In this Quickstart, you learn how to use MCP tools to build Security Copilot agents in VS Code.

You'll complete the following tasks:

• Run the prompt

• Deploy the agent

• Test the agent

Run the prompt

Run the prompt to deploy the agent to autogenerate an agent YAML.

1. Enter the prompt as follows:

   Create an agent that generates a comprehensive post incident report from your Defender, Purview and Sentinel incidents. It aggregates incident summaries, detailed insights, entities, alerts, and provides actionable remediation steps.

2. The MCP toolstart_agent_creation is invoked. SelectAllow.

   

3. A second tool is invoked to get the evaluation result. SelectAllow again, but it might take up to a minute for the evaluation to finish.

4. You can prompt GitHub Copilot with, "Show me the agent YAML" to check for and retrieve the generated YAML.

5. Once GitHub Copilot returns the generated YAML, you can instruct to "Save it to a new .yaml file" so that you can view the created YAML in a file in your VS Code workspace. GitHub Copilot suggests edits to the file as you continue to prompt and iterate on your agent.

6. You can ask GitHub Copilot to refine the definition further, such as to add more tools or to tweak the agent instructions.

Deploy agent

1. Prompt GitHub Copilot to deploy your agent. Specify eitherUser orWorkspace scope. If you made manual edits to the agent definition, add that yaml file to the chat context first before prompting the deployment.

2. If you deploy to User scope, you can see your agent in custom plugins. If you deploy to Workspace scope, the agent is displayed in the Active agents view. The agent is deployed to Security Copilot standalone.

Test agent

1. Navigate to menuBuild in Security Copilot.

2. Select the cardCreate an agent.

   

3. Go to the top navigation bar and select the dropdown.

   

4. Search for your agent to edit.

5. The agent details are populated in the agent overview page.

6. Navigate to theTest tab and proceed with testing. SeeTest agent.