What problem does it solve? Configuring MCP servers for GitHub Copilot in VS Code involves security-sensitive decisions about trust, secrets, transports, and tool scope, and mistakes can leak credentials or grant unintended write authority. This Skill provides a structured workflow for designing, reviewing, and debugging .vscode/mcp.json configurations safely. ## Core Features & Use Cases - Secure Configuration Authoring: Guides creation of .vscode/mcp.json with servers under servers and secret prompts under inputs, keeping tokens out of source control. - Trust and Provenance Review: Verifies server publisher, source, version, executable or URL, license, and authentication method before configuration. - Least-Privilege Scoping: Applies minimal filesystem and network access, sandboxing, and read-only tool preferences. - Use Case: A developer needs to connect Copilot to a remote read-only MCP server. The Skill walks them through verifying the server, writing the JSON configuration without embedded secrets, validating it offline, and performing an approved smoke test. ## Quick Start Ask the assistant to create a secure .vscode/mcp.json configuration for a read-only remote MCP server without embedding any secrets.
