Copilot Studio MCP and Dome

1. 01

   Register an agent and issue its key

   One Dome agent for each Copilot Studio agent you want to tell apart.

   $ dome agents register --name helpdesk-copilot --gateway prod-gateway
   $ dome agents create-key helpdesk-copilot --name copilot-studio
   $ dome rules apply helpdesk-copilot.cedar --agent helpdesk-copilot --name jira-helpdesk

2. 02

   Copy the Gateway's MCP URL

   It's endpoints.mcp_url in the output. Copilot Studio supports the Streamable HTTP transport, and so does the Gateway.

   $ dome gateways get prod-gateway --json

3. 03

   Add the Gateway in Copilot Studio

   On the agent's Tools page, choose Add a tool, New tool, then Model Context Protocol. Enter the URL, pick API key, type Header, header name Authorization. When you create the connection, enter Bearer followed by the agent key.

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Microsoft Copilot Studio itself, see Microsoft's documentation.

permit (principal, action == Dome::Action::"mcp:discover", resource);
 
permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "atlassian" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "atlassian" }
unless {
  ["searchJiraIssuesUsingJql", "getJiraIssue", "createJiraIssue", "getConfluenceContent"]
    .contains(resource.tool_name)
};