Domain 6 of 6 · Chapter 3 of 4

Integrate agents within development environments

Unlock the complete study guide.

Bundled into the existing Developing in Agentic AI Systems premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Where the agent runs decides what it can reach
  • Which MCP file each session harness reads
  • Stdio MCP servers need attached, clean streams
  • Worktree sessions keep agent edits out of your primary worktree
  • Reviewing agent edits depends on the session harness
  • How the agent's terminal succeeds or stalls
  • Preparing the cloud environment before the agent starts
  • Choosing a runner the cloud agent can work with
  • Where cloud-agent hooks are discovered, and what they run with
  • The cloud agent's working-branch scope
  • Which custom-agent definition a task gets
  • Driving agents from scripts and workflows
  • Pull-request base and head in agent workflows

Where the change belongs

Requirement or symptomWhere to make the changeWhat it governsWhat it does not govern
A server must run on the laptop while the editor is connected to a remote machineMCP scope: user profile versus workspace or remote user settingsWhich machine starts the server processWhether the Agent Host reads the file natively
An Agent Host session (the current VS Code chat harness, not a machine) is missing a server defined in `.vscode/mcp.json`Check whether the definition uses `${input:...}` values: VS Code does not forward servers that require them; for native configuration use workspace `.mcp.json` or user `~/.copilot/mcp-config.json`Configuration the Agent Host reads itself rather than through forwardingThe `.vscode/mcp.json` servers VS Code already forwards
The cloud agent needs `uv`, `pipx` or a project toolchain that the runner lacks`copilot-setup-steps.yml`, merged to the default branchWhat exists in the environment before the agent startsThe agent's prompt, its tool allowlist, or its working-branch scope
The agent must be able to push somewhere other than a fresh `copilot/` branchHow the task is started — `@copilot` on an existing pull requestWhich single branch receives the agent's commitsBranch protection and required checks, which still apply
A setup step needs to read the repository`permissions` on the `copilot-setup-steps` jobWhat the setup steps themselves may doCopilot's own working-branch scope
A cloud-agent hook must notify an external service during a sessionWhere the integrated firewall is in use, an administrator-configured allow rule; plus the hook on the default branchWhether that firewall lets the destination be reachedWhich credentials the hook sandbox provides
A workflow step must hand the agent one instruction and then continueCopilot CLI `-p`/`--prompt`Execute-and-exit behaviour for the stepWhich custom agent runs, which `--agent` selects
`gh workflow run` reports that the workflow cannot be dispatchedThe target workflow's `on:` triggersWhether a `workflow_dispatch` event is acceptedWhich branch the resulting pull request targets
Clients fail to initialize a locally launched MCP serverWhere the launcher writes its diagnosticsWhether stdout carries only valid protocol messagesWhether stderr output means the server failed
The integrated firewall cannot be used because the runner is self-hosted or WindowsNetwork controls outside the integrated firewallHow outbound network traffic (egress) is restricted for that runnerWhether the agent is compatible with the runner at all

Decision tree

Does the task need tools, files orcredentials that exist only on the laptop? Run locally. Keep MCP servers in user-profilescope; choose how to isolate the session. yes no Must a workflow step drive the agentand then return control to the job? Copilot CLI in prompt mode (-p),plus an authentication route. yes no Does the cloud agent need toolchainsor dependencies before it starts? Prepare it in copilot-setup-steps on thedefault branch; keep to supported settings. yes no Does a hook have to reach a serviceoutside GitHub during the session? Default-branch hook; where the integratedfirewall is in use, allow the destination. yes no Is the ask about what the agent maywrite rather than what it can run? That is the working-branch scope and branchprotection, never the setup job's permissions. yes no: none of these surfaces needs changing

Cheat sheet

  • Choose execution context based on where the agent's tools run
  • Use a worktree session to keep agent files separate from the primary worktree
  • Place MCP configuration in the scope that runs on the intended machine
  • In an Agent Host session, review saved edits through diffs, not approval prompts
  • How the task starts sets the cloud agent's working-branch scope
  • Set pull-request base and head according to destination and proposed changes
  • A cloud-agent task uses the branch's latest custom-agent profile and keeps that version
  • A repository's matching custom-agent profile overrides broader definitions
  • Use prompt mode for a CLI invocation that exits after completing its task
  • Authenticate an Actions CLI invocation with the built-in token and Copilot request permission
  • Declare workflow_dispatch before invoking an agent workflow with gh workflow run
  • Select the workflow's repository and ref explicitly for branch-specific invocation
  • Parse programmatic JSON output as JSON Lines
  • Use silent mode when a script needs only the agent's response
  • Select the intended custom agent on the CLI invocation
  • Use the recognized setup file and job identifier
  • Install required MCP launch dependencies in setup steps
  • Setup-job permissions are not the cloud agent's working-branch scope
  • Test environment setup when the setup workflow changes
  • Provide a Linux-compatible command for cloud-agent hooks
  • Do not assume cloud-agent hook scripts receive the Actions GITHUB_TOKEN variable
  • Allow the destination before depending on an external cloud-agent hook notification
  • Explicitly authorize repository-controlled MCP startup in CLI prompt mode
  • Keep stdio MCP protocol output separate from diagnostic logging
  • Commit cloud-agent audit hooks to the default branch
  • Use native portable MCP configuration when Agent Host forwarding is unsuitable
  • Keep a Docker-launched stdio MCP server in the foreground
  • Select a shell with integration support for reliable command lifecycle signals
  • Background persistent terminal commands so the agent can continue working
  • Merge the setup workflow into the default branch to activate it
  • Prepare application dependencies deterministically before the agent starts
  • Treat a failed setup step as partial preparation rather than a blocked agent launch
  • Restrict setup-job customization to the supported settings
  • Select a compatible provisioned runner for the agent's execution requirements
  • Replace the integrated firewall with network controls on incompatible runners
  • Fetch LFS objects during setup when the agent needs their file contents
  • The cloud agent's pushes stay within its working-branch scope and its protections

Unlock with Premium — includes all practice exams and the complete study guide.