Connect GitHub Copilot

Overview

GitHub Copilot can use MCP servers in agent mode inside VS Code. This guide adds Ocean as a remote MCP server so Copilot can query threats, metrics, phishing reports, and allow/deny lists. For connection details and the full tool catalog, see the MCP Server Overview.

Prerequisites

VS Code with the GitHub Copilot and GitHub Copilot Chat extensions.
Copilot agent mode enabled (select Agent in the Copilot Chat view).
MCP access enabled for your tenant.
An Ocean account to sign in with — or, if you’re using the API key method, an Ocean API key (see Authentication).

Add with OAuth (recommended)

Copilot reads MCP servers from a .vscode/mcp.json file in your workspace. Add Ocean as an http server with no credential and let VS Code run the OAuth flow:

.vscode/mcp.json

{
  "servers": {
    "ocean": {
      "type": "http",
      "url": "https://api.ocean.security/mcp"
    }
  }
}

The first time the server starts, VS Code asks you to sign in and opens a browser where you authenticate with your Ocean account and approve the access Copilot asked for. VS Code stores the token in your account credentials and refreshes it automatically. Because there’s no secret in the file, this entry is safe to commit — each teammate authenticates as themselves.

OAuth access to Ocean is read-only. If you need the allow/deny write tools, use an API key instead — see Authentication.

To make Ocean available in every workspace, add the same servers entry to your user configuration instead. Open the Command Palette and run MCP: Open User Configuration.

Add with an API key

Use an input so the key is prompted for and stored in your user secrets rather than written into the file:

.vscode/mcp.json

{
  "inputs": [
    {
      "id": "ocean-api-key",
      "type": "promptString",
      "description": "Ocean Security API key",
      "password": true
    }
  ],
  "servers": {
    "ocean": {
      "type": "http",
      "url": "https://api.ocean.security/mcp",
      "headers": {
        "X-Api-Key": "${input:ocean-api-key}"
      }
    }
  }
}

Add via the Command Palette

Alternatively, add the server interactively:

Open the MCP add flow

Open the Command Palette (Cmd/Ctrl+Shift+P) and run MCP: Add Server.

Choose the transport

Select HTTP (streamable) and enter the URL https://api.ocean.security/mcp.

Name the server

Name it ocean. VS Code writes the entry to your mcp.json.

Authenticate

Start the server and complete the browser sign-in when prompted. To use an API key instead, edit the generated entry to add the X-Api-Key header as shown above.

Verify the connection

Start the server

Open .vscode/mcp.json and click Start above the ocean server, or run MCP: List Servers and start it from there.

Check the tools

In the Copilot Chat view (Agent mode), open the tools picker and confirm Ocean’s tools appear.

Ask a question

Try “Use Ocean to show the top threat types” and confirm Copilot calls an Ocean tool.

Troubleshooting

Server won’t start. Confirm the URL is https://api.ocean.security/mcp and the type is http. Check the server output via MCP: List Servers → Show Output.
Sign-in keeps being requested. Stop the server, then start it again to re-run the OAuth flow. Signing out of the account in VS Code clears the stored token.
401 on tool calls. With an API key, the key is missing, expired, or inactive — re-enter it when prompted (clear stored inputs via MCP: Reset Cached Tools / Inputs if needed). With OAuth, sign in again.
No Ocean tools listed. MCP access may not be enabled for your tenant, or your identity lacks the relevant permissions. See the overview troubleshooting.

​Overview

​Prerequisites

​Add with OAuth (recommended)

​Add with an API key

​Add via the Command Palette

​Verify the connection

​Troubleshooting

Overview

Prerequisites

Add with OAuth (recommended)

Add with an API key

Add via the Command Palette

Verify the connection

Troubleshooting