25 - MCP in Copilot and Advanced Custom Instructions

{
  "[javascript]": {
    "editor.defaultFormatter": "esbenp.prettier-vscode"
  },
  "copilot.experimental.agentMode": true,
  "copilot.experimental.contextWindow": "extended"
}

{
  "mcpServers": {
    "filesystem": {
      "command": "node",
      "args": ["mcp-server-filesystem/index.js"],
      "disabled": false,
      "alwaysAllow": ["read", "list", "create"]
    },
    "github": {
      "command": "node",
      "args": ["mcp-server-github/index.js"],
      "env": {
        "GITHUB_TOKEN": "$GITHUB_TOKEN"
      },
      "disabled": false
    }
  }
}

Prompt: "Rileggi tutti i file TypeScript in src/ e segnala errori di type safety"

Copilot reasoning:
1. Utente chiede di leggere file TypeScript
2. Disponibili tool: [filesystem.read, filesystem.list, ...]
3. Esecuzione: filesystem.list("src/", pattern="*.ts") → 47 file
4. Per ogni file: filesystem.read("src/...") → analizza con TypeScript compiler
5. Segnala errori trovati

Output: "Trovati 3 type errors in src/components/ ..."

{
  "mcpServers": {
    "filesystem": {
      "command": "node",
      "args": ["path/to/mcp-server-filesystem.js"],
      "cwd": "${workspaceFolder}",
      "env": {
        "NODE_ENV": "production"
      },
      "disabled": false
    },
    "github": {
      "command": "node",
      "args": ["path/to/mcp-server-github.js"],
      "env": {
        "GITHUB_TOKEN": "${env:GITHUB_TOKEN}",
        "GITHUB_OWNER": "fedcal",
        "GITHUB_REPO": "PortfolioPersonaleAngular"
      },
      "disabled": false
    },
    "postgres": {
      "command": "node",
      "args": ["path/to/mcp-server-postgres.js"],
      "env": {
        "DATABASE_URL": "${env:DATABASE_URL}",
        "DB_USER": "${env:DB_USER}",
        "DB_PASSWORD": "${env:DB_PASSWORD}"
      },
      "disabled": false
    },
    "slack": {
      "command": "node",
      "args": ["path/to/mcp-server-slack.js"],
      "env": {
        "SLACK_BOT_TOKEN": "${env:SLACK_BOT_TOKEN}"
      },
      "disabled": false
    },
    "sentry": {
      "command": "python3",
      "args": ["-m", "mcp_server_sentry"],
      "env": {
        "SENTRY_AUTH_TOKEN": "${env:SENTRY_AUTH_TOKEN}",
        "SENTRY_ORG": "myorg",
        "SENTRY_PROJECT": "myproject"
      },
      "disabled": false
    }
  },
  "env": {
    "GITHUB_TOKEN": "ghp_xxxxx",
    "DATABASE_URL": "postgresql://user:pass@localhost:5432/mydb",
    "SLACK_BOT_TOKEN": "xoxb-xxxxx"
  }
}

~/.copilot/mcp.json  - Configurazione globale (tutti i progetti)

~/.copilot/mcp.json:
{
  "mcpServers": {
    "github": {
      "command": "node",
      "args": ["/usr/local/lib/mcp-server-github/index.js"],
      "env": {
        "GITHUB_TOKEN": "${env:GITHUB_TOKEN}"
      }
    },
    "filesystem": {
      "command": "node",
      "args": ["/usr/local/lib/mcp-server-filesystem/index.js"]
    }
  }
}

{
  "mcpServers": {
    "untrusted-thirdparty-tool": {
      "command": "node",
      "args": ["path/to/unknown-mcp-server.js"],
      "sandbox": {
        "enabled": true,
        "allowedPaths": [
          "${workspaceFolder}/src",
          "${workspaceFolder}/docs"
        ],
        "blockedPaths": [
          "${workspaceFolder}/.env",
          "${workspaceFolder}/.env.prod",
          "${HOME}/.ssh",
          "${HOME}/.aws"
        ],
        "allowedNetworkDomains": ["api.example.com"],
        "blockedNetworkDomains": ["*"]
      },
      "disabled": false
    },
    "trusted-postgres": {
      "command": "node",
      "args": ["mcp-server-postgres"],
      "sandbox": {
        "enabled": false
      }
    }
  }
}

== PRIMA (GitHub App Extension - DEPRECATA) ==
❌ github-app/manifest.json (OAuth setup complesso)
❌ Registrazione manuale in GitHub Marketplace
❌ Ogni editor supportava il protocollo diversamente
❌ Nessun sandbox, accesso non ristretto

== DOPO (MCP Server - NUOVO STANDARD) ==
✅ mcp.json con server command + args
✅ Zero registrazione GitHub, basta installare il package npm
✅ Funziona ovunque: VS Code, JetBrains, CLI, custom client
✅ Sandbox support on demand

== ESEMPIO: Migrazione Sentry Extension ==

Prima (GitHub App):
1. Registra GitHub App OAuth
2. Installa extension da Marketplace
3. Extension autentica con GitHub
4. Sentry API calls via OAuth token

Dopo (MCP):
1. npm install mcp-server-sentry
2. Aggiungi a .vscode/mcp.json o ~/.copilot/mcp.json:
   {
     "sentry": {
       "command": "node",
       "args": ["-m", "mcp_server_sentry"],
       "env": { "SENTRY_AUTH_TOKEN": "${env:SENTRY_AUTH_TOKEN}" }
     }
   }
3. Usa in Copilot Chat: "Mostra i 10 errori più recenti da Sentry"
4. MCP server chiama Sentry API con token

# Copilot Instructions for PortfolioPersonaleAngular Backend

## Architecture
- Follow Clean Architecture 4-layer pattern (domain, application, infrastructure, presentation)
- Domain layer: ZERO framework dependencies
- Application layer: orchestrate domain + infrastructure, implement use cases
- Infrastructure layer: implement domain ports, handle external integrations
- Presentation layer: REST controllers, error handling, DTOs

## Code Style
- Language: Java 21, Spring Boot 3.4
- Pattern: Records for DTOs (immutability first)
- Validation: use @Validated and custom validators
- Exception Handling: create domain exceptions, not generic RuntimeException

## Testing
- Framework: JUnit 5 + Mockito + Testcontainers
- Coverage: target 80%+ on business logic
- Test naming: method_givenContext_thenExpectation
- Integration tests use Testcontainers for PostgreSQL + Redis

## Database
- ORM: Spring Data JPA + Hibernate 6
- Migrations: Flyway (V001..VnNN pattern)
- Transactions: use @Transactional only on service layer
- Caching: @Cacheable on read-heavy queries

## API Design
- REST endpoints: /api/v1/resource
- DTOs: request/response separation
- Pagination: use Spring Data Page
- Error responses: standardized ErrorResponse envelope

## Security
- Authentication: JWT proprietario (HS256)
- Role hierarchy: GUEST < USER < PRO < MODERATOR < ADMIN < SUPER_ADMIN
- Rate limiting: Bucket4j via Redis
- CORS: whitelist federicocalo.dev + localhost dev

> getAll(
    @ParameterObject @PageableDefault(size = 20, sort = "id", direction = Sort.Direction.DESC) Pageable pageable
  ) {
    return ResponseEntity.ok(service.findAll(pageable));
  }

  @GetMapping("/{id}")
  public ResponseEntity<{ResourceName}Response> getById(@PathVariable Long id) {
    return ResponseEntity.ok(service.findById(id));
  }

  @PostMapping
  @ResponseStatus(HttpStatus.CREATED)
  public ResponseEntity<{ResourceName}Response> create(@Valid @RequestBody {ResourceName}Request request) {
    return ResponseEntity.status(HttpStatus.CREATED).body(service.create(request));
  }

  @PutMapping("/{id}")
  public ResponseEntity<{ResourceName}Response> update(
    @PathVariable Long id,
    @Valid @RequestBody {ResourceName}Request request
  ) {
    return ResponseEntity.ok(service.update(id, request));
  }

  @DeleteMapping("/{id}")
  @ResponseStatus(HttpStatus.NO_CONTENT)
  public void delete(@PathVariable Long id) {
    service.delete(id);
  }
}
\`\`\`

## Usage in Copilot
Type in chat: `@.prompt /generate-rest-controller ResourceName=User`

Copilot will:
1. Generate the controller class
2. Generate request/response DTOs
3. Create the service interface
4. Add unit test class

Copilot Chat prompt:
> @.prompt /generate-rest-controller ResourceName=Product Category=ProductCategory

Copilot interpretation:
1. Carica template .prompt.md "generate-rest-controller"
2. Sostituisce variabili: {ResourceName} → Product, {ResourceName}Response → ProductResponse
3. Executes template logic: genera controller, DTOs, service, test
4. Output: 4 file Java creati con codice completo

{
  "copilot.codeReviewAuto": true,
  "copilot.contextWindow": "extended",
  "copilot.customInstructions": {
    "languages": ["java", "typescript", "markdown"],
    "tone": "concise and technical",
    "targetAudience": "senior developers"
  },
  "copilot.disabledInComments": false,
  "copilot.inlineCompletions.enabled": true,
  "copilot.chat.runCommandWithSelection": true
}

name: security-reviewer
displayName: Security Reviewer
description: Analyzes code for security vulnerabilities and compliance issues

systemPrompt: |
  You are a security expert reviewing code for vulnerabilities.

  Your analysis focuses on:
  1. OWASP Top 10 vulnerabilities (SQL injection, XSS, CSRF, etc.)
  2. Authentication & authorization flaws
  3. Sensitive data exposure (credentials, PII)
  4. Insecure cryptography
  5. Access control misconfigurations

  Output format:
  - Severity: CRITICAL / HIGH / MEDIUM / LOW
  - CWE reference: link to CWE database
  - Vulnerability description
  - Proof of concept (if applicable)
  - Remediation steps

allowedTools:
  - filesystem:read    # Can read code files
  - filesystem:list    # Can list directories
  - github:searchCode  # Can search code in repo
  - github:getPullRequest # Can analyze PR diffs

restrictedTools:
  - filesystem:write   # Cannot modify code
  - filesystem:delete  # Cannot delete files
  - github:approve     # Cannot approve PRs (advisory only)

context:
  - "src/**/*.java"
  - "src/**/*.ts"
  - "backend/src/**/*"
  - "frontend/src/**/*"

ignorePatterns:
  - "node_modules/**"
  - "dist/**"
  - "*.lock"
  - "*.log"

Copilot Chat:
> @security-reviewer analyze src/main/java/dev/federicocalo/portfolio/presentation/controller/AuthController.java

Copilot behavior:
1. Carica agent "security-reviewer" da .github/agents/security-reviewer.yml
2. Applica systemPrompt
3. Usa SOLO tool in allowedTools (filesystem:read, github, ecc.)
4. Blocca tool in restrictedTools (filesystem:write)
5. Limita context a "src/**/*.java"
6. Output: security report dettagliato

Sample output:
---
🔴 CRITICAL: SQL Injection in AuthController.java:142
CWE-89: Improper Neutralization of Special Elements used in an SQL Command

Vulnerability:
String query = "SELECT * FROM users WHERE email = '" + email + "'";
This concatenates user input directly into SQL query.

Remediation:
Use parameterized queries (PreparedStatement):
String query = "SELECT * FROM users WHERE email = ?";
PreparedStatement ps = conn.prepareStatement(query);
ps.setString(1, email);

---
🟡 MEDIUM: Missing CSRF token validation in POST endpoints
CWE-352: Cross-Site Request Forgery (CSRF)

Recommendation:
Enable @EnableWebSecurity with .csrf(csrf -> csrf.disable()) removed.
Use @GetMapping for idempotent operations, @PostMapping for state changes.
---

#!/bin/bash
# Installa server MCP globali in ~/.local/bin/mcp/

mkdir -p ~/.local/bin/mcp
cd ~/.local/bin/mcp

# 1. Node.js-based servers
npm install -g mcp-server-filesystem
npm install -g mcp-server-github
npm install -g mcp-server-postgres
npm install -g mcp-server-slack
npm install -g mcp-server-mongodb
npm install -g mcp-server-docker
npm install -g mcp-server-aws

# 2. Python-based servers (optional)
pip install mcp-server-sentry

# Verifica installazione
which mcp-server-filesystem
which mcp-server-github
which mcp-server-postgres

#!/usr/bin/env python3
import json
import asyncio
from typing import Any
from mcp.server import Server
from mcp.types import Tool, TextContent, ToolResult

# Custom CRM API client
class CRMClient:
    def __init__(self, api_key: str, base_url: str = "https://api.mycrm.com"):
        self.api_key = api_key
        self.base_url = base_url

    async def search_customers(self, query: str) -> list[dict]:
        """Search customers by name, email, or phone"""
        # Mock implementation (replace with real API calls)
        return [
            {"id": "cust_123", "name": "Acme Corp", "email": "contact@acme.com"},
            {"id": "cust_456", "name": "TechCorp Ltd", "email": "sales@techcorp.com"}
        ]

    async def get_customer_history(self, customer_id: str) -> dict:
        """Get order history and interactions"""
        return {
            "customer_id": customer_id,
            "orders": [{"id": "ord_001", "date": "2024-01-15", "amount": 2500}],
            "interactions": [
                {"type": "email", "date": "2024-04-20", "subject": "Renewal discussion"}
            ]
        }

    async def create_opportunity(self, customer_id: str, deal_value: float, description: str) -> dict:
        """Create new sales opportunity"""
        return {
            "opp_id": "opp_789",
            "customer_id": customer_id,
            "deal_value": deal_value,
            "description": description,
            "status": "open"
        }

# Initialize MCP server
mcp = Server("crm-server")
crm = CRMClient(api_key="$CRMAPIKEY")  # Load from env

# Register tools
@mcp.tool()
async def search_customers(query: str) -> ToolResult:
    """Search for customers in the CRM by name, email, or phone number"""
    results = await crm.search_customers(query)
    return ToolResult(
        content=[TextContent(type="text", text=json.dumps(results, indent=2))],
        is_error=False
    )

@mcp.tool()
async def get_customer_history(customer_id: str) -> ToolResult:
    """Get complete customer history: orders, interactions, notes"""
    history = await crm.get_customer_history(customer_id)
    return ToolResult(
        content=[TextContent(type="text", text=json.dumps(history, indent=2))],
        is_error=False
    )

@mcp.tool()
async def create_opportunity(customer_id: str, deal_value: float, description: str) -> ToolResult:
    """Create a new sales opportunity for a customer"""
    opp = await crm.create_opportunity(customer_id, deal_value, description)
    return ToolResult(
        content=[TextContent(type="text", text=json.dumps(opp, indent=2))],
        is_error=False
    )

if __name__ == "__main__":
    mcp.run()

{
  "mcpServers": {
    "crm": {
      "command": "python3",
      "args": ["/path/to/mcp_server_crm.py"],
      "env": {
        "CRMAPIKEY": "${env:CRM_API_KEY}",
        "CRM_BASE_URL": "https://api.mycompany.crm"
      },
      "disabled": false
    }
  }
}

Copilot Chat:
> @mcp-crm Cerca clienti "Acme" e mostra loro cronologia ordini

Copilot behavior:
1. Invoca tool search_customers("Acme")
2. Riceve [cust_123, cust_456]
3. Invoca get_customer_history("cust_123")
4. Riceve order + interaction history
5. Formatta risposta

Output:
---
Ho trovato 2 clienti Acme:

1. **Acme Corp** (cust_123)
   Email: contact@acme.com
   Ordini recenti:
   - Ord_001: 25 gennaio 2024 - €2.500
   Ultime interazioni:
   - Email: 20 aprile 2024 - "Renewal discussion"

2. **TechCorp Ltd** (cust_456)
   ...
---

{
  "mcpServers": {
    "postgres-prod": {
      "command": "node",
      "args": ["/usr/local/lib/mcp-server-postgres-secure.js"],
      "env": {
        "DATABASE_URL": "${env:DATABASE_URL}",
        "DB_USER": "${env:DB_USER}",
        "DB_PASSWORD": "${env:DB_PASSWORD}",
        "ALLOWED_TABLES": "users,orders,payments",
        "ALLOW_WRITES": "false",
        "ALLOW_DELETES": "false",
        "MAX_ROWS_PER_QUERY": "1000"
      },
      "sandbox": {
        "enabled": true,
        "allowedNetworkDomains": ["database.internal.mycompany.com"],
        "blockedNetworkDomains": ["*"]
      }
    },
    "untrusted-third-party": {
      "command": "node",
      "args": ["some-unknown-mcp-server"],
      "sandbox": {
        "enabled": true,
        "allowedPaths": ["${workspaceFolder}/public"],
        "blockedPaths": ["${workspaceFolder}/.env*", "${HOME}/.ssh"]
      }
    }
  }
}