# GitHub Copilot MCP: connect MCP servers in VS Code and the coding agent

Copilot speaks MCP in two places: **agent mode in VS Code**, configured with a `mcp.json` file, and the **Copilot coding agent** on github.com, configured in repository settings. Same protocol, different config — this page covers both. Check whether the tool you want even has a server first: 212 of 234 brands have official ones ([full index](https://mcpyet.com/browse.md)).

## VS Code — where the config lives

| Location | Scope | Good for |
| --- | --- | --- |
| `.vscode/mcp.json` | This workspace | Repo-specific tools; commit it to share with the team |
| **MCP: Open User Configuration** | All workspaces | Personal servers, per VS Code profile |

The guided route is the **MCP: Add Server** command; **MCP: List Servers** shows what's connected. Or write the file directly — note the key is `servers`, not the `mcpServers` every other client uses:

```json
{
  "servers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp"
    },
    "example": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@vendor/mcp-server"]
    }
  }
}
```

Remote servers (`type: "http"`, or `"sse"` for older ones) trigger the vendor's OAuth sign-in when needed. Ready to paste right now: [fal.ai](https://mcpyet.com/mcp/fal-ai.md), [Atlassian](https://mcpyet.com/mcp/atlassian.md), [Datadog](https://mcpyet.com/mcp/datadog.md), [Buffer](https://mcpyet.com/mcp/buffer.md), [Google Drive](https://mcpyet.com/mcp/google-drive.md), [Confluence](https://mcpyet.com/mcp/confluence.md).

For secrets, use an input variable instead of hardcoding the key — the file stays committable:

```json
{
  "inputs": [
    {
      "type": "promptString",
      "id": "vendor-key",
      "description": "Vendor API key",
      "password": true
    }
  ],
  "servers": {
    "example": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@vendor/mcp-server"],
      "env": { "VENDOR_API_KEY": "${input:vendor-key}" }
    }
  }
}
```

Then open the Chat view, switch to **Agent** mode, and pick the server's tools from the tools icon. Copilot asks before running a tool unless you allow it for the session.

## The Copilot coding agent — github.com

The autonomous agent that works on issues gets its MCP servers from repository settings, not from your editor: **Settings → Copilot → Coding agent**, in the MCP configuration section. The GitHub MCP server and Playwright are enabled by default; anything else is JSON with a required `tools` allowlist:

```json
{
  "mcpServers": {
    "example": {
      "type": "http",
      "url": "https://mcp.example.com/mcp",
      "headers": { "Authorization": "Bearer $COPILOT_MCP_EXAMPLE_TOKEN" },
      "tools": ["search", "read_item"]
    }
  }
}
```

Secrets must be created as Copilot environment secrets with names prefixed `COPILOT_MCP_` before the config can reference them. Local (`type: "local"`) servers run with a `command` inside the agent's ephemeral environment. The explicit `tools` list is a real security boundary — the agent works unattended, so give it the narrowest set that does the job.

## When it doesn't work

| Symptom | Usual cause | Fix |
| --- | --- | --- |
| Server never appears | Wrong top-level key | VS Code wants `servers` — `mcpServers` configs from other clients need renaming |
| Tools missing in chat | Not in agent mode | Switch the mode picker to **Agent**; check the tools icon |
| Server fails to start | `npx` not on VS Code's PATH | Use the absolute path from `which npx`, then **MCP: List Servers** → start to see logs |
| MCP options greyed out | Organization policy | MCP access is controlled by GitHub policies — ask your admin |
| Coding agent ignores a server | Empty or wrong `tools` list | The allowlist is required — name each tool or use `"*"` deliberately |

## A word on trust

Copilot's approval prompts exist because MCP tools act with real credentials — and the coding agent acts unattended. Prefer official servers (<https://mcpyet.com/browse/official/>), scope every token, and keep coding-agent tool allowlists narrow. More in the [MCP security guide](https://mcpyet.com/guides/mcp-security.md).

## Questions

**Where does VS Code look for MCP servers?**
Two places: .vscode/mcp.json in the workspace (commit it to share with the team) and a user-level configuration that applies across workspaces, opened with the MCP: Open User Configuration command. Dev containers can add servers via customizations.vscode.mcp in devcontainer.json.

**Do MCP tools work in all Copilot chat modes?**
MCP tools run in agent mode. Open the Chat view, switch the mode picker to Agent, and the tools icon lists every connected server's tools — you can toggle individual tools per session.

**What is the GitHub MCP server URL?**
https://api.githubcopilot.com/mcp — GitHub's own remote server. Add it as a type "http" server and VS Code handles the OAuth sign-in. It gives Copilot tools for repos, issues and pull requests.

**How do I keep API keys out of .vscode/mcp.json?**
Declare an input variable in the file's inputs array and reference it as ${input:id} in the server's env block. VS Code prompts once, stores the value securely, and the file stays safe to commit.

**Can my organization restrict MCP in Copilot?**
Yes — organizations and enterprises control MCP access through GitHub policies, and repository admins control what the coding agent can reach. If MCP options are missing in VS Code, that's usually the policy, not your config.

Related guides: [Cursor](https://mcpyet.com/connect/cursor.md) · [Windsurf](https://mcpyet.com/connect/windsurf.md) · [GitHub MCP server](https://mcpyet.com/mcp/github.md)

---

Source: https://mcpyet.com/connect/github-copilot/ — data refreshed 2026-08-11