Sourced*

Agents

Build a GitHub Copilot extension from an API

· 5 min read · Sourced

  • openapi
  • github-copilot
  • mcp
  • agents

A "Copilot extension from an API" means something different in September 2026 than it did a year ago. GitHub deprecated GitHub App-based Copilot Extensions on November 10, 2025, and now recommends building an MCP server instead — one server that works with Copilot, Claude Code, Cursor, and any other MCP-compatible client, rather than a Copilot-only integration. If your OpenAPI spec is the source of truth, the real path is: generate an MCP server, then wire it into Copilot at the repo, CLI, or editor level.

What happened to GitHub Copilot Extensions?

Per GitHub's changelog, GitHub blocked creation of new GitHub App-based Copilot Extensions starting September 24, 2025, and sunset existing ones on November 10, 2025 at 11:59 PM PST. GitHub's own framing: "Build your server once and it works with GitHub Copilot, Claude Code, and any other MCP-compatible host app" — explicitly naming MCP as the replacement, not a narrower Copilot-specific format. If a tutorial or template still points you at a GitHub App manifest and agent.json skillset for Copilot Chat, treat it as stale.

The current path: MCP servers

Copilot reads MCP servers in a few different places, per GitHub's docs:

  • Copilot coding agent (repo-level): a repository admin pastes an MCP configuration into Settings → Copilot → MCP servers. Once configured, the tools are available to the cloud coding agent on every assigned task, and Copilot calls them autonomously without an approval prompt per call.
  • Local development: Copilot's Agent Host (VS Code, Copilot CLI, the Copilot app) reads a workspace .mcp.json file or a user-level ~/.copilot/mcp-config.json, the same portable shape used elsewhere.

The repo-level JSON shape:

{
  "mcpServers": {
    "your-api": {
      "type": "http",
      "url": "https://mcp.your-api.example.com/mcp",
      "tools": ["*"]
    }
  }
}

For a local stdio server instead of a hosted one:

{
  "mcpServers": {
    "your-api": {
      "type": "local",
      "command": "node",
      "args": ["/absolute/path/to/dist/index.js"],
      "env": { "YOUR_API_API_KEY": "COPILOT_MCP_YOUR_API_API_KEY" },
      "tools": ["*"]
    }
  }
}

Two GitHub-specific details worth knowing before you configure this:

  • tools is required and must list tool names explicitly, or ["*"] to allow everything the server exposes. There's no implicit "allow all" without stating it.
  • Environment variable and header values may only reference repository/organization secrets or variables whose names are prefixed COPILOT_MCP_ — GitHub won't read arbitrary repo secrets into an MCP server's env, by design.

GitHub also shipped Agent Plugins 1.0 in VS Code, Copilot CLI, and the Copilot app in August 2026, per GitHub's changelog; plugins can bundle MCP server configuration alongside an allowlist that approves or blocks individual servers by URL, command, or name. That's a packaging layer on top of MCP, not a separate mechanism — the server your OpenAPI spec produces is still the thing being packaged.

Review checklist before enabling

The same review that matters for any OpenAPI-to-MCP output applies here, plus two Copilot-specific points:

  • Copilot's coding agent calls allowed tools without a per-call confirmation prompt — your safe-default tool set matters more here than in a host that always asks first.
  • COPILOT_MCP_-prefixed secrets are the only way credentials reach the server's env from repo/org settings; don't hardcode a token in the JSON you paste into repo settings.
  • Confirm destructive operations (delete, refund, publish, send) are excluded from the default tools list, or gated behind a separate reviewed config.
  • Check the server's tool descriptions are agent-readable, not just human-readable API docs — see the MCP security checklist for the full list.

Honest scope: when a plain API call beats a Copilot extension

If the goal is "let one developer query an internal API from inside their editor a few times a day," a documented curl snippet or a small VS Code task is faster to ship than standing up and hosting an MCP server. MCP earns its cost when Copilot's coding agent needs to call the API autonomously across many tasks, or when the same server needs to serve Copilot and Claude Code and Cursor without three separate integrations. If you're only ever going to use this from Copilot Chat interactively, GitHub's built-in tools plus a documented API reference may already cover it — don't build a tool surface nobody but you will call.

Copilot Extensions vs MCP servers today

GitHub App-based Copilot Extensions MCP servers (current)
Status, Sept 2026 Deprecated; sunset Nov 10, 2025 Current, GA path
Works with Copilot only Copilot, Claude Code, Cursor, any MCP host
Config surface GitHub App manifest + skillset Repo settings JSON, .mcp.json, or ~/.copilot/mcp-config.json
Generated from OpenAPI Manually mapped to skillset format Directly — operations map to MCP tools

Where Sourced fits

Sourced's OpenAPI-to-MCP generator and managed host turns your spec into a TypeScript MCP server with a safety report, default-enabled read-only tools, destructive-action tagging, and a remote HTTPS endpoint. Point Copilot at that endpoint, or download the package for local .mcp.json use. The same server works with Claude Code and Cursor without regeneration. If you also want hosted docs and typed SDKs from the same spec, create hosted docs from your repo or start free.

FAQ

Are GitHub Copilot Extensions still supported?

GitHub App-based Copilot Extensions are deprecated. GitHub blocked new ones starting September 24, 2025 and sunset existing ones on November 10, 2025. Build an MCP server instead — GitHub's own guidance points developers there.

How do I add an API to GitHub Copilot now?

Generate an MCP server from your OpenAPI spec, then configure it at the level you need: repo settings for Copilot's cloud coding agent, or a workspace .mcp.json / ~/.copilot/mcp-config.json for local Copilot CLI and editor use.

Does Copilot's coding agent ask for approval before calling a tool?

No — per GitHub's docs, once an MCP server is configured for a repository, the coding agent uses its tools autonomously during assigned tasks without an approval prompt per call. Review your default tool list accordingly before enabling it.

Can one MCP server work for both Copilot and Claude Code?

Yes. MCP is a shared protocol; the same server process can serve Copilot, Claude Code, Cursor, or any other MCP-compatible client. That's the explicit reason GitHub gave for deprecating the Copilot-only extension format.

What are Agent Plugins in Copilot?

A packaging layer GitHub shipped in August 2026 for VS Code, Copilot CLI, and the Copilot app. Plugins can bundle MCP server configuration with an allowlist that approves or blocks specific servers by URL, command, or name — it wraps MCP rather than replacing it.

Do I need a GitHub App to expose my API to Copilot?

No, not anymore for this use case. GitHub Apps are still valid for other GitHub platform integrations, but the Copilot-specific extension path built on GitHub Apps is the deprecated one. MCP server configuration doesn't require a GitHub App.