CYBO Attest MCP Server: VS Code Setup Guide¶

Quick start¶

Three clicks and a login. You need an Attest account first; create one at attest.ulapcybo.app if you do not have one.

Install. Click Install in VS Code. Let the browser open VS Code, then click Allow on the card that shows cybo_attest.
Sign in. Click Start when VS Code offers it, then Allow on the sign in prompt. Log in to Attest in the browser tab that opens, approve the access request, and come back. The server shows Running.
Use it. Open Copilot Chat (Ctrl+Alt+I), set the mode dropdown at the bottom to Agent, and type: List my Attest applications.

That is the whole setup. See Using Attest from chat below for what to ask next. Everything after that section is reference material and troubleshooting; you only need it if a step above did not work or you want to configure things by hand.

Using Attest from chat¶

You do not call the tools directly. Describe what you want in Copilot Chat (Agent mode) and the agent picks the right Attest tools, asking you to confirm before anything that changes state.

What you want	Say something like
See your apps	List my Attest applications
Register the repo you have open	Add this GitHub repo to Attest (a GitLab repo is added in the console; the agent gives you the link)
Run a scan	Start a scan on [app] and tell me when it finishes
Prove a fix	I pushed the fix. Scan the latest code of [app] and tell me which findings are gone and which remain
Review results	Show me the critical findings from the latest scan, then Explain finding [id]
Fix things	Plan fixes for the open findings, then Give me a fixed Dockerfile and apply it
Handle a false positive	Draft a justification for finding [id]; we do not ship that component. Then Submit it
Check readiness	Which gates are we failing and what controls do they map to?
Finish	Request authorization for version 1.4.0 of [app]

Tips

Type # followed by a tool name (for example #list_findings) to make the agent use that exact tool.
Combine Attest with your code: "Look at the Attest findings for this app and fix the ones in this file" reads findings through MCP and then edits the file.
Uncheck any tool in the Tools picker to keep the agent from calling it in that session.

Reference and troubleshooting¶

Details for manual setup, other editors, and fixing problems. Connection facts for reference:

Item	Value
Server URL	`https://attest.ulapcybo.app/mcp`
Transport	HTTP (Streamable HTTP)
Authentication	OAuth sign in with your Attest account
Suggested server name	`cybo_attest`
User config file	`~/.copilot/mcp-config.json` (shared by VS Code and the Copilot CLI)
Project config file	`.mcp.json` or `.github/mcp.json` at the repo root

Prerequisites¶

You need three things before you start.

An Attest account. Create one first at attest.ulapcybo.app if you do not have one; your free trial starts at registration. VS Code cannot create the account for you, and the sign in step below will fail without it.
VS Code 1.102 or later (check Help > About; run Extensions > Check for Updates if you are behind)
The GitHub Copilot and GitHub Copilot Chat extensions installed and signed in, since VS Code's MCP support runs through Copilot's Agent mode

If your organization manages Copilot, confirm that MCP servers are allowed in your Copilot policy. An admin can turn that off, and when they do the MCP commands never appear in VS Code.

Option A: Add the server from the Command Palette¶

This is the quickest path and writes the config file for you.

Open the Command Palette with Ctrl+Shift+P (Cmd+Shift+P on macOS).
Type MCP: Add Server and select it.
Choose the HTTP option. Depending on your build it is labeled HTTP (HTTP or Server Sent Events) or HTTP (Streamable HTTP); either one works.
Paste the server URL: https://attest.ulapcybo.app/mcp
Enter the server name: cybo_attest
When VS Code asks you to select the global configuration, pick Copilot Global (~/.copilot/mcp-config.json). Skip the entry marked deprecated; VS Code is phasing out its old per profile mcp.json.
VS Code writes the entry and opens mcp-config.json so you can see it. The result should look like the JSON block in Option B below.

If you would rather scope the server to one project, pick the Workspace option instead when it is offered and save to .mcp.json at the project root. The deprecated .vscode/mcp.json entry still works for now but the Copilot CLI does not read it.

VS Code opens the config file it wrote and offers to start the server. Click Start, then continue to the sign in section below. Because the Copilot Global file is shared with the GitHub Copilot CLI, the same server is available there with no extra setup.

Option B: Add the server by editing mcp.json¶

Use this path if you prefer a file you can check in and share with the team. Current VS Code and the GitHub Copilot CLI read the same portable format, so one file covers both.

For all your projects: edit the Copilot user file and paste the block below. On macOS and Linux it is ~/.copilot/mcp-config.json; on Windows it is %USERPROFILE%\.copilot\mcp-config.json. Create the file if it does not exist. If you have set COPILOT_HOME, the file lives in that directory instead.

For one project only: create .mcp.json in the project root and paste the same block. To share it with everyone on the repo, put it at .github/mcp.json instead and commit it; both are read automatically. The older .vscode/mcp.json with a top level servers key is deprecated and the Copilot CLI ignores it.

{
  "mcpServers": {
    "cybo_attest": {
      "type": "http",
      "url": "https://attest.ulapcybo.app/mcp",
      "tools": ["*"]
    }
  }
}

If the file already contains an mcpServers object, add only the cybo_attest entry inside it. "tools": ["*"] exposes every Attest tool; replace it with a list of tool names to limit what the agent can call. Do not put tokens or credentials in this file; sign in is handled by OAuth and the session is stored in the OS secret store.

After saving, run MCP: List Servers from the Command Palette, select cybo_attest, and choose Start. From the terminal you can do the same thing in one line, which writes to the same user file: copilot mcp add --transport http cybo_attest https://attest.ulapcybo.app/mcp

Once the config is saved (you can close the JSON tab), start the server and complete the one time login.

Open the Command Palette (Ctrl+Shift+P, or Cmd+Shift+P on macOS) and run MCP: List Servers.
Pick cybo_attest, then choose Start.
VS Code asks to allow sign in to Attest. Click Allow. If a trust dialog for the server appears first, accept that too.
VS Code opens your browser to the Attest login page. Sign in with your Attest account and approve the access request.
Return to VS Code and run MCP: List Servers again. The status next to cybo_attest should now read Running.
Open Copilot Chat, switch the mode dropdown at the bottom of the panel to Agent, and type List my Attest applications. If it answers with your applications, setup is complete.

If Start fails, pick the server in MCP: List Servers, choose Show Output, and check the Troubleshooting section below.

You only do this once per machine. The session is stored in your OS keychain, so you will not be asked again unless you sign out of Attest or the token expires. To sign out later, open the Accounts menu in the bottom left of VS Code and remove the Attest entry.

Verify and use¶

Once the server shows Running, the Attest tools are available in Copilot Chat.

Open Copilot Chat (Ctrl+Alt+I, or the chat icon in the Activity Bar).
Switch the mode dropdown at the bottom of the chat panel to Agent.
Click the Tools icon in the chat input. Expand cybo_attest and confirm the tools are listed and checked.
Ask something simple to confirm the connection, for example: List my Attest applications or What is the security posture of my application?

Common tools you will see:

Tool	What it does
`whoami`	Confirms which Attest account you are signed in as
`list_applications`	Lists the applications registered in Attest
`add_github_repository`	Registers a GitHub repo as a new application
`sync_application`	Pulls the newest commits, rebuilds, and starts the scans; the rescan after a fix
`start_scan`	Re runs the scans on the build Attest already has
`list_findings` / `get_finding`	Returns findings from the latest scan with detail on each
`explain_finding`	Explains a finding in plain language with remediation context
`plan_fixes`	Produces a fix plan for the open findings
`get_dockerfile_fix` / `use_fixed_dockerfile`	Proposes and applies a corrected Dockerfile
`draft_justification` / `propose_justification`	Drafts and submits a justification for a finding
`get_security_posture`	Summarizes the application's current posture against the gates
`request_authorization`	Requests authorization once gates are passed

Tools that change state (starting a scan, applying a Dockerfile, submitting a justification) will ask you to confirm in the chat panel before they run.

Other editors and agents¶

The same URL works anywhere that supports remote MCP servers over HTTP.

Claude Code (terminal or VS Code extension)

claude mcp add --transport http cybo_attest https://attest.ulapcybo.app/mcp

Then run /mcp inside Claude Code and choose cybo_attest to complete the OAuth login. Full guide: Claude Code.

GitHub Copilot CLI: nothing extra if you already set up VS Code with Copilot Global, since both read ~/.copilot/mcp-config.json. Full guide: GitHub Copilot CLI.

Cursor: add the URL in Cursor's MCP settings and click Login. Full guide: Cursor.

Gemini CLI and OpenAI Codex: one command adds the server and one signs in. Full guides: Gemini CLI and OpenAI Codex.

Windsurf and other VS Code forks: open their MCP settings panel and add an HTTP server with the URL above. Field names vary slightly but the URL, transport, and OAuth flow are identical.

Claude.ai: add it as a custom connector with the same URL. Full guide: Claude: Quick Setup.

ChatGPT: add it as a custom connector with the same URL. Full guide: ChatGPT.

Troubleshooting¶

Symptom	Likely cause	Fix
`MCP: Add Server` is not in the Command Palette	VS Code is older than 1.102, Copilot is not installed, or an org policy disables MCP	Update VS Code and the Copilot extensions; ask your Copilot admin to enable MCP servers
Add Server asks which global configuration to use	Newer VS Code builds store MCP config in the shared Copilot file	Choose Copilot Global; the deprecated User Configuration entry still works but will be removed
Server is in the file but never appears in the list	Config is in a deprecated location, or the wrong top level key	Use `mcpServers` (not `servers`) in `~/.copilot/mcp-config.json` or `.mcp.json`; move anything from `.vscode/mcp.json`
Server shows an error icon in `MCP: List Servers`	Config typo, or the URL is unreachable from your network	Select the server, choose Show Output, and read the log; confirm you can open `https://attest.ulapcybo.app` in a browser
Browser shows "An error occurred while signing in: Invalid scopes"	The Attest sign in service rejected the client VS Code registered	Contact Ulap support with the exact error text; this is fixed on the Attest side, then Restart the server and sign in again
Server sits at Error with a 401 in Show Output after a failed login	VS Code is holding a stale login state	`MCP: List Servers`, cybo_attest, Disconnect Account (or sign out of Attest from the Accounts menu), then Restart and sign in again
Browser login succeeds but VS Code still says not signed in	OAuth redirect was blocked, or the browser session never handed the token back	Select the server and choose Restart; retry the login and keep the browser tab open until VS Code reports Running
Tools are missing from the Tools picker	Chat is in Ask or Edit mode, or the server is stopped	Switch the mode dropdown to Agent and make sure the server is Running
Tool calls return 401 or 403	Session expired, or your account lacks access to that application	Remove the Attest entry from the Accounts menu and sign in again; confirm your role in the Attest console

Still stuck? Run MCP: List Servers, choose the server, pick Show Output, and send the log to Ulap support along with your VS Code version.