VS Code and GitHub Copilot

Add the server to Copilot agent mode with .vscode/mcp.json and a password input, so the committed file never contains the key.

VS Code runs MCP servers for GitHub Copilot in agent mode. Its inputs mechanism prompts once for a secret and stores it, so the config file holds only a reference.

Workspace config with an input

.vscode/mcp.json:

{
  "inputs": [
    {
      "id": "vulnetix-key",
      "type": "promptString",
      "description": "Vulnetix API key as orgId:hex",
      "password": true
    }
  ],
  "servers": {
    "vulnetix": {
      "type": "http",
      "url": "https://mcp.vulnetix.com/mcp",
      "headers": {
        "Authorization": "ApiKey ${input:vulnetix-key}"
      }
    }
  }
}

VS Code asks for the value on first start. Enter <orgId>:<hex> without the ApiKey prefix, which is already in the header. The file is safe to commit; each teammate is asked for their own key.

User config

Command palette, MCP: Open User Configuration, then add the same inputs and servers blocks. The server is then available in every workspace.

Check it

Open Chat and set the mode to Agent.
Open the tools picker; vulnetix should be listed with its tools.
Command palette, MCP: List Servers, shows state and Show Output for logs. MCP: Restart Server applies config edits.

Is CVE-2021-44228 in CISA KEV, and what was the remediation deadline?

Prompts

Prompts appear as slash commands in chat, /mcp.vulnetix.<prompt>:

/mcp.vulnetix.vulnetix_repo_impact

VS Code asks for the prompt’s arguments value when the prompt declares one.

VS Code with Copilot is on the MCP Apps client matrix, so the KEV board, triage queue and CVE card may render inline. See Apps.

Troubleshooting

Symptom	Fix
Server not listed	Use `servers` and `"type": "http"`
Asked for the key every session	The workspace is not trusted, so the input is not stored
Tools present, never called	Agent mode; check the tools picker has Vulnetix enabled
401	The input must be `<orgId>:<hex>`