mirror of
https://github.com/github/awesome-copilot.git
synced 2026-08-06 09:09:03 +00:00
Alex Yang (DevDiv)
2f258c7226
Replace Azure CLI-only authentication with InteractiveBrowserCredential, protected sign-in lifecycle endpoints, and subscription refresh after sign-in. Persist the Azure Identity cache securely across extension reloads and align connector restart guidance with the GitHub Copilot app. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
93 lines
4.4 KiB
Markdown
93 lines
4.4 KiB
Markdown
# MCP Connectors — Copilot CLI Canvas Extension
|
|
|
|
A GitHub Copilot CLI **canvas extension** that lets you browse and add MCP
|
|
connectors from an Azure **Connector Namespace** directly inside a Copilot CLI
|
|
session. Search by name or category, sign in to a connector, then restart the
|
|
session to make its tools available to the agent.
|
|
|
|
> The canvas talks to public Azure Resource Manager (`management.azure.com`)
|
|
> using an interactive Microsoft Entra browser sign-in. It does not register its
|
|
> own Entra application. Azure Identity persists the account session in the
|
|
> operating system's encrypted credential store.
|
|
|
|
## Prerequisites
|
|
|
|
- **GitHub Copilot CLI** (the host that loads canvas extensions).
|
|
- A browser for Microsoft Entra sign-in. The extension prompts when Azure
|
|
authentication is required and restores the encrypted Azure Identity session
|
|
after extension or Copilot CLI restarts.
|
|
- **An Azure subscription with a Connector Namespace** — resource type
|
|
`Microsoft.Web/connectorGateways` (API version `2026-05-01-preview`). This is
|
|
a preview resource provider; you must have access to it for the catalog to
|
|
load. Without it the extension installs fine but has nothing to show.
|
|
|
|
## Install
|
|
|
|
Install it from the public Awesome Copilot repository:
|
|
|
|
```
|
|
install_extension https://github.com/github/awesome-copilot/tree/main/extensions/connector-namespaces
|
|
```
|
|
|
|
For a reproducible install, swap `main` for a reviewed commit SHA from this
|
|
repository.
|
|
|
|
The destination **scope** is chosen at install time:
|
|
|
|
- **user** (default) — installs globally for you at
|
|
`$COPILOT_HOME/extensions/connector-namespaces/`. The usual choice for a
|
|
personal tool.
|
|
- **project** — installs into the current repo.
|
|
- **session** — scoped to a single CLI session.
|
|
|
|
## Usage
|
|
|
|
1. Open the **MCP Connectors** canvas from Copilot CLI.
|
|
2. If prompted, choose **Sign in** and complete Microsoft Entra authentication
|
|
in the browser. The canvas reloads your subscriptions automatically. Pick an
|
|
Azure **subscription** and a **Connector Namespace**. The choice is saved for
|
|
future sessions (change it any time via **Change namespace**).
|
|
3. Browse or filter the connector catalog, then **Connect**. A browser tab
|
|
opens for Microsoft sign-in; complete it and the canvas updates on its own.
|
|
4. Connected connectors move into **My MCPs**. Use **Sandbox** on a tile to open
|
|
that server directly in the namespace MCP playground.
|
|
5. Restart the GitHub Copilot app so the agent can load the connected tools.
|
|
|
|
The extension registers the native `connector_namespaces_open_playground` tool,
|
|
so GitHub Copilot can open a named connector from **My MCPs** without installing
|
|
an additional Agent Skill.
|
|
|
|
## How it works
|
|
|
|
- `extension.mjs` — entry point; declares the canvas, `open_sandbox` action, and
|
|
native `connector_namespaces_open_playground` tool.
|
|
- `server.mjs` — a loopback HTTP server (bound to `127.0.0.1` only) that serves
|
|
the canvas UI and the JSON/authentication endpoints the iframe calls.
|
|
- `auth.mjs` — `InteractiveBrowserCredential` broker for sign-in lifecycle,
|
|
cancellation, encrypted token-cache persistence, and ARM token refresh.
|
|
- `armClient.mjs` — thin ARM client (public ARM base only, SSRF-guarded path
|
|
segments).
|
|
- `catalog.mjs` — fetches and curates the connector list for a namespace.
|
|
- `install.mjs` — the connect/install pipeline (managed-API connection, consent,
|
|
rollback on cancel, and native HTTPS MCP config registration).
|
|
- `renderer.mjs` — all canvas HTML/CSS/client JS.
|
|
- `sandbox.mjs` — builds namespace playground links and resolves named My MCPs.
|
|
- `state.mjs` — saved namespace and connector state.
|
|
|
|
## Privacy & security
|
|
|
|
- ARM tokens come from `@azure/identity`'s `InteractiveBrowserCredential` and
|
|
are never logged. Azure Identity stores its refreshable account cache through
|
|
the operating system's encrypted credential store. A non-secret account
|
|
locator is saved with user-only permissions so a new process can select that
|
|
cache entry; the extension never writes raw tokens to its artifact files.
|
|
- All servers bind to loopback (`127.0.0.1`) and are never exposed externally.
|
|
- ARM requests go only to `https://management.azure.com/`; path segments are
|
|
validated to prevent SSRF-style host smuggling.
|
|
- The minted gateway API key is stored in the selected Copilot MCP config and
|
|
sent to its validated HTTPS endpoint as the `X-API-Key` header.
|
|
|
|
## License
|
|
|
|
[MIT](./LICENSE) © Microsoft Corporation.
|