fix(copilot): measure documented MCP surfaces - #116
Merged
Conversation
Signed-off-by: Imran Siddique <imran.siddique@opaque.co>
imran-siddique
added a commit
that referenced
this pull request
Aug 15, 2026
#116 removed `copilot/mcp-config.json`, which nothing reads, and left `.vscode/mcp.json` as the only measured path. That is correct as far as it goes, but it is not the whole surface: Copilot CLI reads two repository files of its own, and dev containers carry MCP servers in a third place. Verified against vendor documentation and now measured: .mcp.json Copilot CLI, per checkout, takes precedence .github/mcp.json Copilot CLI, committed and shared .devcontainer/devcontainer.json customizations.vscode.mcp .devcontainer.json and .devcontainer/*/devcontainer.json Dev container files are digested whole rather than parsed for that one key. devcontainer.json is JSONC, and a parser that mishandles a comment reports "nothing changed" about a file it failed to read. The cost is that unrelated devcontainer edits report as MCP changes, which a reviewer settles from the diff. MEASUREMENT_SCOPE moves to 2. Removing a path that never matched needed no bump, but adding four does: a baseline written before them cannot tell a file that was always present from one this run started measuring, and without the bump it would report a server someone just added. The scope_change call also carried a reason copied from the claude-code engine, describing skill digests this engine does not measure; it now describes this widening. The README claimed Copilot CLI reads only the user-level config. Corrected, and the two surfaces that genuinely cannot be reached from inside a repository are now stated rather than implied: the home directory config, and the coding agent's MCP configuration, which lives in repository settings on github.com. Closes #75
imran-siddique
added a commit
that referenced
this pull request
Aug 15, 2026
#116 removed `copilot/mcp-config.json`, which nothing reads, and left `.vscode/mcp.json` as the only measured path. That is correct as far as it goes, but it is not the whole surface: Copilot CLI reads two repository files of its own, and dev containers carry MCP servers in a third place. Verified against vendor documentation and now measured: .mcp.json Copilot CLI, per checkout, takes precedence .github/mcp.json Copilot CLI, committed and shared .devcontainer/devcontainer.json customizations.vscode.mcp .devcontainer.json and .devcontainer/*/devcontainer.json Dev container files are digested whole rather than parsed for that one key. devcontainer.json is JSONC, and a parser that mishandles a comment reports "nothing changed" about a file it failed to read. The cost is that unrelated devcontainer edits report as MCP changes, which a reviewer settles from the diff. MEASUREMENT_SCOPE moves to 2. Removing a path that never matched needed no bump, but adding four does: a baseline written before them cannot tell a file that was always present from one this run started measuring, and without the bump it would report a server someone just added. The scope_change call also carried a reason copied from the claude-code engine, describing skill digests this engine does not measure; it now describes this widening. The README claimed Copilot CLI reads only the user-level config. Corrected, and the two surfaces that genuinely cannot be reached from inside a repository are now stated rather than implied: the home directory config, and the coding agent's MCP configuration, which lives in repository settings on github.com. Closes #75
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
copilot/mcp-config.json.vscode/mcp.jsonas the documented VS Code workspace MCP surface.github/agents/**/*.agent.md, including custom-agentmcp-serversconfigurationRoot cause
The original MCP paths came from search results rather than GitHub's product documentation and conflated three different Copilot runtimes. Copilot cloud-agent repository MCP is stored in GitHub settings, while Copilot CLI's
mcp-config.jsonis user-level at~/.copilot/.Security impact
This removes a silently empty category and adds coverage for repository custom-agent profiles, where prompts, tools, and MCP servers can change agent behavior. It does not claim visibility into GitHub repository settings or user-level CLI configuration that is outside the checkout.
Validation
nox -s capture_engines— 141 passedgit diff --checkOfficial references:
Closes #75