github.copilot.chat.githubMcpServer.readonly"): let's you force GH MCP to only return readonly tools. No write tools will come back as valid tools. This is documented on the GH MCP Server docs. - lockdown (
"github.copilot.chat.githubMcpServer.lockdown"): I don't quite understand the semantics of this setting... but it seems to influce what comes back in tool calls. This is documented on the GH MCP Server docs.
Note, there's already an issue I opened on "extending" MCP Servers... which could solve this same problem by allowing users to just configure the headers directly for this server (and prevent us from being out of sync with GitHub should they ever change it... ie changing "toolsets" to be called "toolgroups" or whatever).
Step-up auth (skip for now as this is not lit up yet)
The GitHub MCP Server support step up auth... meaning if it is given an auth token that is not good enough, then it will respond in a well-defined OAuth-y way that VS Code is able to handle. When this happens, you'll see an auth prompt.
The best way to get this to trigger is to:
- add the
orgstoolset - ask something that uses an org tool
When you do this, VS Code will ask you to re-auth and the tool call should then go through.
Important to note that re-authing is pretty rare. The vast majority of GH MCP tools will be satisfied with the "big auth" I referred to before. However, there are some that are not and that's what this flow is for.
Known issues
- Figure out a way to advertise MCP servers contributed by extensions without such a high cost of tokens #279704
- GitHub MCP Server doesn't currently send the right response when the GitHub Auth token it was given isn't good enough. They are actively working on this.
