Copilot Code Review not using copilot-setup-steps.yml and ignoring MCP

[FSchmidt-Altus]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

Copilot Code Review

Body

I am trying to connect an MCP to Copilot Code Review (copilot-pull-request-reviewer). But I cannot get it to work.

I got the MCP working in Agent mode.

But during PR review it ignores the /.github/workflows/copilot-setup-steps.yml file.
During session init (Setting up environment) it lists the configured MCP server. But in the verbose logs during Processing Request it then logs:

MCP server "ado" has no allowed tools after filtering — omitting from config

It also ignores the COPILOT_AGENT_DEBUG setting.

If I disable the organisation policy 'Copilot code review' > 'Opt in to preview features' the filtering message disappears and also the Setting up environment in the session view.

Also my custom /.github/workflows/copilot-setup-steps.yml is never used for Code review.

The organisation setting Allow repositories to customize the runner type is active and working for agent mode, but is ignored for code review.

No idea how to troubleshoot this further.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[sanalkr]

I am having the same isssue where all tools of my custom MCP server is getting filtered out
MCP server "" has no allowed tools after filtering — omitting from config.

In the View Session of coppilot review, I can see the tools for the MCP server were loaded at start. But it seems it was filtered out later, having no effect on the review..=

[leonli-xero]

I ran into the same issue and wanted to share what fixed it for me.

From what I observed, my MCP configuration works as expected in the GitHub Copilot agent environment, but not in GitHub Copilot code review. In code review, the MCP server connects successfully, but the tools exposed by the server are filtered out and therefore aren’t available during review.

After comparing the two environments, it looks like the code review environment is more restrictive. In particular, COPILOT_MCP_READ_ONLY_MODE=true is present there. Based on that, my current assumption is that GitHub Copilot code review only loads or exposes MCP tools that are explicitly marked as read-only.

To test that, I added

"annotations": {
    "readOnlyHint": true
}

to the relevant tools exposed by our MCP server so they were explicitly advertised as read-only. After that change, the issue was resolved.

So my current theory is that the root cause is related to how GitHub Copilot code review determines whether an MCP tool is safe to invoke. I haven’t found any official documentation confirming this yet, so this is still an inference based on observed behavior rather than a documented GitHub guarantee.

[sanalkr]

Yes, eventually realised that. I had to annotate the tools in our mcp server with readonly for it to work.
Once the read only operations were correctly annotated, it started working.

[AlekSi]

https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-environment says:

Copilot code review also runs in an ephemeral development environment, and you can customize it in the same ways described in this article. By default, Copilot code review reuses your copilot-setup-steps.yml file

But yeah, that does not happen

[FSchmidt-Altus]

Looks like the message about omitting a tool has disappeared but the behaviour stayed. Making the tracking of this issue (why is a MCP not used) even harder - as if it was easy before.