power-platform-mcp-connector-suite

Define the connector name, tools, resources, and authentication, then generate apiDefinition.swagger.json with the x-ms-agentic-protocol: mcp-streamable-1.0 header, apiProperties.json, and a script.csx handling JSON-RPC 2.0. Validate with paconn before uploading via pac CLI.

Copilot Studio currently supports MCP Tools, which are functions the LLM calls with user approval, and Resources, which must be delivered as tool outputs. MCP Prompts are not yet supported, so plan templates for future compatibility.

Tools are filtered when schemas use reference types ($ref) or multi-type arrays like ["string", "number"]. Replace them with primitive single types such as string, number, integer, boolean, array, or object, and ensure all endpoints use full URIs.

Run paconn validate --api-def apiDefinition.swagger.json to check the definition, then use pac connector create or update, which automatically validates script.csx during upload. For certification, also run ConnectorPackageValidator.ps1 and complete settings.json metadata.

Implement OAuth 2.0 enhanced with MCP security practices, including token audience validation to prevent passthrough attacks, secure state parameters against CSRF, HTTPS-only endpoints, and custom validation logic in script.csx to mitigate confused deputy attacks.