# Use LightHouse in GitHub Copilot

> Add LightHouse's hosted MCP server to GitHub Copilot in Visual Studio Code, and sign in with your own LightHouse identity.

GitHub Copilot in Visual Studio Code reaches LightHouse as a remote MCP server. In agent mode, Copilot can call LightHouse’s tools: your agents and their runs, usage and cost, and knowledge retrieval from your own sources. Each call runs as you, under your role in LightHouse and the scopes you approve.

**Copilot licences are not used to run Atlantic’s agents.** Copilot calls LightHouse’s tools over MCP. The agents and the retrieval behind those tools run on your deployment, on the model providers your organisation has connected to LightHouse. Copilot’s own model answers in the editor; it is never a model backend for an Atlantic agent.

## Before you start

- **The hosted endpoint is on for your platform.** The address below answers only where Atlantic has turned the hosted endpoint on ([Availability](/mcp/connect/#availability)).
- **Your tenant ID**: the first label of your portal’s address, beginning `t-`.
- **Visual Studio Code with GitHub Copilot**, signed in, with agent mode available.
- **MCP servers are allowed for your Copilot plan.** On Copilot Business and Copilot Enterprise, an administrator enables the **MCP servers in Copilot** policy for the organisation or enterprise. If the policy is off, VS Code does not start the server.

## Add the server

Add LightHouse to an `mcp.json` file: the workspace’s `.vscode/mcp.json` to share it with a project, or your user profile’s `mcp.json` (command **MCP: Open User Configuration**) to use it in every workspace.

```json
{
  "servers": {
    "lighthouse": {
      "type": "http",
      "url": "https://mcp.atlanticagenticlabs.com/t/<tenant id>/mcp"
    }
  }
}
```

Replace `<tenant id>` with your own. The file holds no key, token or secret, so it is safe to commit.

Alternatively, run **MCP: Add Server** from the Command Palette, choose **HTTP**, paste the address above and name the server `lighthouse`.

## Sign in

1. Start the server: select **Start** above the server’s entry in `mcp.json`, or open the tools picker in the Chat view.
2. VS Code asks whether the server may authenticate. Select **Allow**.
3. Your browser opens your portal’s approval page, `https://<tenant id>.atlanticagenticlabs.com/oauth/authorize`. Sign in through your identity provider if your portal asks you to.
4. Review the request and select **Approve**. The browser hands the answer back to VS Code.

VS Code keeps the token in its own secret storage and renews it while it is in use. Nothing is copied by hand.

- **VS Code**: GitHub Copilot, agent mode
- **MCP endpoint**: LightHouse, hosted
- **Tenant portal**: at the tenant's address
- **Person**: signed in through the identity provider

Discovery and registration

1. VS Code to MCP endpoint: **First request, no token**
2. MCP endpoint to VS Code: **Refused, naming where to sign in**. the endpoint's protected-resource document names the portal
3. VS Code to Tenant portal: **Register**. dynamic registration: an identifier, no secret

Approval

4. VS Code to Tenant portal: **Open the approval page**. with a PKCE challenge (S256)
5. Tenant portal to Person: **Who is asking, where the answer goes, each scope**. after sign-in with a second factor
6. Person to Tenant portal: **Approve**. recorded in the tenant's audit log
7. Tenant portal to VS Code: **A single-use code**. bound to the client and its redirect
8. VS Code to Tenant portal: **Code and verifier for a token**. one tenant, one person, the approved scopes

Use

9. VS Code to MCP endpoint: **Tool call, with the token**. read-only tools
10. MCP endpoint: **Checked, then audited**. scope and role checked before the tool runs; each knowledge read audited to the person

VS Code discovers the tenant's portal from the endpoint, registers by dynamic client registration without a secret, and opens the portal's approval page for the person. Each tool call then runs as that person, under their role and approved scopes, and is audited.

## What you see on the approval page

- **Who is asking.** When the answer is sent through `https://vscode.dev/redirect`, LightHouse recognises the client by that address and names it **Visual Studio Code**. When VS Code receives the answer directly on your computer, the page says the answer goes to an application on this computer, and shows the name the client gave itself. Approve only if you started the sign-in yourself, just now.
- **Where the answer goes**, as an address.
- **What it may read**, one sentence per scope. VS Code asks for `telemetry:read`, `agents:read` and `knowledge:read`, which cover the agents and retrieval tools. `knowledge:read` reaches records only if you hold the `content_viewer` role.

If you decline, VS Code is told `access_denied` and stops waiting.

## Use the tools

1. Open the Chat view and select **Agent** mode.
2. Open the tools picker. The LightHouse tools are listed under `lighthouse`; clear any you do not want Copilot to use.
3. Ask in plain language, for example “Which of our agents failed most often this week?” or “Search our knowledge bases for the current release procedure.”

Copilot asks before it runs a tool, unless you have allowed that tool for the session. Every tool reads only: none approves, pays, deploys or changes a limit ([Read only, deliberately](/mcp/#read-only-deliberately)).

## What is audited

The integration changes nothing about what LightHouse records. Each request is checked and recorded exactly as for any other MCP client:

- **The approval.** Your approval or decline is written to your tenant’s audit log, with the client’s name and the scopes approved.
- **Each knowledge read.** Every `knowledge` tool call is audited as a content read by you.
- **Each refusal.** A sign-in refused because your access has been withdrawn is audited.
- **The token’s use.** **Settings → Keys → Signed-in tools** shows the token, its scopes and when it was last used.

## Revoke access

In your portal, open **Settings → Keys → Signed-in tools** and revoke the token. VS Code’s next request is refused, and VS Code asks you to sign in again. Withdrawing a person’s access in LightHouse stops their token at once.

## If it does not connect

| What you see                                           | What it means                                                                                                                                         |
| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| VS Code reports that the server failed to start        | The hosted endpoint is not on for your platform ([Availability](/mcp/connect/#availability)), or the MCP servers policy is off for your Copilot plan. |
| The approval page says the request cannot be completed | The address in `mcp.json` names another tenant, or the sign-in expired. Start it again from VS Code.                                                  |
| A tool answers `scope_required`                        | The token was not approved for that tool’s scope. Revoke it and sign in again, approving the scope ([Scopes, per tool](/mcp/#scopes-per-tool)).       |
| A tool answers that your role does not allow it        | The tool needs a role you do not hold, such as `client_admin` for billing.                                                                            |

See also [Connect a client](/mcp/connect/) and [MCP security](/security/mcp/).

Source: https://docs.atlanticagenticlabs.com/mcp/github-copilot/