Skip to content

Updated

GitHub Copilot Cloud Agent

This guide uses LyraShield's integration registry for the cloud surface. It shows the current setup strategy and client source; actual client loading and authenticated runtime acceptance are tracked separately below.

Connection setup

The registry's setup path for this client is Guided manual setup over remote HTTP.

Client activation instructions

Skill installation is withheld because the published workflow set has not yet been reduced and validated for this read-only surface. Do not copy skills from the mutable preparation branch into `.github/skills/`. The intended read-only set is `get-started`, `review-changes` and `launch-readiness`; use direct MCP tools meanwhile. Do not enable the full marketplace plugin: it includes workflows and an OAuth MCP descriptor that this surface cannot use. Skill discovery is separate from MCP authentication. Allow only the read-only tools `lyrashield_check_diff`, `lyrashield_get_launch_readiness`, `lyrashield_list_targets` and `lyrashield_list_workspaces`. Configure the remote server separately in GitHub repository Settings → Code, planning and automation → Copilot → MCP servers with `type: "http"`, `url: "https://app.lyrashieldai.com/api/mcp" and `headers.Authorization: "Bearer $COPILOT_MCP_LYRASHIELD_API_KEY"`. Create a read-only LyraShield workspace API key and save it as an Agents secret named `COPILOT_MCP_LYRASHIELD_API_KEY` under Settings → Security → Secrets and variables → Agents. Omit `*` because GitHub lets Cloud Agent use configured tools autonomously. Do not install `scan-project`, `fix-and-retest` or the backward-compatible `lyrashield` skill on this read-only surface; requested recorded scans, fixes and retests require an OAuth-capable client. The optional recorded scan action in `review-changes` is not allowlisted. Copilot Cloud Agent does not support remote OAuth, and hosted mutations still return `connect_required`. This documentation-only entry has no authenticated Cloud Agent runtime receipt.

Install type: No verified native MCP configuration is available for this client.
Skill installation is withheld because the published workflow set has not yet been reduced and validated for this read-only surface. Do not copy skills from the mutable preparation branch into `.github/skills/`. The intended read-only set is `get-started`, `review-changes` and `launch-readiness`; use direct MCP tools meanwhile. Do not enable the full marketplace plugin: it includes workflows and an OAuth MCP descriptor that this surface cannot use. Skill discovery is separate from MCP authentication. Allow only the read-only tools `lyrashield_check_diff`, `lyrashield_get_launch_readiness`, `lyrashield_list_targets` and `lyrashield_list_workspaces`. Configure the remote server separately in GitHub repository Settings → Code, planning and automation → Copilot → MCP servers with `type: "http"`, `url: "https://app.lyrashieldai.com/api/mcp" and `headers.Authorization: "Bearer $COPILOT_MCP_LYRASHIELD_API_KEY"`. Create a read-only LyraShield workspace API key and save it as an Agents secret named `COPILOT_MCP_LYRASHIELD_API_KEY` under Settings → Security → Secrets and variables → Agents. Omit `*` because GitHub lets Cloud Agent use configured tools autonomously. Do not install `scan-project`, `fix-and-retest` or the backward-compatible `lyrashield` skill on this read-only surface; requested recorded scans, fixes and retests require an OAuth-capable client. The optional recorded scan action in `review-changes` is not allowlisted. Copilot Cloud Agent does not support remote OAuth, and hosted mutations still return `connect_required`. This documentation-only entry has no authenticated Cloud Agent runtime receipt.
Manual setup: the pinned CLI package (lyrashield@0.2.14) has no matching installer contract for this integration. Use the configuration or client instructions above and verify the client loads it.

Important gotchas

  • Cloud Agent and Copilot code review share repository MCP settings; configured MCP tools are used autonomously, so allowlist read-only tools and review the target repository before enabling them.
  • The planned read-only skill set, withheld until a surface-safe bundle is validated, is `get-started`, `review-changes` and `launch-readiness`; the tool allowlist includes only read-only calls. Recorded scans, fixes and retests require an OAuth-capable client.
  • GitHub documents `$COPILOT_MCP_...` substitutions for remote headers and requires those values to come from Agents secrets or variables. The key authenticates read-only calls; it cannot grant hosted mutations, which return `connect_required` without a connected OAuth delegation.
  • Remote MCP OAuth is not supported by Copilot Cloud Agent. Portable plugin and skills discovery is separate from service authentication; a plugin install or skill discovery is not evidence that the LyraShield MCP server connected.
Hosted access: use OAuth when the client supports it. Hosted mutations require a browser-confirmed delegation and are checked against its workspace, scope and expiry. An API key alone does not authorize hosted mutations. See the Remote MCP guide.

Native components and distribution

Documented client capabilities: plugin, skills. These describe what the client can load; use the installer and distribution details below to see which LyraShield components are available for this surface.

Skill installation is withheld for this client surface while its workflow bundle is validated. Use the documented MCP setup above; do not copy skills from a preparation branch.

Distribution route: GitHub Copilot read-only MCP; surface-safe workflow skills pending validation; registry state PREPARATION. Client distribution documentation.

Support evidence

Registry tier: COMPATIBLE. Evidence: DOCUMENTATION, checked 2026-10-01. Client version: not recorded; tested platforms: not recorded. No client runtime receipt is recorded.Marketplace state and runtime compatibility are separate claims.

Source: GitHub Copilot Cloud Agent official documentation.