Pass MCP configuration inline via --additional-mcp-config flag using environment variable by Copilot · Pull Request #14810 · github/gh-aw

Copilot · 2026-02-10T15:50:54Z

Copilot CLI now receives MCP configuration via --additional-mcp-config flag instead of reading from ~/.copilot/mcp-config.json. All configuration remains in memory with no file writes.

Changes

Shell Scripts

convert_gateway_config_copilot.sh: Output compact JSON to stdout (jq -c) instead of writing to file
start_mcp_gateway.sh: Store converted JSON in GH_AW_COPILOT_MCP_CONFIG environment variable and output to GitHub Actions step output using multiline string syntax

Go Code

copilot_engine_execution.go: Set GH_AW_COPILOT_MCP_CONFIG environment variable from step output and pass to copilot via --additional-mcp-config "$(printf %q "$GH_AW_COPILOT_MCP_CONFIG")" with proper quote escaping
Remove GH_AW_MCP_CONFIG environment variable (no longer needed)

Tests

playwright_allowed_domains_secrets_test.go: Update to check MCP gateway input instead of file writes

Compiled Output

Before:

env:
GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.jsonrun: | mkdir -p /home/runner/.copilot cat > /home/runner/.copilot/mcp-config.json << EOF {"mcpServers": {...}} EOF copilot --prompt "..." ...

After:

run: | copilot --additional-mcp-config "$(printf %q "$GH_AW_COPILOT_MCP_CONFIG")" --prompt "..." ...env:
GH_AW_COPILOT_MCP_CONFIG: ${{ steps.start-mcp-gateway.outputs.copilot-mcp-config }}

Security & Encoding Safety

JSON is compacted via jq -c and stored in environment variable
Step output passed to environment variable prevents template injection vulnerabilities
printf %q properly escapes JSON containing both single quotes (') and double quotes (")
No file writes - configuration is truly in-memory only
No string interpolation or user input in the pipeline

Impact: Copilot engine only. Claude/Codex/Custom engines unchanged.

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Changeset

Type: patch
Description: Pass Copilot's MCP gateway configuration via --additional-mcp-config so the setup stays in memory instead of writing mcp-config.json.

Generated by Changeset Generator

- Modified convert_gateway_config_copilot.sh to output JSON to stdout instead of writing to file - Updated start_mcp_gateway.sh to save converted config to /tmp/gh-aw/mcp-config/copilot-mcp-config.json - Added --additional-mcp-config flag to copilot CLI invocation with inline JSON from file - Removed GH_AW_MCP_CONFIG environment variable as config is now passed inline - Config is no longer written to ~/.copilot/mcp-config.json Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

- Updated playwright_allowed_domains_secrets_test.go to check MCP gateway input instead of mcp-config.json - Recompiled all 148 workflows successfully - All Copilot workflows now use --additional-mcp-config flag instead of writing to ~/.copilot/mcp-config.json - Verified no Copilot workflows have GH_AW_MCP_CONFIG environment variable anymore - All unit tests passing Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

@pelikhan

Per @pelikhan's feedback, the MCP configuration is now stored as an environment variable instead of writing to a file, making it truly in-memory only. Changes: - start_mcp_gateway.sh: Store JSON in GH_AW_COPILOT_MCP_CONFIG env var and output to step - copilot_engine_execution.go: Use env var GH_AW_COPILOT_MCP_CONFIG from step output - Eliminates intermediate file /tmp/gh-aw/mcp-config/copilot-mcp-config.json - Uses GitHub Actions multiline string syntax for step output - Passes config via env var to prevent template injection Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-02-10T16:39:15Z

+	if hasMCPServers {
+ // The JSON is passed via GH_AW_COPILOT_MCP_CONFIG environment variable
+ // which is set from the step output to prevent template injection
+ copilotArgs = append(copilotArgs, "--additional-mcp-config", "\"$GH_AW_COPILOT_MCP_CONFIG\"")


@copilot you need to add the argument in a way that handles the case where the JSON payload contains quotes " and single quotes '

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-02-10T18:00:19Z

@copilot keep working

The JSON payload in GH_AW_COPILOT_MCP_CONFIG can contain both single and double quotes. Using printf %q ensures the JSON is properly quoted for shell reuse, handling all special characters including quotes. Changes: - Add --additional-mcp-config after base command is built - Use printf %q "$GH_AW_COPILOT_MCP_CONFIG" for safe shell quoting - Works correctly when wrapped in AWF's single quotes via shellEscapeArg - All 148 workflows recompiled with proper quote handling Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-02-10T18:07:18Z

@copilot keep working

Completed in 5e863bc. The --additional-mcp-config flag now uses printf %q to properly escape JSON with quotes:

--additional-mcp-config "$(printf %q "$GH_AW_COPILOT_MCP_CONFIG")"

This handles both single quotes (') and double quotes (") in the JSON payload correctly. The printf %q shell builtin quotes strings in a format that can be safely reused as shell input, properly escaping all special characters.

github-actions · 2026-02-10T18:11:35Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-02-10T18:11:36Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-10T18:11:37Z

🧪 Smoke Project is now testing project operations...

github-actions · 2026-02-10T18:11:40Z

🎬 THE END — Smoke ClaudeMISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-10T18:11:41Z

✅ Changeset Generator completed successfully!

github-actions · 2026-02-10T18:12:51Z

❌ Smoke Project encountered failures. Check the logs for details.

github-actions · 2026-02-10T18:14:25Z

📰 DEVELOPING STORY: Smoke Copilot reports failed. Our correspondents are investigating the incident...

github-actions · 2026-02-10T18:16:04Z

Smoke test (Codex)
Merged PRs: #14817 [docs] Remove bloat from errors.md documentation; #14802 Add disable-agentic-editing frontmatter field to Astro docs
GitHub MCP: ✅
Serena (activate + find_symbol>=3): ✅
Playwright title contains GitHub: ✅
File write + cat: ✅
Build (make build): ✅
Overall: PASS

AI generated by Smoke Codex

Initial plan
8a1c25d

CopilotAI assigned Copilot and pelikhan Feb 10, 2026

Copilotstarted work on behalf of pelikhan February 10, 2026 15:51 View session

CopilotAIand others added 2 commits February 10, 2026 15:59

CopilotAI changed the title ~~[WIP] Add additional MCP config support for copilot CLI~~Pass MCP configuration inline via --additional-mcp-config flagFeb 10, 2026

CopilotAI requested a review from pelikhan February 10, 2026 16:09

Copilotfinished work on behalf of pelikhan February 10, 2026 16:09

pelikhan reviewed Feb 10, 2026
View reviewed changes

Comment threadactions/setup/sh/start_mcp_gateway.sh Outdated

Copilotstarted work on behalf of pelikhan February 10, 2026 16:16 View session

CopilotAI changed the title ~~Pass MCP configuration inline via --additional-mcp-config flag~~Pass MCP configuration inline via --additional-mcp-config flag using environment variableFeb 10, 2026

CopilotAI requested a review from pelikhan February 10, 2026 16:25

Copilotfinished work on behalf of pelikhan February 10, 2026 16:25

pelikhan reviewed Feb 10, 2026
View reviewed changes

Copilotstarted work on behalf of pelikhan February 10, 2026 16:40 View session

Changes before error encountered
236d9ef
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

CopilotAI requested a review from pelikhan February 10, 2026 17:17

Copilotstarted work on behalf of pelikhan February 10, 2026 18:01 View session

Copilotfinished work on behalf of pelikhan February 10, 2026 18:08

pelikhan added the smoke label Feb 10, 2026

Add changeset [skip-ci]
c1adf6c

github-actionsBot added smoke-codex and removed smoke labels Feb 10, 2026

github-actionsBot mentioned this pull request Feb 10, 2026
Smoke Test: Claude - 21876859538 #14821
Closed

pelikhan closed this Feb 10, 2026

github-actionsBot deleted the copilot/add-additional-mcp-config branch April 2, 2026 11:38

Navigation Menu

Uh oh!

Pass MCP configuration inline via --additional-mcp-config flag using environment variable - #14810

Pass MCP configuration inline via --additional-mcp-config flag using environment variable#14810
pelikhan with Copilot wants to merge 7 commits into
mainfrom
copilot/add-additional-mcp-config

CopilotAI commented Feb 10, 2026•
edited by github-actions Bot
Loading

Uh oh!

Uh oh!

pelikhanFeb 10, 2026

Uh oh!

pelikhan commented Feb 10, 2026

Uh oh!

CopilotAI commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026•
edited
Loading

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026•
edited
Loading

Uh oh!

github-actionsBot commented Feb 10, 2026•
edited
Loading

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

CopilotAI commented Feb 10, 2026• edited by github-actions BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Compiled Output

Security & Encoding Safety

Changeset

Uh oh!

Uh oh!

pelikhanFeb 10, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Feb 10, 2026

Uh oh!

CopilotAI commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Feb 10, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

github-actionsBot commented Feb 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

CopilotAI commented Feb 10, 2026•
edited by github-actions Bot
Loading

github-actionsBot commented Feb 10, 2026•
edited
Loading

github-actionsBot commented Feb 10, 2026•
edited
Loading

github-actionsBot commented Feb 10, 2026•
edited
Loading