Domain 6 of 6 · Chapter 1 of 4

Select and configure agent tools

Unlock the complete study guide.

Bundled into the existing Developing in Agentic AI Systems premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Where tools come from, and the layers that govern them
  • Building a least-privilege custom agent profile for its target environment
  • Controlling how a custom agent is chosen, separately from what it can do
  • Copilot CLI session controls: visibility and permission flags, directory trust, enterprise policy and grant lifetimes
  • Tool selection surfaces and limits in VS Code
  • Choosing MCP tools by their discovered contract
  • Credentials for tools: secrets, tokens and the programs that read them
  • Calling the GitHub API directly with gh api
  • Applied reasoning: matching a tool requirement to its layer

Which layer or decision, and which control, answer which question

Layer or decisionQuestionControlWhere it appliesWhat it does not decide
ProviderDoes the capability exist in this environment at all?A built-in tool, an extension-contributed tool, or a configured MCP serverVS Code (built-in and extension tools); MCP servers for any agentWhether the model is offered the tool, or, where that product has a separate execution control, may run it
VisibilityWhich tools is this custom agent offered?`tools` in the agent profileCustom agent profilesWhether the agent is selected automatically
VisibilityWhich tools can the CLI model see?`--available-tools` / `--excluded-tools`Copilot CLIWhether a visible tool may execute without approval
VisibilityToo many enabled tools for one request?Deselect tools or servers, or set `github.copilot.chat.virtualTools.threshold`VS CodeWhich providers are installed or configured
PermissionMay a visible tool run, or must it be refused?`--allow-tool` / `--deny-tool` (deny wins)Copilot CLIWhether the model is offered the tool
PermissionMay the agent reach this URL or domain?`--allow-url` / `--deny-url` (deny wins)Copilot CLIApproval for shell or MCP tools
PermissionMay Copilot cloud agent run an MCP tool at all?The `tools` array in each MCP server's configuration, chosen before the runCopilot cloud agent, which asks for no approval as it worksWhich of the exposed tools a given custom agent is offered
InvocationShould the agent run only when someone selects it?`disable-model-invocation: true`Copilot cloud agent selectionWhich tools the agent has
InvocationShould people be unable to pick the agent by hand?`user-invocable: false`Custom agent profilesProgrammatic access to the agent
CredentialWhich secret can MCP configuration substitute?Agents secret or variable named `COPILOT_MCP_*`Cloud agent MCP configurationAccess to ordinary Actions secrets

Decision tree

Is the needed capability missingfrom the environment entirely? Provider: use a built-in tool, or add anMCP server or extension-contributed tool yes no Must the model never be offeredthis tool at all? Visibility: the profile tools list,or --available-tools / --excluded-tools yes no Must a visible tool be refused,or run without a prompt? Permission: CLI --allow-tool / --deny-tooland URL rules, where deny beats allow;cloud agent: each MCP server's tools array yes no Is the problem which custom agentgets chosen, and by whom? Invocation: disable-model-invocationor user-invocable, not the tools list yes no Otherwise, if a tool that is provided, visible and permitted fails to authenticate,check where the program that reads its credential looks, such as a COPILOT_MCP_ Agents secretfor cloud agent MCP servers, or the COPILOT_GITHUB_TOKEN, GH_TOKEN, GITHUB_TOKENorder for Copilot CLI.
Cheat sheet

Cheat sheet

  • Listing a planning tool does not make an unavailable tool operational.
  • Use read and search tools to inspect a repository without enabling edits
  • Enable edit when an agent must change files
  • Enable execute for shell-based builds and tests
  • Enable the agent tool to invoke another custom agent
  • Use cloud agent's default Playwright MCP tools for browser work against localhost
  • Distinguish an omitted tools property from an empty tools list
  • Namespace MCP tools when filtering a custom agent's tool set
  • Do not treat an unrecognized tool name as a configuration failure
  • Disable model invocation to require deliberate custom-agent selection
  • Use user-invocable to control manual selection separately from automatic invocation
  • Set target when an agent profile is intended for a particular environment
  • Configure IDE MCP connections outside the profile's mcp-servers property
  • Separate model-visible tools from permission to execute them
  • Explicit CLI deny rules override allow rules
  • Use the command-stem pattern to avoid matching unrelated executable names
  • Scope CLI MCP approval to a tool rather than an entire server when possible
  • Deny writes to a selected path without blocking unrelated writes
  • Configure URL access independently of tool approval
  • Treat adding a CLI directory as a configuration-trust decision
  • Enterprise policy can prevent CLI bypass flags from granting broad permissions
  • Discover the server's actual tools rather than inferring capabilities from its name
  • Validate tool arguments against inputSchema
  • Use outputSchema to validate structured tool results
  • Do not grant tool permissions solely from an untrusted annotation
  • Refresh discovery when a server announces a changed tool catalog
  • Provide cloud-agent MCP credentials as prefixed Agents secrets
  • Match secret-reference syntax to the MCP configuration format
  • Check token environment-variable precedence when CLI uses the wrong identity
  • Use a supported fine-grained token when authenticating CLI with a personal access token
  • Check credential-store availability before relying on encrypted local token storage
  • Choose the tool provider that supplies the required integration
  • Use integrated browser tools to validate an observable web user flow
  • Match the tool-selection surface and persistence to the active harness
  • Apply the availability allowlist when both CLI visibility filters are supplied
  • Distinguish location-persisted tool consent from session flags and global URL consent
  • Reset interactive approvals without discarding startup permission options
  • Reduce enabled tools or use virtual tools when a request exceeds the tool limit
  • Provide GitHub CLI credentials for unattended repository operations
  • Use gh api for GitHub operations beyond dedicated subcommands

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://code.visualstudio.com/docs/agents/run/tools
  2. https://code.visualstudio.com/docs/agents/reference/ai-settings
  3. https://modelcontextprotocol.io/specification/2025-06-18/server/tools