GitHub Copilot MCP Security Workflow Setup Guide

Connect GitHub Copilot CLI to LyraShield through the pinned MCP adapter. Authenticate with CLI OAuth, merge the configuration, confirm discovery and make a read-only workspace call. Agent Plugin 0.1.31 is published; its public listing and authenticated Copilot CLI acceptance remain pending. Copilot CLI has no documented LyraShield skills installation path, so use direct MCP. Follow the Copilot integration guide for setup and the vibe coding security guide for review context.

1. Authenticate local stdio

Use Node.js 24 or newer and run npx -y lyrashield@0.2.14 login --oauth in the same OS account that starts Copilot CLI. Select one authorized workspace in the browser. The local adapter reads the CLI credential store, so no credential belongs in committed MCP configuration. A teammate must complete their own login and workspace selection; sharing the project entry does not share authentication. Keep the credentials file private, and repeat consent when access expires or is revoked.

The Node.js downloads page describes the runtime. A missing Node executable and a denied workspace read are different failures: first confirm the client can start npx, then inspect the authenticated service response. Use npx -y lyrashield@0.2.14 doctor to inspect local setup, while keeping client discovery and an authenticated tool call as separate checks. Doctor cannot prove a skill was loaded, a scan was accepted or a hosted write is authorized.

2. Plugin release boundary

The marketplace default branch contains preparation artifacts. Do not register that branch or enable its plugin in shared repository settings. The Agent Plugin package 0.1.31 is published, but public listing and authenticated client runtime acceptance remain separate gates. The earlier CLI 0.2.13 release printed obsolete marketplace instructions; do not infer a supported plugin route from that older output. The pinned CLI provides a safe config writer for the Copilot CLI contract; preview it with npx -y lyrashield@0.2.14 install copilot-cli --dry-run before applying. Do not copy candidate plugin files from the preparation repository; plugin listing and authenticated runtime acceptance remain pending.

Copilot CLI, Copilot in VS Code and Copilot Cloud Agent are distinct surfaces. For VS Code, follow the VS Code MCP guide, which uses servers and a per-entry stdio type. The Copilot Cloud Agent guide uses a private read-only Agents secret and a narrow tool allowlist; it cannot authenticate through the portable plugin’s OAuth descriptor. Do not share a local credential store with that cloud environment or substitute an Actions secret for an Agents secret. Cloud Agent skills remain withheld until a dedicated read-only bundle passes tool-allowlist and runtime review.

3. Merge the pinned direct MCP configuration

The Copilot CLI configuration guide documents global ~/.copilot/mcp-config.json and project .mcp.json or .github/mcp.json scope. Preserve existing server definitions when adding this entry. For a personal setup, use the global file; project entries also require the client’s project trust checks. The stdio connection uses the coordinated pinned package version:

{
  "mcpServers": {
    "lyrashield": {
      "type": "local",
      "command": "npx",
      "args": ["-y", "@lyrashield/mcp@0.2.12"]
    }
  }
}

Do not add a raw key or token to this block. For a narrow initial read-only setup, select only the workspace, target, advisory diff and readiness tools your review needs. Recheck the allowlist when changing the server version instead of enabling every tool by default. The official Copilot MCP documentation explains server management and allowlists. The MCP transport documentation explains local process and remote transport boundaries. A local adapter still contacts the hosted LyraShield service; stdio does not mean scans or account data remain entirely on the machine.

4. Confirm discovery and authenticated access

Restart Copilot CLI, then enter /mcp show lyrashield in its interactive session. Inspect the server status and tools before asking for a service call. Next, ask Copilot to call lyrashield_list_workspaces and confirm the intended workspace, then list its authorized targets. A successful read proves that access at that moment, while an installed badge or listed server proves only discovery. Keep error and incomplete states visible rather than describing a failed check as a clean security result.

Request recorded scans explicitly for an authorized target and review the returned execution and evidence states. Advisory diff checks do not create a retained scan record. Findings require triage; they do not automatically prove exploitability or a retest-confirmed outcome. An authenticated read does not establish scan, write, revocation or upgrade acceptance. For the separate remote route, follow the canonical guide’s authentication contract. A hosted API key grants read access only and cannot replace a browser-confirmed OAuth delegation for scans, fix proposals or retests. CLI OAuth authenticates local stdio separately.

For a failed scan or interrupted request, keep the returned scan or operation identifier and inspect its recorded state before retrying. An unfinished request is not a successful review, and a repeated prompt must not silently create duplicate paid work.

5. Add the GitHub Action diff gate

Wire the workflow into CI so every pull request is scanned on the changed diff, not the whole repository. The LyraShield GitHub Action runs on pull request events, targets the changed files and emits SARIF output you can ingest. Approval gated fix proposals are proposals requiring review, so the action blocks only on new findings while a human approves any fix. The GitHub Actions security hardening guide describes the permissions and secret handling to apply. Run the action on every pull request so review cannot be skipped under deadline pressure and pin your action versions so an upstream change cannot alter your gate. Store any token the action needs as a GitHub Actions secret rather than in the workflow file and give the job the minimum permissions it needs, because a scanner job does not need write access to your repository contents. The action uploads the SARIF file to the GitHub security tab via the CodeQL upload action, so findings appear alongside existing code scanning alerts and each finding links back to the changed file in the pull request diff. Because the scan targets only the changed files in the diff range, the action runs fast even on large repositories where a full scan would timeout.

name: LyraShield Security Check
on:
  pull_request:
    types: [opened, synchronize, reopened]
permissions:
  contents: read
  pull-requests: write
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: ecryptoguru/lyrashield-ai@v2
        with:
          fail_on_severity: HIGH

6. Add an agent rules snippet

Review or extend .github/copilot-instructions.md manually, preserving existing guidance. Keep your project rules focused on how the team should use the workflow. A short snippet tells Copilot to run a check before completing a feature and to attach evidence to the pull request. Keep the snippet under ten lines so Copilot treats it as a standing rule and phrase each rule as an imperative so the agent treats it as non negotiable. If your team has a severity threshold, name it in the snippet.

Before finishing a feature, run a LyraShield security check and attach the findings link to the pull request. Never commit secrets. If a high severity issue is found, stop and ask for review.

Workflow step	Command or action	Purpose
Authenticate	npx -y lyrashield@0.2.14 login --oauth	Local credential store
Configure	Pinned MCP 0.2.12 manual merge	Preserve existing settings
Discover	/mcp show lyrashield	Inspect client-loaded tools
Verify read	lyrashield_list_workspaces	Confirm authorized workspace
CI gate	GitHub Action on diff	Advisory changed-file check

Why pair GitHub Copilot with LyraShield AI

LyraShield AI gives you release assurance for AI built apps through a target, review, evidence, fix, retest, report loop. For Copilot it contributes agentic pentest, software composition analysis and secrets scanning, then writes each finding with its scope and evidence in an assurance record; a retest-confirmed state requires a fresh applicable retest. Approval gated fix proposals are proposals requiring review, so a human stays in the loop before anything ships. The platform is live with open registration, so you can create an account and pair it with the AI app security checklist tool. For a review focused companion, see the Codex security workflow post.