MCP

Specify MCP servers under mcpServers in SessionConfig to enable them. If you’re using Laravel Boost from the Copilot CLI, also install laravel-boost-copilot-cli. We know that 'type' => 'stdio' (or 'local') and 'tools' => ['*'] are required. Without them, the MCP server is not recognized. args is optional.

Artisan::command('copilot:mcp', function () {
    $config = new SessionConfig(
        mcpServers: [
            'laravel-boost' => [
                'type' => 'stdio',
                'command' => 'php',
                'args' => ['artisan', 'boost:mcp'],
                'tools' => ['*'],
            ],
        ],
    );

    Copilot::start(function (CopilotSession $session) {
        info('Starting Copilot with Laravel Boost MCP: '.$session->id());

        $prompt = 'Which MCPs are loaded? If laravel-boost is available, fetch the app info with application-info.';

        warning($prompt);

        $response = spin(
            callback: fn () => $session->sendAndWait($prompt),
            message: 'Thinking...',
        );

        note($response->content());
    }, config: $config);
});

MCP Apps (experimental)

In a session with enableMcpApps enabled, use $session->rpc()->mcp()->apps() to work with MCP Apps tools and resources. listTools() returns the tools an app can call, callTool() runs a tool, and readResource() fetches a ui:// resource such as HTML. listTools() and callTool() require originServerName, which identifies the calling server. Use getHostContext() and setHostContext() to read and write host context such as the theme and locale. diagnose() returns the server’s MCP Apps support status.

use Revolution\Copilot\Types\Rpc\MCPAppsDiagnoseRequest;
use Revolution\Copilot\Types\Rpc\MCPAppsListToolsRequest;
use Revolution\Copilot\Types\Rpc\McpAppsCallToolRequest;
use Revolution\Copilot\Types\Rpc\McpAppsReadResourceRequest;
use Revolution\Copilot\Types\Rpc\McpAppsSetHostContextDetails;
use Revolution\Copilot\Types\Rpc\McpAppsSetHostContextRequest;

$apps = $session->rpc()->mcp()->apps();

$tools = $apps->listTools(new MCPAppsListToolsRequest(
    serverName: 'my-server',
    originServerName: 'my-server',
));

$result = $apps->callTool(new McpAppsCallToolRequest(
    serverName: 'my-server',
    toolName: 'lookup',
    originServerName: 'my-server',
    arguments: ['query' => 'hello'],
));

$resource = $apps->readResource(new McpAppsReadResourceRequest(
    serverName: 'my-server',
    uri: 'ui://my-app/index.html',
));

$context = $apps->getHostContext();
$apps->setHostContext(new McpAppsSetHostContextRequest(
    context: new McpAppsSetHostContextDetails(theme: 'dark', locale: 'en-US'),
));

$diagnostics = $apps->diagnose(new MCPAppsDiagnoseRequest(serverName: 'my-server'));

callTool() returns a free-form MCP result. The SDK provides RPCs for fetching and setting data, but it does not render the fetched HTML or manage iframes. Implement rendering in your application, for example with Livewire or Inertia.

Provide MCP OAuth tokens from the host

When an MCP server requires OAuth authentication, use onMcpAuthRequest to handle authentication in your application. The callback receives an McpAuthRequest and a context array that contains sessionId. Return an McpAuthToken to pass the token to the CLI runtime. Return null or an McpAuthResult with kind: 'cancelled' to cancel authentication.

use Revolution\Copilot\Types\McpAuthRequest;
use Revolution\Copilot\Types\McpAuthResult;
use Revolution\Copilot\Types\McpAuthToken;
use Revolution\Copilot\Types\SessionConfig;

$config = new SessionConfig(
    mcpServers: [
        'private-mcp' => [
            'type' => 'http',
            'url' => 'https://mcp.example.com',
        ],
    ],
    onMcpAuthRequest: function (McpAuthRequest $request, array $context): McpAuthToken|McpAuthResult|null {
        // Get a token from your application's own credential service
        $accessToken = $credentialProvider->tokenFor($request->serverName);

        return $accessToken === null
            ? new McpAuthResult(kind: 'cancelled')
            : new McpAuthToken(accessToken: $accessToken, tokenType: 'Bearer');
    },
);

McpAuthRequest includes requestId, serverName, serverUrl, and reason (initial, refresh, reauth, or upscope). When you set the handler, the SDK automatically subscribes to mcp.oauth_required events. This lets you authenticate in contexts that cannot open a browser, such as web requests, queues, and batches. When you resume a session, pass the same handler in ResumeSessionConfig.

Check MCP OAuth support (Server RPC)

After a remote MCP server requests OAuth authentication, use Server RPC to check whether it supports Dynamic Client Registration (DCR). authorizationServerUrl is returned when the authorization server can be discovered from metadata. If supportsDcr is false, dynamic registration is not available.

use Revolution\Copilot\Facades\Copilot;
use Revolution\Copilot\Types\Rpc\McpOauthCheckDcrSupportRequest;
use Revolution\Copilot\Types\Rpc\McpOauthIsMicrosoftAuthorizationServerRequest;

$oauth = Copilot::client()->rpc()->mcp()->oauth();

$dcr = $oauth->checkDcrSupport(new McpOauthCheckDcrSupportRequest(
    serverUrl: 'https://mcp.example.com',
    resourceMetadataText: $challengeMetadata,
    sessionId: $session->id(),
));

$isMicrosoft = $dcr->authorizationServerUrl === null
    ? false
    : $oauth->isMicrosoftAuthorizationServer(new McpOauthIsMicrosoftAuthorizationServerRequest(
        authorizationServerUrl: $dcr->authorizationServerUrl,
    ))->isMicrosoftAuthorizationServer;

resourceMetadataText is the protected resource metadata from the WWW-Authenticate challenge. If you omit it, the authorization server is discovered from the server URL. If you pass sessionId, the destination policy and sandbox proxy of that local session apply. Microsoft Entra ID does not support DCR. If the authorization server is Microsoft, you can use a pre-registered client instead of asking the user for client credentials. These are Server RPCs (Copilot::client()->rpc()). They are a separate namespace from the session RPC $session->rpc()->mcp()->oauth(), which handles login and OAuth requests.

MCP server status

MCP server status inside a session can be one of the following:

Status	Description
`connected`	Connected
`failed`	Connection failed
`needs-auth`	Authentication required
`pending`	Waiting to connect
`disabled`	Disabled
`not_configured`	Not configured

Each server returned by $session->rpc()->mcp()->listConfigured() may include its observed runtime state as live. Convert it to a typed object with McpConfiguredServerState::fromArray($server['live']). The optional toolsLoaded bool on McpConfiguredServerState indicates whether the current connection has loaded its tool list. When the runtime has not reported it, toolsLoaded is null, so don’t treat a missing value as false.

use Revolution\Copilot\Types\Rpc\McpConfiguredServerState;

foreach ($session->rpc()->mcp()->listConfigured()['servers'] ?? [] as $server) {
    if (isset($server['live'])) {
        $state = McpConfiguredServerState::fromArray($server['live']);

        dump($state->status->value, $state->toolsLoaded);
    }
}

A connected status alone does not mean the tools are loaded. Listen for the session.mcp_server_tools_loaded event to know when a server’s tool list becomes available. This ephemeral event fires once per connection with data.serverName and data.toolCount, and is not persisted. When cached tools are used, it can arrive before connected.

Managing MCP server configuration (Server RPC)

Independently of sessions, you can manage MCP server configuration at the server level.

use Revolution\Copilot\Facades\Copilot;
use Revolution\Copilot\Types\Rpc\McpConfigAddRequest;
use Revolution\Copilot\Types\Rpc\McpConfigUpdateRequest;
use Revolution\Copilot\Types\Rpc\McpConfigRemoveRequest;
use Revolution\Copilot\Types\Rpc\McpServerValue;

// List configured MCP servers
$result = Copilot::client()->rpc()->mcp()->list();
foreach ($result->servers as $name => $config) {
    dump($name, $config->type, $config->command);
}

// Add an MCP server
Copilot::client()->rpc()->mcp()->add(new McpConfigAddRequest(
    name: 'laravel-boost',
    config: new McpServerValue(
        type: 'stdio',
        command: 'php',
        args: ['artisan', 'boost:mcp'],
        tools: ['*'],
    ),
));

// Update an MCP server's configuration
Copilot::client()->rpc()->mcp()->update(new McpConfigUpdateRequest(
    name: 'laravel-boost',
    config: new McpServerValue(
        type: 'stdio',
        command: 'php',
        args: ['artisan', 'boost:mcp', '--verbose'],
        tools: ['*'],
    ),
));

// Remove an MCP server
Copilot::client()->rpc()->mcp()->remove(new McpConfigRemoveRequest(name: 'laravel-boost'));

Disabled servers when reloading MCP

When you pass configuration to reloadWithConfig(), configuredDisabledServers is the list of servers disabled by settings that your application resolved. Specify it separately from the session-level disabledServers and the CLI’s cliEnabledServers. Settings-based disabling has lower priority than CLI enabling and explicit session disabling, so don’t merge configuredDisabledServers into disabledServers.

$session->rpc()->mcp()->reloadWithConfig([
    'config' => [
        'mcpServers' => $mcpServers,
        'disabledServers' => ['session-disabled'],
        'cliEnabledServers' => ['cli-enabled'],
        'configuredDisabledServers' => ['settings-disabled'],
    ],
]);

For the latest updates, see the GitHub repository.

GitHub Copilot

SDK

AI SDK

VOICEVOX

Starter Kits

Feeds and RSS

Middleware

MCP

MCP

MCP Apps (experimental)

Provide MCP OAuth tokens from the host

Check MCP OAuth support (Server RPC)

MCP server status

Managing MCP server configuration (Server RPC)

Disabled servers when reloading MCP

​MCP

​MCP Apps (experimental)

​Provide MCP OAuth tokens from the host

​Check MCP OAuth support (Server RPC)

​MCP server status

​Managing MCP server configuration (Server RPC)

​Disabled servers when reloading MCP

MCP

MCP Apps (experimental)

Provide MCP OAuth tokens from the host

Check MCP OAuth support (Server RPC)

MCP server status

Managing MCP server configuration (Server RPC)

Disabled servers when reloading MCP