> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ocean.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect GitHub Copilot

> Add the Ocean Security MCP server to GitHub Copilot agent mode in VS Code.

## Overview

[GitHub Copilot](https://docs.github.com/en/copilot) can use MCP servers in **agent mode**
inside VS Code. This guide adds Ocean as a remote MCP server so Copilot can query threats,
metrics, phishing reports, and allow/deny lists.

For connection details and the full tool catalog, see the
[MCP Server Overview](/api-reference/mcp/overview).

## Prerequisites

* VS Code with the **GitHub Copilot** and **GitHub Copilot Chat** extensions.
* Copilot **agent mode** enabled (select **Agent** in the Copilot Chat view).
* MCP access enabled for your tenant.
* An Ocean account to sign in with — or, if you're using the API key method, an Ocean **API
  key** (see [Authentication](/api-reference/introduction#authentication)).

## Add with OAuth (recommended)

Copilot reads MCP servers from a `.vscode/mcp.json` file in your workspace. Add Ocean as an
`http` server with no credential and let VS Code run the OAuth flow:

```json .vscode/mcp.json theme={null}
{
  "servers": {
    "ocean": {
      "type": "http",
      "url": "https://api.ocean.security/mcp"
    }
  }
}
```

The first time the server starts, VS Code asks you to sign in and opens a browser where you
authenticate with your Ocean account and approve the access Copilot asked for. VS Code stores
the token in your account credentials and refreshes it automatically.

Because there's no secret in the file, this entry is safe to commit — each teammate
authenticates as themselves.

<Note>
  OAuth access to Ocean is **read-only**. If you need the allow/deny write tools, use an API
  key instead — see [Authentication](/api-reference/mcp/overview#authentication).
</Note>

<Tip>
  To make Ocean available in every workspace, add the same `servers` entry to your user
  configuration instead. Open the Command Palette and run **MCP: Open User Configuration**.
</Tip>

## Add with an API key

Use an **input** so the key is prompted for and stored in your user secrets rather than written
into the file:

```json .vscode/mcp.json theme={null}
{
  "inputs": [
    {
      "id": "ocean-api-key",
      "type": "promptString",
      "description": "Ocean Security API key",
      "password": true
    }
  ],
  "servers": {
    "ocean": {
      "type": "http",
      "url": "https://api.ocean.security/mcp",
      "headers": {
        "X-Api-Key": "${input:ocean-api-key}"
      }
    }
  }
}
```

## Add via the Command Palette

Alternatively, add the server interactively:

<Steps>
  <Step title="Open the MCP add flow">
    Open the Command Palette (`Cmd/Ctrl+Shift+P`) and run **MCP: Add Server**.
  </Step>

  <Step title="Choose the transport">
    Select **HTTP (streamable)** and enter the URL `https://api.ocean.security/mcp`.
  </Step>

  <Step title="Name the server">
    Name it `ocean`. VS Code writes the entry to your `mcp.json`.
  </Step>

  <Step title="Authenticate">
    Start the server and complete the browser sign-in when prompted. To use an API key instead,
    edit the generated entry to add the `X-Api-Key` header as shown above.
  </Step>
</Steps>

## Verify the connection

<Steps>
  <Step title="Start the server">
    Open `.vscode/mcp.json` and click **Start** above the `ocean` server, or run
    **MCP: List Servers** and start it from there.
  </Step>

  <Step title="Check the tools">
    In the Copilot Chat view (Agent mode), open the tools picker and confirm Ocean's tools
    appear.
  </Step>

  <Step title="Ask a question">
    Try **"Use Ocean to show the top threat types"** and confirm Copilot calls an Ocean tool.
  </Step>
</Steps>

## Troubleshooting

* **Server won't start.** Confirm the URL is `https://api.ocean.security/mcp` and the `type` is
  `http`. Check the server output via **MCP: List Servers → Show Output**.
* **Sign-in keeps being requested.** Stop the server, then start it again to re-run the OAuth
  flow. Signing out of the account in VS Code clears the stored token.
* **401 on tool calls.** With an API key, the key is missing, expired, or inactive — re-enter it
  when prompted (clear stored inputs via **MCP: Reset Cached Tools / Inputs** if needed). With
  OAuth, sign in again.
* **No Ocean tools listed.** MCP access may not be enabled for your tenant, or your identity
  lacks the relevant permissions. See the
  [overview troubleshooting](/api-reference/mcp/overview#troubleshooting).