Integrating MCP Servers with VS Code Copilot: A Complete Guide

A Developer's Journey into the Model Context Protocol

Hey there! 👋

I want to share something exciting I've been working on that completely changed how I interact with my development tools. You know those moments when you're deep in code and need to quickly check if a server port is open, or verify an SSL certificate is valid? Usually, you'd switch to your terminal, run some commands, maybe google the right openssl syntax (because who memorizes that?), and then piece together the results.

What if your AI assistant could just... do that for you?

That's exactly what I built with SimplePortChecker MCP — a bridge that lets GitHub Copilot perform real security assessments, right in VS Code. And the best part? It took just 6 lines of configuration.

Let me show you what I learned along the way.

⚡ Quick Start (TL;DR)

For VS Code Users:

1. Create .vscode/mcp.json:

   {
     "servers": {
       "simplePortChecker": {
         "type": "sse",
         "url": "https://mcp.simpleportchecker.com/mcp"
       }
     }
   }

2. Restart VS Code

3. Open Copilot Chat and ask: Check if google.com has port 443 open

That's it! No installation required. The server is public and ready to use.

---

🤔 First, Let's Talk About MCP (Model Context Protocol)

If you haven't heard of MCP yet, you're in for a treat. It's an open standard from Anthropic that's quietly revolutionizing how we think about AI assistants.

Here's the lightbulb moment for me:

Remember when APIs revolutionized software development? Before APIs, if you wanted to integrate with a payment system or a mapping service, you'd have to build everything from scratch. APIs gave us a standardized way for systems to talk to each other.

MCP does the same thing for AI assistants.

The Problem MCP Solves

Think about your typical workflow with an AI coding assistant:

1. You ask Copilot something like: "Is port 443 open on google.com?"

2. Copilot might generate a command: nc -zv google.com 443

3. You copy that command

4. Switch to your terminal

5. Run it

6. Copy the results back

7. Ask Copilot to interpret them

Sound familiar? It's like having a brilliant assistant who can't use a phone — they can tell you what to say, but you have to make the call yourself.

Enter MCP: Giving AI Assistants "Hands"

MCP changes the game completely. With MCP, your AI assistant can:

• ✅ Actually run security scans, not just suggest commands

• ✅ Fetch real-time data from live systems

• ✅ Interact with APIs and external services directly

• ✅ Return structured results that it can interpret and act on

• ✅ Chain multiple operations to accomplish complex tasks

It's like upgrading your assistant from "consultant" to "doer."

Why This Matters for Developers

Before MCP:

You: "Check if my API is behind a CDN"
Copilot: "Here's a curl command you can run..."
You: [switches to terminal, runs command, copies output]
You: "Here's the output: [paste]"
Copilot: "Yes, looks like Cloudflare"

With MCP:

You: "Check if my API is behind a CDN"
Copilot: [runs scan automatically]
Copilot: "Yes, Cloudflare detected with high confidence. Here's what I found..."

No context switching. No copy-pasting. No friction.

This is the future we're building towards, and it's available today.

🚀 Building SimplePortChecker MCP: What It Does

So here's what I built. SimplePortChecker MCP is a production MCP server that brings comprehensive network security tools directly into your AI assistant's toolbelt.

The Vision: What if checking a server's security posture was as easy as asking a colleague?

Instead of this old workflow:

# Port scan
nmap google.com -p 443

# Check for WAF
curl -I https://google.com | grep -i cloudflare

# Certificate info
openssl s_client -connect google.com:443 -servername google.com </dev/null 2>/dev/null | openssl x509 -text

# ... interpret all this yourself ...

You now just ask:

"Run a security scan on google.com"

And Copilot does everything, interprets the results, and gives you a clean summary. Magic? No, just MCP.

🛠️ The Toolbox: 6 Security Tools

I built these tools based on what I found myself doing repeatedly during development and security reviews:

1. Port Scanning Check if specific ports are open — the foundation of any security assessment.

2. L7 Protection Detection Ever wonder if a site is behind Cloudflare, AWS WAF, or Akamai? This detects it automatically with confidence scores.

3. SSL/TLS Certificate Analysis Validates certificates, checks expiration dates, and lists SANs. No more memorizing openssl commands!

4. Mutual TLS (mTLS) Verification Detects if a server requires client certificates — crucial for enterprise security.

5. Azure AD Hybrid Identity Detection Discovers ADFS and federation configurations for Microsoft authentication setups.

6. Full Security Scan Runs all checks in sequence and gives you a comprehensive security posture report.

🎯 The Public Server

Here's something cool: I'm hosting this publicly at:

https://mcp.simpleportchecker.com

No API keys. No authentication. No installation. Just add it to your config and start using it.

Why? Because I believe security tools should be accessible. If this helps even one developer catch a security issue faster, it's worth it.

💡 Smart Prompts: Teaching the AI Common Patterns

One thing I learned while building this: just having tools isn't enough. The AI needs to know when and how to use them.

So I built in 5 intelligent prompts that guide Copilot through common security workflows:

1. Quick Security Scan "I need a fast security overview"

• Scans common ports (80, 443, 22, etc.)

• Checks for WAF/CDN protection

• Validates SSL certificates

• Perfect for rapid assessments

2. Certificate Health Check "When does this cert expire?"

• Deep dive into SSL/TLS configuration

• Expiration warnings

• SAN validation

• Great for monitoring production services

3. Compliance Assessment "Is this server configured securely?"

• Security best practices check

• Compliance verification

• Risk assessment

4. Troubleshoot Connection Issues "Why can't I connect to this server?"

• Port accessibility checks

• Service detection

• Firewall/network diagnostics

5. Hybrid Identity Discovery "Is this using Azure AD?"

• ADFS detection

• Federation configuration analysis

• Enterprise authentication insights

These prompts make Copilot feel less like a tool and more like a colleague who knows what you're trying to accomplish.

⚙️ Getting Started: Your First 5 Minutes with MCP

Alright, enough theory. Let's get this running! I promise this is easier than configuring your first Docker container.

The Magic Configuration (Seriously, That's It)

VS Code 1.102+ introduced a dedicated mcp.json file for MCP servers. Here's all you need:

Step 1: Create MCP Configuration File

Create a new file at .vscode/mcp.json in your workspace or user settings folder:

For Workspace Configuration (recommended):

1. Create .vscode/mcp.json in your project root

2. Add this configuration:

{
  "servers": {
    "simplePortChecker": {
      "type": "sse",
      "url": "https://mcp.simpleportchecker.com/mcp"
    }
  }
}

For User Configuration (applies to all projects):

1. Press Cmd+Shift+P (macOS) or Ctrl+Shift+P (Windows/Linux)

2. Type: MCP: Open User Configuration

3. Add the same configuration above

Step 2: Quick Settings Check (Optional, but Recommended)

Make sure MCP access is enabled in your settings.json:

{
  "chat.mcp.access": "all"
}

Pro tip: You can also set this to "registry" to only allow official MCP servers, or "none" to disable MCP entirely. I keep mine on "all" for maximum flexibility during development.

Step 3: Restart VS Code

This is the "turn it off and on again" step. Close all VS Code windows and reopen.

Step 4: The Moment of Truth — Verify It Works

Open the Command Palette (Cmd+Shift+P or Ctrl+Shift+P) and type:

MCP: List Servers

You should see simplePortChecker listed. Click on it to peek at all the available tools. Feels good, doesn't it? 😊

Step 5: Take It for a Spin!

Open Copilot Chat (Ctrl+Cmd+I or Cmd+I) and let's do something cool:

Check if google.com has port 443 open

Watch the magic happen. Copilot will:

1. Recognize it needs the scan_ports tool

2. Ask for your approval (security first!)

3. Run the actual scan on the MCP server

4. Parse the results

5. Give you a clean, human-readable answer

First time seeing this work feels amazing. Trust me, I still get a little thrill every time.

Is cloudflare.com behind a WAF?

Analyze the SSL certificate for github.com

Check if microsoft.com has Azure AD Hybrid Identity configured

You can also explicitly reference MCP tools using the # symbol:

#scan_ports google.com

#full_security_scan cloudflare.com

🔧 Using MCP Commands

VS Code provides several commands to manage MCP servers:

• MCP: List Servers - View all configured MCP servers and their status

• MCP: Browse Resources - Explore resources provided by MCP servers

• MCP: Reset Cached Tools - Clear cached tool definitions and refresh

• MCP: Reset Trust - Reset trust settings for MCP servers

• MCP: Open User Configuration - Open user-level mcp.json

• MCP: Open Workspace Folder Configuration - Open workspace mcp.json

🎯 Using MCP Tools in Agent Mode

In agent mode (the default), Copilot automatically selects and invokes MCP tools as needed:

1. Open Copilot Chat

2. Simply ask questions naturally - Copilot will use the right tools automatically

3. Review and approve tool invocations when prompted

Example:

You: "Run a security scan on api.github.com"

Copilot: I'll use the full_security_scan tool...
[Shows tool invocation prompt - click Approve]
[Returns comprehensive security assessment]

🔄 How It Works: MCP Integration Flow

Here's how the MCP integration works when you ask Copilot to perform a security scan:

Key Components:

1. VS Code - Your development environment with MCP configuration

2. GitHub Copilot - AI assistant that decides when to use tools

3. MCP Server - Remote server at https://mcp.simpleportchecker.com

4. Target Host - The system being scanned (e.g., google.com)

The Flow:

1. User Query → You ask a natural language question

2. Tool Selection → Copilot determines which MCP tool to use

3. Approval → VS Code prompts you to approve the tool invocation

4. Execution → MCP server performs the actual security scan

5. Results → Structured data is returned and interpreted by Copilot

6. Response → You get a clear, actionable answer

This architecture keeps the heavy lifting on the server side while giving you a seamless, conversational experience in your editor!

🔧 Understanding the MCP Configuration

Let's break down what the mcp.json configuration does:

{
  "servers": {
    "simplePortChecker": {        // Server name (use camelCase)
      "type": "sse",               // Connection type: Server-Sent Events
      "url": "https://mcp.simpleportchecker.com/mcp"  // Remote server URL
    }
  }
}

Configuration Options

Server Types:

• "sse" - Server-Sent Events (used for HTTP streaming, like our server)

• "http" - Standard HTTP (VS Code tries HTTP stream, falls back to SSE)

• "stdio" - Standard Input/Output (for local servers)

For Remote Servers (like SimplePortChecker):

{
  "type": "sse",  // or "http"
  "url": "https://mcp.simpleportchecker.com/mcp"
}

For Local Servers:

{
  "type": "stdio",
  "command": "python",
  "args": ["path/to/mcp_server.py", "stdio"],
  "env": {
    "SOME_VAR": "value"
  }
}

🐛 Troubleshooting

Server Not Appearing in VS Code?

1. Check MCP access setting:

   {
     "chat.mcp.access": "all"
   }

2. Verify configuration file location:

   • Workspace: .vscode/mcp.json in project root

   • User: Use MCP: Open User Configuration command

3. Restart VS Code completely:

   • Close all windows

   • Reopen VS Code

   • Check MCP: List Servers again

4. Check the output log:

   • Open MCP: List Servers

   • Select your server

   • Click Show Output to see connection errors

Tools Not Working?

1. Clear cached tools:

   • Run command: MCP: Reset Cached Tools

   • Restart the MCP server from the server list

2. Test server connectivity:

   curl -X POST https://mcp.simpleportchecker.com/mcp \
     -H "Content-Type: application/json" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","method":"tools/list","id":1}'

   Should return a list of available tools.

3. Check tool approval settings:

   • VS Code prompts you to approve tool usage

   • Make sure you're clicking "Approve" when prompted

   • Check if tools are enabled in the Chat view tools picker

"Cannot have more than 128 tools per request" Error?

This happens when too many tools are selected:

1. Click the Tools button in Chat view

2. Deselect some tools or entire MCP servers

3. Or ensure virtual tools are enabled (default in VS Code 1.102+)

Trust Prompt Issues?

When you first start an MCP server, VS Code asks you to trust it:

1. Review the server configuration carefully

2. Click the link to view server details

3. Only trust servers from sources you know

Reset trust settings:

MCP: Reset Trust

Configuration Format Changed?

VS Code 1.102+ introduced a new MCP configuration format:

❌ Old Format (deprecated):

// settings.json
{
  "github.copilot.chat.mcp.enabled": true,
  "github.copilot.chat.mcp.servers": { ... }
}

✅ New Format (current):

// .vscode/mcp.json
{
  "servers": { ... }
}

If you're using an older VS Code version, you may need the old format. Check your VS Code version: Code > About Visual Studio Code

Real-World Stories: How I Actually Use This

Let me share some real scenarios where this tool saved my bacon (and sanity).

Story #1: The 3 AM Certificate Expiration

The Situation: I'm deploying a new microservice to production. It's late, I'm tired, and I just want to make sure the SSL cert is valid.

Old Way:

# Me, googling "openssl check certificate expiration" for the 100th time
openssl s_client -connect api.example.com:443 -servername api.example.com </dev/null 2>/dev/null | openssl x509 -noout -dates
# Squint at output, do mental math on dates...

New Way:

Me: "Check when the SSL certificate for api.example.com expires"

Copilot: Certificate expires in 231 days (2025-12-15). 
Issuer: Let's Encrypt. All looks good! ✅

Result: Deployed with confidence. Got to bed before 4 AM. Win.

Story #2: The Mystery of the Slow API

The Situation: Users reporting our API is slow. Is it us? Is it the CDN? Is it DNS? Who knows?

Old Way: Open multiple tabs, run various tools, piece together information from different sources, spend 20 minutes investigating.

New Way:

Me: "Run a full security scan on api.myapp.com"

Copilot: 
✅ Port 443: OPEN
✅ Cloudflare detected (high confidence)
✅ Certificate valid, expires in 89 days
✅ mTLS not required
✅ Response time: 2.1s

Found: You're behind Cloudflare. Check your origin server performance 
and Cloudflare dashboard for any rate limiting.

Result: Identified it was a Cloudflare rate limit in seconds. Fixed the issue before it became a real problem.

Story #3: Enterprise Client Integration

The Situation: Integrating with a large enterprise client. They mention "ADFS" and "hybrid identity" and I nod knowingly while internally panicking.

Old Way: Schedule a meeting, ask their IT team for documentation, wait 3 days for a response.

New Way:

Me: "Does enterprise-client.com use Azure AD Hybrid Identity?"

Copilot: Yes! Detected ADFS configuration:
- Federation Server: sts.enterprise-client.com
- Type: Active Directory Federation Services  
- Authentication URL: https://sts.enterprise-client.com/adfs/ls/

Result: Had the information I needed immediately. Integration conversation was productive instead of full of questions.

Story #4: "Is It Just Me?"

The Situation: Can't connect to a service. Is the port closed? Is my VPN acting up? Am I losing my mind?

Old Way: Try different tools, ask in Slack "anyone else having issues?", feel embarrassed if it's just me.

New Way:

Me: "Check if api.service.com port 8080 is accessible"

Copilot: Port 8080 is FILTERED. 
This typically indicates a firewall is blocking the connection.
Port 443 is OPEN though - try using HTTPS instead.

Result: Saved face. Switched to HTTPS. Moved on with life.

🎨 Using Built-in Prompts

The MCP server includes intelligent prompts that guide Copilot to perform structured assessments:

Example 1: Quick Security Scan

You: "Quick security scan on cloudflare.com"

Copilot will automatically:
1. Scan common ports (80, 443, 22, 8080)
2. Detect L7 protection services
3. Analyze SSL certificate if HTTPS is available
4. Provide a comprehensive summary

Example 2: Hybrid Identity Discovery

You: "Investigate hybrid identity for microsoft.com"

Copilot will:
1. Check for Azure AD tenant information
2. Identify federation type
3. Detect authentication URLs
4. Assess hybrid identity setup

🔒 Security & Privacy

• No Data Stored: All scans are performed in real-time; no data is cached or logged

• Public Information Only: The tools only check publicly available information

• Read-Only: No modifications are made to any target systems

• Rate Limited: Reasonable rate limits prevent abuse

🌟 Why This is Game-Changing

Before MCP:

# You had to manually run commands
$ nmap google.com -p 443
$ curl -I https://google.com
$ openssl s_client -connect google.com:443
# Then copy results back to your AI conversation

With SimplePortChecker MCP:

You: "Check if google.com has port 443 open"
# Copilot does everything automatically and gives you results!

The difference?

• ⚡ 10x faster - No context switching

• 🎯 More accurate - AI interprets results correctly

• 🔄 Iterative - Can ask follow-up questions instantly

• 📊 Better insights - AI can correlate findings across multiple scans

🚀 Getting Started Today

3 Simple Steps:

1. Create .vscode/mcp.json in your project root with:

   {
     "servers": {
       "simplePortChecker": {
         "type": "sse",
         "url": "https://mcp.simpleportchecker.com/mcp"
       }
     }
   }

2. Restart VS Code completely

3. Open Copilot Chat (Ctrl+Cmd+I or Cmd+I) and start asking!

That's it! No installation, no API keys, no complex setup. The public MCP server at https://mcp.simpleportchecker.com is ready and waiting.

💡 Pro Tips from the Trenches

Here are some tricks I've learned that make this even more powerful:

1. Be Explicit When You Need Speed

Agent mode is smart, but sometimes it's faster to directly call tools:

#scan_ports github.com
#analyze_certificate google.com
#full_security_scan cloudflare.com

The # prefix tells Copilot exactly which tool you want. No ambiguity, instant results.

2. Chain Investigations Like Sherlock Holmes

Don't ask one thing at a time. Ask for everything:

Check port 443 on github.com, analyze its certificate, 
detect if it's behind a CDN, and tell me if mTLS is required

Copilot will orchestrate all the checks and give you a comprehensive report. It's like having a junior DevOps engineer who never gets tired.

3. Generate Monitoring Scripts

This blew my mind when I discovered it:

Create a Python script that checks certificate expiry for these domains: 
api.example.com, www.example.com, cdn.example.com, and emails me 
if any expire within 30 days

Create a script that checks certificate expiry for these domains: api.example.com, www.example.com, cdn.example.com

Copilot will actually use the MCP tools to check those certificates FIRST, then write the script based on real data. Mind = blown.

### 4. Pre-Production Security Checks
Before deploying? Make it a habit:

Run a full security scan on staging-api.mycompany.com 
and tell me if there are any security concerns

Think of it as a pre-flight checklist, but automated and smart.

5. Explore All the Tools

Don't just use what you know. Discover what's available:

• Command Palette → MCP: List Servers

• Click simplePortChecker

• Browse all 6 tools and their descriptions

You might find something perfect for a problem you didn't even know you had.

6. Use MCP Resources (Advanced)

Access cached results and structured data:

• MCP: Browse Resources

• Pick a resource type

• Add to chat context

This is great for building on previous scans without repeating work.

💭 Reflections: Why This Matters

I've been coding for several years, and I've seen a lot of "revolutionary" tools come and go. Most are incremental improvements dressed up as breakthroughs.

MCP feels different.

It's not just making AI assistants slightly better at generating code. It's fundamentally changing the relationship between developers and their tools. We're moving from:

"AI that suggests" → "AI that does"

This shift is profound. When your AI assistant can:

• Actually run security scans

• Fetch real-time data

• Interact with live systems

• Chain multiple operations

• Learn from the results

...it stops being a smart autocomplete and becomes a genuine collaborator.

The Bigger Picture

SimplePortChecker is just one example. Imagine MCP servers for:

• 🗄️ Database queries and schema analysis

• ☁️ Cloud infrastructure management

• 📊 Log analysis and debugging

• 🔍 Code repository insights

• 📈 Performance monitoring

• 🔐 Secret management

The ecosystem is just getting started, and we're already seeing amazing possibilities.

An Invitation

If this blog post inspired you, I'd love to see what you build. MCP is an open standard — anyone can create a server. Got a workflow that involves switching between your editor and another tool? That's a perfect candidate for an MCP server.

The code for SimplePortChecker MCP is open source. Learn from it, improve it, build your own. Let's make development better together.

---

🔗 Try It Yourself

Ready to get started? Here's everything you need:

• 🌐 Public MCP Server: Available for demonstration purposes

• 📖 MCP Protocol Docs: https://modelcontextprotocol.io

• 💻 Source Code: Private repository for security reasons

Quick Start Reminder:

1. Create .vscode/mcp.json with the config from above

2. Restart VS Code

3. Ask Copilot: "Check if google.com has port 443 open"

4. Watch the magic happen ✨

---

💬 Let's Connect

Built something cool with MCP? Found a clever use case I didn't mention? Hit a snag and need help?

I'd love to hear from you!

• Drop a comment below

• Open an issue on GitHub

• Share your MCP servers with the community

The future of AI-assisted development is being built right now, and you're part of it.

What will you build with MCP? 🚀

---

Thanks for reading! If this helped you, consider sharing it with your team. The more developers discover MCP, the better the ecosystem becomes for everyone.

— Happy coding! 🎉