Skip to content

CYBO Attest in the GitHub Copilot CLI

Before you start

The Copilot CLI and VS Code read the same configuration file, so if you already added Attest in VS Code with the Copilot Global option, Attest is already in the CLI. Skip to Sign in and try it.

Otherwise it takes about a minute. You need:

  • An Attest account. Create one at attest.ulapcybo.app first; your free trial starts at registration.
  • The GitHub Copilot CLI installed and signed in to GitHub with a Copilot subscription.

The connection details, in case you are asked for them:

Item Value
Server type Remote MCP server, HTTP transport
Server URL https://attest.ulapcybo.app/mcp
Suggested name cybo_attest
Sign in OAuth, with your Attest account
Config file ~/.copilot/mcp-config.json, shared with VS Code

Add the server

From your shell, not inside a Copilot session:

copilot mcp add --transport http cybo_attest https://attest.ulapcybo.app/mcp

If you would rather edit the file, add this to ~/.copilot/mcp-config.json (on Windows, %USERPROFILE%\.copilot\mcp-config.json):

{
  "mcpServers": {
    "cybo_attest": {
      "type": "http",
      "url": "https://attest.ulapcybo.app/mcp",
      "tools": ["*"]
    }
  }
}

For one project only, put the same block in .mcp.json at the repo root, or in .github/mcp.json to share it with everyone who clones the repo. Nobody shares credentials; the file only carries the URL.

Sign in and try it

  1. Start a session with copilot and type /mcp. Attest is listed and needs authentication.
  2. Select cybo_attest and choose sign in. Your browser opens to the Attest sign in page. Log in with your Attest account, approve the consent screen, and return to the terminal. The status changes to connected.
  3. Ask: Who am I in CYBO Attest? It answers with your name and organization, which confirms the sign in.
  4. Ask: What is the security posture of my applications?

The CLI asks before each tool call the first time. Allow the read tools; for tools that change something (starting a scan, submitting a justification) keep answering per call until you are comfortable.

Useful next prompts, from inside a project directory:

  • Explain the first finding and tell me which file in this repo it applies to
  • Get the Attest fix plan for this app and work through it, one commit per fix
  • I pushed the fix. Scan the latest code of [app], follow it, and tell me which findings are gone and which remain
  • Draft a justification for finding [id]; we do not ship that component

Good to know

The rescan is how a fix gets proven. Once the fix is on the default branch, ask the agent to scan the latest code. Attest pulls the newest commits, rebuilds the container, and runs the scans; the agent follows the build and then lists the findings on the new scan, so you see what closed and what is left. Asking to start a scan without new code re runs the scans on the build Attest already has, which is for when a justification or configuration changed, not the code.

It is the same connection as VS Code. Add Attest in either place and it is available in both, because both read ~/.copilot/mcp-config.json. Sign in is per machine, so after signing in from the CLI you are signed in for VS Code too.

Writes carry your name. Every change the agent makes is logged in Attest as you, with the client that made it. The agent cannot approve or reject a build; that stays in the Attest console with a named person.

Keep write tools out of unattended runs. If you script the CLI, allow only the read tools it needs. See Connecting an AI agent for the permissions model.

If something goes wrong

Symptom Fix
/mcp does not list cybo_attest The CLI did not find the file. Check ~/.copilot/mcp-config.json exists with the block above, or re run the add command, then restart copilot
Listed but marked needs authentication Expected before first sign in. Select it in /mcp and sign in
Browser opens but the terminal never updates Keep the tab open until the terminal shows connected; if it never does, run /mcp and sign in again
Sign in page says invalid scopes or unknown client Remove the server and add it again, which registers a fresh client. If it repeats, send the exact text to Ulap support
Tools return 401 or 403 Your session expired or your Attest role lacks access to that application. Sign in again from /mcp and check your role in Attest
The agent uses another tool instead of Attest Say "use Attest" in the prompt

Still stuck? Contact Ulap support with the exact error text and a screenshot.