This repository must never contain:
- Microsoft access or refresh tokens;
- browser cookies, authorization codes, or callback URLs;
- complete Power Apps Studio coauthoring links;
- tenant-specific environment IDs or app IDs;
- exported business data or production
.pa.yamlsource.
The plugin starts Microsoft's MCP server without tenant values. App identifiers are passed directly to the connect tool only when a user supplies a Studio URL in their trusted Codex session.
Open a GitHub security advisory for vulnerabilities in this plugin. Do not include working credentials, private coauthoring links, customer data, or production app source in a report.
Issues in Microsoft.PowerApps.CanvasAuthoring.McpServer itself should also be reported through Microsoft's Power Platform support or the relevant Microsoft repository.