Skip to content

Commit 1913091

Browse files
alexyaangyangalex1Copilot
authored
Add Azure Connector Namespaces canvas extension 🤖🤖🤖 (#2250)
* Add MCP Connectors (connector-namespaces) canvas extension A Copilot CLI canvas extension for browsing and adding MCP connectors from an Azure Connector Namespace into a Copilot session. Sign-in is dependency-free (OAuth 2.0 auth-code + PKCE via the Azure CLI public client, loopback redirect); network access is restricted to the public Azure Resource Manager endpoint. MIT licensed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update Connector Namespaces canvas extension Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Harden Connector Namespaces canvas extension Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Sanitize connector icon brand colors Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Connector Namespace playground actions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Replace sandbox skill with native tool Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Clarify connector disconnect action Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Color disconnect action red Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Add connector extension plugin manifest Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Address connector canvas review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Remove legacy connector canvas manifest Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Address remaining connector review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Harden connector review fixes Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Harden connector convergence Address the latest connector review batch across config persistence, executable trust, reauthentication, JSON-RPC transport, smoke safety, and accessibility. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Use native HTTP connector configs Persist Connector Namespace MCP servers as direct HTTPS entries with API-key headers, remove the stdio unwrap proxy, and exercise the native Streamable HTTP path in smoke coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf * Secure persisted connector state Create the Connector Namespace artifacts directory and saved gateway config with private permissions, and align the reduced-motion regression notes with the static fallback behavior. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a986299f-86be-46c3-9562-cbf7d25174cf --------- Co-authored-by: Alex Yang <yangalex@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent e4a1f57 commit 1913091

35 files changed

Lines changed: 7658 additions & 0 deletions

‎extensions/connector-namespaces/.github/plugin/plugin.json‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
{
2+
"name": "connector-namespaces",
3+
"description": "Browse, connect, and open MCP connectors from an Azure Connector Namespace.",
4+
"version": "1.1.0",
5+
"author": {
6+
"name": "Alex Yang",
7+
"url": "https://github.com/alexyaang"
8+
},
9+
"keywords": [
10+
"azure",
11+
"connector-namespace",
12+
"mcp",
13+
"mcp-connectors",
14+
"model-context-protocol",
15+
"tool-discovery"
16+
],
17+
"logo": "assets/preview.png",
18+
"extensions": "."
19+
}

‎extensions/connector-namespaces/LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) Microsoft Corporation.
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎extensions/connector-namespaces/README.md‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
# MCP Connectors — Copilot CLI Canvas Extension
2+
3+
A GitHub Copilot CLI **canvas extension** that lets you browse and add MCP
4+
connectors from an Azure **Connector Namespace** directly inside a Copilot CLI
5+
session. Search by name or category, sign in to a connector, then restart the
6+
session to make its tools available to the agent.
7+
8+
> The canvas talks to public Azure Resource Manager (`management.azure.com`)
9+
> using the signed-in Azure CLI account. The extension does not register its own
10+
> Entra application or persist Azure credentials.
11+
12+
## Prerequisites
13+
14+
- **GitHub Copilot CLI** (the host that loads canvas extensions).
15+
- **Azure CLI**, signed in with `az login`. The extension asks Azure CLI for a
16+
short-lived ARM access token and refreshes it through the same broker.
17+
- **An Azure subscription with a Connector Namespace** — resource type
18+
`Microsoft.Web/connectorGateways` (API version `2026-05-01-preview`). This is
19+
a preview resource provider; you must have access to it for the catalog to
20+
load. Without it the extension installs fine but has nothing to show.
21+
22+
## Install
23+
24+
Install it from the public Awesome Copilot repository:
25+
26+
```
27+
install_extension https://github.com/github/awesome-copilot/tree/main/extensions/connector-namespaces
28+
```
29+
30+
For a reproducible install, swap `main` for a reviewed commit SHA from this
31+
repository.
32+
33+
The destination **scope** is chosen at install time:
34+
35+
- **user** (default) — installs globally for you at
36+
`$COPILOT_HOME/extensions/connector-namespaces/`. The usual choice for a
37+
personal tool.
38+
- **project** — installs into the current repo.
39+
- **session** — scoped to a single CLI session.
40+
41+
## Usage
42+
43+
1. Open the **MCP Connectors** canvas from Copilot CLI.
44+
2. The canvas loads subscriptions from your signed-in Azure CLI account. Pick an
45+
Azure **subscription** and a **Connector Namespace**. The choice is saved for
46+
future sessions (change it any time via **Change namespace**).
47+
3. Browse or filter the connector catalog, then **Connect**. A browser tab
48+
opens for Microsoft sign-in; complete it and the canvas updates on its own.
49+
4. Connected connectors move into **My MCPs**. Use **Sandbox** on a tile to open
50+
that server directly in the namespace MCP playground.
51+
5. Restart the Copilot CLI session so the agent can load the connected tools.
52+
53+
The extension registers the native `connector_namespaces_open_playground` tool,
54+
so GitHub Copilot can open a named connector from **My MCPs** without installing
55+
an additional Agent Skill.
56+
57+
## How it works
58+
59+
- `extension.mjs` — entry point; declares the canvas, `open_sandbox` action, and
60+
native `connector_namespaces_open_playground` tool.
61+
- `server.mjs` — a loopback HTTP server (bound to `127.0.0.1` only) that serves
62+
the canvas UI and the JSON/OAuth endpoints the iframe calls.
63+
- `armClient.mjs` — thin ARM client (token brokered by Azure CLI, public ARM
64+
base only, SSRF-guarded path segments).
65+
- `catalog.mjs` — fetches and curates the connector list for a namespace.
66+
- `install.mjs` — the connect/install pipeline (managed-API connection, consent,
67+
rollback on cancel, and native HTTPS MCP config registration).
68+
- `renderer.mjs` — all canvas HTML/CSS/client JS.
69+
- `sandbox.mjs` — builds namespace playground links and resolves named My MCPs.
70+
- `state.mjs` — saved namespace and connector state.
71+
72+
## Privacy & security
73+
74+
- ARM tokens come from `az account get-access-token`, stay in process memory,
75+
and are never logged or written by the extension. Azure CLI owns sign-in and
76+
credential storage.
77+
- All servers bind to loopback (`127.0.0.1`) and are never exposed externally.
78+
- ARM requests go only to `https://management.azure.com/`; path segments are
79+
validated to prevent SSRF-style host smuggling.
80+
- The minted gateway API key is stored in the selected Copilot MCP config and
81+
sent to its validated HTTPS endpoint as the `X-API-Key` header.
82+
83+
## License
84+
85+
[MIT](./LICENSE) © Microsoft Corporation.

0 commit comments

Comments
 (0)