Skip to main content

18 - Copilot Extensions and Marketplace

Extend Copilot with Extensions and Skillsets from the Marketplace. MCP integration, third-party agents (Claude, Codex), and how to create your own custom extension.

What do you think about this article?

At a Glance

Extend Copilot with Extensions and Skillsets from the Marketplace. MCP integration, third-party agents (Claude, Codex), and how to create your own custom extension.

Copilot Extensions and Marketplace

GitHub Copilot is designed to be extensible. Through Copilot Extensions, it is possible to expand the AI assistant's capabilities with third-party integrations, custom tools, and specialized agents. Extensions allow you to connect Copilot to databases, cloud services, testing platforms, monitoring tools, and much more, transforming it into a centralized hub for the entire development workflow.

In this article we will explore the extensions ecosystem, the available types, how to integrate them into your workflow, and how to build custom extensions for your team's specific needs.

Complete Series Overview

#ArticleFocus
1Foundation and MindsetSetup and mindset
2Ideation and RequirementsFrom idea to MVP
3Backend ArchitectureAPI and database
4Frontend StructureOrganization and naming
5Prompt EngineeringPrompts and MCP Agents
6Testing and QualityUnit, integration, E2E
7DocumentationREADME, API docs, ADR
8Deploy and DevOpsDocker, CI/CD
9EvolutionScalability and maintenance
10Coding AgentAutonomous GitHub agent
11Code ReviewAutomated review
12Copilot Edits and Agent ModeMulti-file editing
13GitHub SparkNo-code micro-apps
14Copilot Spaces and MemoryShared context
15AI ModelsMulti-model and selection
16CustomizationInstructions and configuration
17Enterprise and BusinessPlans, analytics, policy
18You are here → Extensions and MarketplaceExtensions and integrations
19SecuritySecurity and compliance

Copilot Extensions Overview

Copilot Extensions are applications that extend the functionality of GitHub Copilot. They are available on the GitHub Marketplace and can be installed at both individual and organizational levels. Extensions integrate directly with Copilot Chat, allowing developers to interact with external tools without leaving their IDE or browser.

Extensions Architecture

Copilot Extensions are built as GitHub Apps, which ensures cross-platform compatibility and a robust authentication and authorization model. When a user invokes an extension through Copilot Chat, the request is routed through the GitHub infrastructure to the extension's endpoint, which processes the request and returns a response.

Copilot Extension Flow

StepActorActionDetail
1UserInvokes extension in chat@extension-name how can I...?
2GitHubAuthenticates the requestVerifies user and app permissions
3GitHubForwards to endpointHTTP POST to the extension server
4ExtensionProcesses the requestCalls external APIs, analyzes data
5ExtensionGenerates responseText, code, links, actions
6GitHubReturns responseFormatted in the Copilot chat

Types of Extensions

GitHub distinguishes two main types of extensions, each with different characteristics and implementation complexity.

Full Extensions (Agents)

  • Complete applications with server-side logic
  • Can call external APIs
  • Manage state and sessions
  • Support complex multi-step flows
  • Require their own hosting infrastructure
  • Greater flexibility and power
  • Development time: weeks/months

Skillsets (Lightweight)

  • Lightweight and task-specific extensions
  • Defined through configuration, minimal code
  • Focus on a single capability
  • Quick to build and deploy
  • No complex infrastructure required
  • Ideal for simple automations
  • Development time: hours/days

Skillsets: Lightweight Extensions

Skillsets are the simplest way to extend Copilot with custom functionality. They are ideal for specific and repetitive tasks that don't require complex logic. A skillset is essentially a tool definition that Copilot can use to respond to specific requests.

Skillset Structure

Skillset Definition - Database Query Helper
{
  "name": "db-query-helper",
  "description": "Helps developers write and optimize SQL queries for PostgreSQL",
  "version": "1.0.0",
  "skills": [
    {
      "name": "explain-query",
      "description": "Analyze and explain a SQL query step by step",
      "parameters": {
        "query": {
          "type": "string",
          "description": "The SQL query to analyze"
        },
        "database": {
          "type": "string",
          "description": "Target database type",
          "enum": ["postgresql", "mysql", "sqlite"],
          "default": "postgresql"
        }
      }
    },
    {
      "name": "optimize-query",
      "description": "Suggest optimizations for a SQL query including index recommendations",
      "parameters": {
        "query": {
          "type": "string",
          "description": "The SQL query to optimize"
        },
        "table_info": {
          "type": "string",
          "description": "Table schemas and current indexes"
        },
        "expected_rows": {
          "type": "number",
          "description": "Expected number of rows in result"
        }
      }
    },
    {
      "name": "generate-migration",
      "description": "Generate a database migration script from a description",
      "parameters": {
        "description": {
          "type": "string",
          "description": "Description of schema changes"
        },
        "format": {
          "type": "string",
          "description": "Migration format",
          "enum": ["flyway", "liquibase", "prisma", "raw-sql"],
          "default": "flyway"
        }
      }
    }
  ]
}

Use Cases for Skillsets

Common Skillsets for Development Teams

SkillsetFunctionTriggerOutput
Code FormatterFormats code according to company standards@formatter format this codeFormatted code + diff
Regex BuilderGenerates regex from natural description@regex validate Italian fiscal codeRegex pattern + test cases
API Mock GeneratorGenerates mock data from OpenAPI schema@mock generate 10 usersJSON with realistic data
Changelog WriterGenerates changelog from commit history@changelog since v2.1.0Formatted Markdown changelog
Dependency CheckerChecks for outdated and vulnerable dependencies@deps check this projectReport with versions and CVEs
i18n HelperGenerates translations for missing keys@i18n translate to ItalianJSON/YAML file with translations

GitHub Apps Integration

Full Copilot Extensions are built as GitHub Apps. This means they inherit the entire security, authentication, and authorization model of GitHub Apps, ensuring a secure and controllable integration.

Authentication and Authorization

Extensions Security Model

LevelMechanismDescription
App-levelJWT (JSON Web Token)Identifies the app itself to GitHub
Installation-levelInstallation Access TokenToken specific to the installation in the org
User-levelOAuth User Access TokenActions on behalf of the specific user
PermissionsGranular permissionsAccess only to necessary resources (repo, issues, PRs)
WebhooksHMAC-SHA256 signatureVerifies authenticity of received events

Required Permissions

Each extension declares the permissions it needs. The user or the organization admin must explicitly approve them before installation. The principle of least privilege should guide the choice of permissions.

GitHub App Manifest - Extension Permissions
{
  "name": "Copilot DB Assistant",
  "description": "Database query helper for Copilot Chat",
  "url": "https://db-assistant.example.com",
  "hook_attributes": {
    "url": "https://db-assistant.example.com/webhooks"
  },
  "redirect_url": "https://db-assistant.example.com/auth/callback",
  "public": true,
  "default_events": [
    "issues",
    "pull_request"
  ],
  "default_permissions": {
    "contents": "read",
    "issues": "write",
    "pull_requests": "read",
    "metadata": "read"
  },
  "copilot_agent": {
    "url": "https://db-assistant.example.com/copilot/agent",
    "description": "Helps with database queries and migrations"
  }
}

MCP Integration in the Extensions Context

The Model Context Protocol (MCP) is a complementary alternative to Copilot Extensions for connecting external tools to Copilot. While extensions follow the GitHub Apps model, MCP offers a standardized protocol for connecting tools and data sources.

GitHub MCP Registry

The GitHub MCP Registry is a curated discovery service for MCP servers. It works as a catalog that allows you to quickly find and install verified MCP servers, reducing the risk of insecure integrations.

Comparison: Extensions vs MCP Servers

AspectCopilot ExtensionsMCP Servers
PlatformGitHub MarketplaceMCP Registry + local configuration
AuthenticationGitHub OAuth / App tokensVaries (API key, OAuth, none)
HostingExternal server (cloud)Local (stdio) or remote (HTTP/SSE)
Setup complexityMedium (GitHub App)Low (config file)
Cross-platformAll Copilot environmentsPrimarily IDE (VS Code)
GovernanceGitHub Marketplace reviewUser/org responsibility
Use caseSaaS integrations, complex workflowsLocal tools, databases, file system
DistributionPublic (Marketplace)Private or public (Registry)

Toolsets: Grouping MCP Tools

Toolsets are a mechanism for grouping related MCP tools under a single namespace. This simplifies management when you have many active MCP servers simultaneously, allowing you to enable/disable groups of tools with a single operation.

.vscode/mcp.json - Configuration with Toolsets
{
  "servers": {
    "development-tools": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@dev-tools/mcp-server"],
      "toolsets": {
        "database": {
          "description": "Database management tools",
          "tools": ["query", "migrate", "seed", "backup"]
        },
        "testing": {
          "description": "Testing utilities",
          "tools": ["generate-test", "run-test", "coverage-report"]
        },
        "documentation": {
          "description": "Documentation generation",
          "tools": ["generate-docs", "update-readme", "create-adr"]
        }
      }
    },
    "cloud-services": {
      "type": "remote",
      "url": "https://cloud-mcp.example.com/sse",
      "toolsets": {
        "aws": {
          "description": "AWS service management",
          "tools": ["s3-upload", "lambda-deploy", "cloudwatch-logs"]
        },
        "monitoring": {
          "description": "Monitoring and alerting",
          "tools": ["check-health", "get-metrics", "create-alert"]
        }
      }
    }
  }
}

Third-Party Agents

One of the most significant evolutions of the Copilot ecosystem is the integration of third-party agents directly into the platform. These agents bring the capabilities of alternative AI models within the Copilot experience.

Available Agents

Third-Party Agents in Copilot

AgentProviderSpecializationAvailabilityModel
ClaudeAnthropicDeep code analysis, refactoring, documentationPro+ / EnterpriseClaude Sonnet 4
CodexOpenAICode generation, advanced completionsPro+ / EnterpriseCodex / o3-mini
GeminiGoogleMultimodal understanding, long contextPro+ / EnterpriseGemini 2.5 Pro

When to Use Each Agent

ScenarioRecommended AgentRationale
Legacy codebase refactoringClaudeExcellent at analyzing complex code and proposing gradual restructuring
Rapid boilerplate generationNative Copilot (GPT-4)Optimized for fast completions and scaffolding
UI screenshot analysisGeminiMultimodal understanding for analyzing interface images
Complex algorithmic debuggingCodex / o3-miniStrong in logical reasoning and algorithmic problem solving
Detailed technical documentationClaudeProduces high-quality technical text with long context
Framework migrationClaude or native CopilotDeep understanding of different framework patterns

Note on Availability

Third-party agents are currently in public preview and available only for Pro+ and Enterprise plans. Availability and specific models may change over time as new providers are integrated into the platform.

Using third-party agents consumes premium requests from your monthly budget. Requests to advanced models may consume more premium requests compared to requests to Copilot's base model.

Building Your Own Copilot Extension

If the extensions available on the Marketplace don't cover your team's specific needs, you can build your own Copilot Extension. The process requires creating a GitHub App with a server endpoint that handles Copilot requests.

Prerequisites

What You Need to Build an Extension

  • GitHub Account: With access to create GitHub Apps
  • Web server: To host the extension endpoint (Node.js, Python, Go, etc.)
  • HTTPS domain: The endpoint must be accessible via HTTPS
  • Knowledge of GitHub Apps API: To manage authentication and webhooks
  • Copilot Extensions SDK: Official SDK to simplify development

Extension Architecture

Extension Architecture - Text Diagram
# Copilot Extension Architecture

                    GitHub Infrastructure
                    +-------------------+
                    |                   |
  User in IDE ---> | Copilot Chat      |
  "@my-ext help"   | (message router)  |
                    |                   |
                    +--------+----------+
                             |
                    HTTP POST (authenticated)
                             |
                    +--------v----------+
                    |                   |
                    | Your Extension    |
                    | Server            |
                    |                   |
                    | +---------------+ |
                    | | Request       | |
                    | | Handler       | |
                    | +-------+-------+ |
                    |         |         |
                    | +-------v-------+ |
                    | | Business      | |
                    | | Logic         | |
                    | +-------+-------+ |
                    |         |         |
                    | +-------v-------+ |
                    | | External      | |
                    | | Services      | |
                    | | (DB, API,     | |
                    | |  tools)       | |
                    | +---------------+ |
                    |                   |
                    +--------+----------+
                             |
                    HTTP Response (streaming)
                             |
                    +--------v----------+
                    |                   |
                    | Copilot Chat      |
                    | (rendered to      |
                    |  user)            |
                    |                   |
                    +-------------------+

Basic Implementation with Node.js

server.ts - Extension Server (Node.js + Express)
import express from 'express';
import { Octokit } from '@octokit/rest';
import { createNodeMiddleware } from '@octokit/webhooks';
import { verifyRequestByKeyId } from '@copilot-extensions/preview-sdk';

const app = express();
app.use(express.json());

// Main endpoint for Copilot Chat
app.post('/copilot/agent', async (req, res) => {
  try {
    // 1. Verify request authenticity
    const signature = req.headers['github-public-key-signature'] as string;
    const keyId = req.headers['github-public-key-identifier'] as string;
    const body = JSON.stringify(req.body);

    const isValid = await verifyRequestByKeyId(body, signature, keyId, {
      token: process.env.GITHUB_TOKEN!
    });

    if (!isValid) {
      return res.status(401).json({ error: 'Invalid signature' });
    }

    // 2. Extract the user message
    const messages = req.body.messages;
    const lastMessage = messages[messages.length - 1];
    const userQuery = lastMessage.content;

    // 3. Process the request based on content
    const response = await processQuery(userQuery, req.body);

    // 4. Return response in streaming (SSE format)
    res.setHeader('Content-Type', 'text/event-stream');
    res.setHeader('Cache-Control', 'no-cache');
    res.setHeader('Connection', 'keep-alive');

    // Send the response as an event stream
    res.write(`data: ${JSON.stringify({
      choices: [{
        index: 0,
        delta: {
          role: 'assistant',
          content: response
        }
      }]
    })}\n\n`);

    res.write('data: [DONE]\n\n');
    res.end();

  } catch (error) {
    console.error('Extension error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

async function processQuery(
  query: string,
  context: any
): Promise<string> {
  // Custom extension logic
  // Here you can call databases, external APIs, etc.

  if (query.includes('status')) {
    return await getSystemStatus();
  }

  if (query.includes('deploy')) {
    return await getDeploymentInfo();
  }

  if (query.includes('metrics')) {
    return await getProjectMetrics();
  }

  return `Hello! I'm the team's custom extension.
I can help you with:
- **status**: Current service status
- **deploy**: Latest deployment information
- **metrics**: Project metrics

How can I help you?`;
}

async function getSystemStatus(): Promise<string> {
  // Example: call a health check endpoint
  const services = ['api', 'database', 'cache', 'queue'];
  const results = await Promise.all(
    services.map(async (service) => {
      try {
        const response = await fetch(
          `https://monitoring.example.com/health/${service}`
        );
        const data = await response.json();
        return `- **${service}**: ${data.status} (uptime: ${data.uptime})`;
      } catch {
        return `- **${service}**: UNREACHABLE`;
      }
    })
  );

  return `## System Status\n\n${results.join('\n')}`;
}

async function getDeploymentInfo(): Promise<string> {
  // Example: information from the latest deploy
  return `## Last Deployment
- **Version**: v2.4.1
- **Environment**: production
- **Time**: 2 hours ago
- **Status**: Successful
- **Deployed by**: CI/CD Pipeline
- **Commit**: abc1234`;
}

async function getProjectMetrics(): Promise<string> {
  // Example: metrics from the monitoring system
  return `## Project Metrics (Last 24h)
- **Requests**: 125,430
- **Error Rate**: 0.12%
- **p95 Latency**: 245ms
- **Active Users**: 3,421
- **CPU Usage**: 45%
- **Memory**: 62%`;
}

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Extension server running on port ${PORT}`);
});

Testing the Extension

test/extension.test.ts - Extension Tests
import request from 'supertest';
import { app } from '../server';

describe('Copilot Extension', () => {
  describe('POST /copilot/agent', () => {
    it('should respond to status query', async () => {
      const response = await request(app)
        .post('/copilot/agent')
        .set('Content-Type', 'application/json')
        .send({
          messages: [
            {
              role: 'user',
              content: 'What is the current status?'
            }
          ]
        });

      expect(response.status).toBe(200);
      expect(response.headers['content-type']).toContain('text/event-stream');
    });

    it('should handle unknown queries gracefully', async () => {
      const response = await request(app)
        .post('/copilot/agent')
        .send({
          messages: [
            {
              role: 'user',
              content: 'random question'
            }
          ]
        });

      expect(response.status).toBe(200);
      // Should return help message
    });

    it('should reject unauthenticated requests', async () => {
      // Test without proper GitHub signature headers
      const response = await request(app)
        .post('/copilot/agent')
        .set('github-public-key-signature', 'invalid')
        .set('github-public-key-identifier', 'invalid')
        .send({
          messages: [{ role: 'user', content: 'test' }]
        });

      expect(response.status).toBe(401);
    });
  });
});

Publishing on the Marketplace

Publishing Process

StepActionRequirementsEstimated Time
1Create GitHub AppGitHub account, HTTPS domain1 hour
2Implement endpointServer with Copilot Extensions SDK1-4 weeks
3Local testingPrivate app installation1-2 days
4DocumentationREADME, examples, API docs2-3 days
5Submit for reviewComplete Marketplace listing1 day
6GitHub reviewCompliance with guidelines3-10 days
7PublicationApproval obtainedImmediate

Popular Extension Categories

The GitHub Marketplace offers extensions organized by category. Here are the most popular categories and the types of extensions available.

Main Marketplace Categories

CategoryExamplesAdded Value
Code AnalysisLinter, security scanner, complexity analyzerIdentifies code quality and security issues
DatabaseQuery builder, schema visualizer, migration helperIntegrated database management in chat
Cloud & DevOpsAWS helper, Kubernetes manager, CI/CD statusCloud operations without leaving the IDE
TestingTest generator, coverage reporter, E2E runnerAccelerates test creation and execution
DocumentationAPI doc generator, diagram creator, README builderAutomatic and up-to-date documentation
Project ManagementJira integration, sprint planner, estimation helperConnection between code and project management
MonitoringSentry, DataDog, PagerDuty integrationsVisibility into errors and performance in chat
DesignFigma integration, color palette helper, icon finderBridge between design and implementation

Best Practices for Extension Development

Do

  • Fast responses (timeout < 30s)
  • Graceful error handling
  • Clear and complete documentation
  • Minimum necessary permissions
  • Structured logging for debugging
  • Internal rate limiting
  • Comprehensive automated tests
  • Semantic versioning
  • Respond in Markdown format
  • Suggest next steps to the user

Don't

  • Responses that are too long (> 4000 char)
  • Destructive operations without confirmation
  • Expose sensitive data in responses
  • Request unnecessary permissions
  • Ignore signature verification
  • Responses without context or structure
  • Unmaintained dependencies
  • Lack of clear error messages
  • Blocking synchronous API calls
  • Missing health check endpoint

Recommended Response Pattern

Extension responses should follow a consistent pattern to provide a uniform user experience. Here is the recommended format:

  1. Title: Clear heading describing the result
  2. Result: Requested data formatted in a readable way
  3. Context: Additional information useful for interpretation
  4. Next Steps: Suggestions for possible follow-up actions

Extension Security

Security is a priority when using or building extensions. Each extension has potential access to sensitive data and must be treated with the same care reserved for any third-party integration.

Security Checklist for Extensions

AreaCheckRisk if Ignored
AuthenticationAlways verify GitHub request signatureFraudulent requests processed
AuthorizationCheck user permissions before actingPrivilege escalation
Input validationValidate all input parametersInjection attacks
SecretsNever expose tokens/keys in responsesCredential leaks
Rate limitingImplement per-user and per-IP limitsDenial of service
LoggingLog without sensitive data (no PII, no tokens)Data breach via logs
HTTPSEncrypted communications onlyMan-in-the-middle attacks
DependenciesRegular dependency auditSupply chain attacks

Conclusion

The Copilot Extensions ecosystem transforms GitHub Copilot from an isolated coding assistant into a centralized hub for the entire development workflow. Whether connecting databases, cloud services, monitoring tools, or third-party AI agents, extensions allow you to bring all the necessary context directly into the conversation with Copilot.

For teams, extensions represent an opportunity to automate repetitive workflows and centralize information. For individual developers, they are a way to customize the Copilot experience with tools specific to their domain.

In the next and final article of the series, we will address the crucial topic of security and responsible use of Copilot, exploring built-in protections, data privacy guidelines, and best practices for ethical and secure use of AI in software development.

Series Progress

#ArticleStatus
1Foundation and Mindset✅
2Ideation and Requirements✅
3Backend Architecture✅
4Frontend Structure✅
5Prompt Engineering✅
6Testing and Quality✅
7Documentation✅
8Deploy and DevOps✅
9Evolution✅
10Coding Agent✅
11Code Review✅
12Copilot Edits and Agent Mode✅
13GitHub Spark✅
14Copilot Spaces and Memory✅
15AI Models✅
16Customization✅
17Enterprise and Business✅
18Extensions and Marketplace📍
19Security◻

Try These Tools

Free developer tools related to this topic.

Commenti

Caricamento commenti...

Sign in to comment

Discuss this article in the community

Join the Telegram group to discuss with other developers, ask questions and share your experiences.

Did you like this article?

Explore other content on the blog or discover my projects