agentHost: add MCP connector discovery

[Paul (pwang347)]

Summary

• add a shared Agent Host service that fetches the product-configured Copilot Connectors /plugins/connected catalog with the existing GitHub OAuth credential
• revalidate JSON responses with opaque ETags, apply cache metadata from 304 responses, honor Cache-Control: no-store, accept only HTTPS MCP endpoints, and invalidate safely on token changes
• merge connected connector MCP servers into Copilot, Claude, and Codex while preserving user, workspace, and plugin configuration precedence and revalidating stale catalogs in the background at most once per minute
• use the common Agent Host bootstrap so local and remote/server hosts share the same implementation without new AHP token plumbing

Scope

This draft consumes already-connected connector MCP servers. It does not yet add the catalog/consent UI, PUT/DELETE connection lifecycle, exact-resource OAuth, vendor recovery handling for JSON-RPC codes 1001-1007, or full plugin tarball components.

GHES discovery is intentionally disabled for the current dotcom preview endpoint so an enterprise token is never sent to api.github.com.

Issue association: pending; no unambiguous VS Code tracker was found.

Follow-ups before OAuth scope enforcement

Connector requests will require write:plugin_gateway_connections for managing connections and making MCP calls, or read:plugin_gateway_connections for read-only access. Existing GitHub OAuth sessions cannot gain either scope without user reauthorization.

GitHub OAuth scope bundles are intentionally aligned across VS Code and integrated extensions so multiple experiences can reuse one authentication session. Because the GitHub authentication provider identifies sessions by their requested scope set, independently adding a connector scope could instead create a parallel session and cause different experiences to request authorization separately.

Before scope enforcement, choose and coordinate one authentication model across affected clients:

• Additive connector session: request a connector-capable session only when a user enables or uses connectors. This limits the additional permission and avoids reauthorizing users who do not use connectors, but the extra session, token lifecycle, account selection, and authorization step become intentional product behavior.
• Shared scope bundle: add the connector scope to the canonical GitHub scope bundle used by all participating clients. This preserves a single shared session after migration, but requires a coordinated rollout and reauthorization of existing users, including potentially users who do not use connectors.

No individual client should independently change its default GitHub scope bundle without accounting for the other consumers of that shared session.

The following UX and recovery requirements apply under either model:

• show a nonblocking Update Authorization action in the connector management surface, including the account and GitHub host whose authorization will be updated
• also surface Update Authorization inline when a connector tool call reports insufficient scope, so users do not have to discover the management surface first
• reuse VS Code's existing GitHub authentication provider and setup flow rather than implementing a connector-specific browser or device-code flow
• ensure reauthorization targets the intended existing account; cancellation must leave the current authorization intact
• after authorization succeeds, forward the connector-capable token, refresh the connector catalog and authorization state, update already-running connector sessions, and retry the blocked operation where possible
• distinguish insufficient-scope responses from ordinary catalog failures so enforcement results in an actionable prompt rather than connectors silently disappearing
• add enforcement-mode coverage once the service's insufficient-scope response and challenge contract is finalized; the current live smoke test runs while scope checks are not enforced

Manual Work IQ Mail smoke test

Prerequisites: use an account with Copilot Connectors preview access and an Outlook mailbox that can consent to Work IQ Mail.

1. Confirm the connector catalog is available:

   PREFIX="copilot-connectors/api/v1"
   CONNECTOR="a365outlookmailmcp"
   
   gh api "$PREFIX/plugins" \
     --jq ".plugins[] | select(.name == \"$CONNECTOR\") | {name, status: .connection.status}"

2. If its status is not connected, start the idempotent consent flow and finish it in the browser:

   consent_link=$(gh api -X PUT "$PREFIX/connectors/managed/$CONNECTOR/connection" \
     -f client_source=VS_CODE \
     --jq '.consent_link // empty')
   test -n "$consent_link" && open "$consent_link"

3. Verify that the callback completed and the canonical connected-plugin endpoint advertises the MCP server:

   gh api "$PREFIX/plugins/connected" \
     --jq ".plugins[] | select(.name == \"$CONNECTOR\") | {name, status: .connection.status, servers: .mcpServers.mcpServers}"

4. Build and launch the Agents window using the Run and Compile Agents - OSS task. Sign in to the same GitHub account, choose Local, select Copilot, and choose a workspace.

5. Start a fresh session with this read-only prompt:

   Use the Work IQ Mail MCP tools to list my 5 most recent email messages. Show only sender, received time, and subject. Do not send, delete, move, mark, archive, or otherwise modify anything.

6. Approve a365outlookmailmcp-SearchMessagesQueryParameters for the session. If the result exceeds the inline tool-output limit, also approve reading the generated temporary copilot-tool-output-*.txt file.

Expected result:

• the Customizations area includes a365outlookmailmcp
• the connector search tool completes and the response lists five messages
• no mail is modified
• agenthost.log contains connector activity with no AgentHostMcpConnectorsService warning or connector authorization error

Verified locally on 2026-09-03 against the live preview: the end-to-end Copilot turn completed successfully in 46 seconds with zero connector errors.

Testing

• npm run typecheck-client
• targeted ESLint for all PR-owned TypeScript files
• connector service contract tests: 11 passing
• merged service graph and Codex fixture suites: 178 passing
• merged Copilot, Claude, and Codex MCP-focused tests: 29 passing
• live Work IQ Mail test described above

[Copilot]

Copilot review overview

🟡 Changes recommended

Plain-HTTP credential exposure, incomplete 304 cache handling, and per-turn catalog requests must be addressed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 1 · 3

New issues introduced by this change (4)

Severity	Finding
	src/​vs/​platform/​agentHost/​node/​agentHostMcpConnectorsService.ts — Reject plain HTTP connector URLs. Every accepted endpoint receives the user's GitHub OAuth token in…
	src/​vs/​platform/​agentHost/​node/​agentHostMcpConnectorsService.ts — The 304 path ignores cache metadata returned by the revalidation response. A 304 may replace the…
	src/​vs/​platform/​agentHost/​node/​codex/​codexAgent.ts — This method runs once from sendMessage and again from _materialize for a cold session, so…
	src/​vs/​platform/​agentHost/​node/​copilot/​copilotAgent.ts — This puts a catalog request on the hot path of every live Copilot turn: snapshot() is recomputed…

What changed in this PR

Adds shared Agent Host discovery of connected Copilot Connector MCP servers and integrates them across providers.

Changes:

• Fetches, validates, caches, and revalidates connector catalogs.
• Merges connectors into Copilot, Claude, and Codex MCP configurations.
• Adds product configuration and provider/service tests.

File	Description
product.json	Configures the connector catalog endpoint.
src/​vs/​base/​common/​product.ts	Defines the optional product endpoint.
src/​vs/​platform/​agentHost/​node/​agentHostBootstrap.ts	Passes product configuration into core services.
src/​vs/​platform/​agentHost/​node/​agentHostServices.ts	Registers the connector service.
src/​vs/​platform/​agentHost/​node/​agentHostMcpConnectorsService.ts	Implements discovery, validation, caching, and authentication.
src/​vs/​platform/​agentHost/​node/​copilot/​copilotAgent.ts	Adds connectors to Copilot MCP configuration.
src/​vs/​platform/​agentHost/​node/​claude/​claudeAgentSession.ts	Adds connectors to Claude sessions.
src/​vs/​platform/​agentHost/​node/​codex/​codexAgent.ts	Adds connectors and reload handling to Codex.
src/​vs/​platform/​agentHost/​test/​node/​testMcpConnectorsService.ts	Provides a connector-service test stub.
src/​vs/​platform/​agentHost/​test/​node/​agentHostMcpConnectorsService.test.ts	Tests connector service behavior.
src/​vs/​platform/​agentHost/​test/​node/​copilotAgent.test.ts	Tests Copilot merging and precedence.
src/​vs/​platform/​agentHost/​test/​node/​claudeAgent.test.ts	Tests Claude merging and precedence.
src/​vs/​platform/​agentHost/​test/​node/​codex/​codexAgent.test.ts	Tests Codex merging and authentication.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.