Connect VS Code and GitHub Copilot to the Safeguard MCP server

VS Code connects to remote MCP servers natively, so no extension is needed. Add an entry to .vscode/mcp.json with type http and the URL https://mcp.safeguard.sh/mcp, then sign in to Safeguard in the browser window VS Code opens on first connection. Safeguard's documentation lists this under its Copilot guide.

Workspace or user configuration

You have two places for the entry. The file .vscode/mcp.json in a workspace applies to that workspace. Running the command MCP: Open User Configuration from the command palette adds it for every workspace you open.

Choose the user configuration if the entry is for you alone. Choose the workspace file if you want teammates who open the repository to see the same server.

The entry

{
  "servers": {
    "safeguard": {
      "type": "http",
      "url": "https://mcp.safeguard.sh/mcp"
    }
  }
}

Note that VS Code uses the key servers, not mcpServers. Copying a Cursor snippet into a VS Code file is a common reason the server does not load.

First connection

On the first connection VS Code opens a browser window. Sign in to Safeguard, check the app name and the host the page says the authorization code will be sent to, then click Authorize access. You need a Safeguard account first, created at app.safeguard.sh.

After that, your Copilot agent can call the Safeguard tools your workspace has enabled. The assistant acts as you, so it sees only what your Safeguard role allows.

Using an MCP key instead

OAuth is the recommended route. If you must send a fixed header, create a key of the type MCP key under Settings, then Developer, in Safeguard. In VS Code that goes in a headers object on the server entry. Put it in your user configuration, not in a workspace file you commit. A key acts as the member who created it.

Copilot Studio is different

Safeguard's guide also covers Copilot Studio. There you open the MCP connector configuration, add a remote Streamable HTTP server with the same URL, and complete OAuth if the connector supports it. If the connector can only send a fixed header, use an MCP key. Reload Copilot afterwards.

Troubleshooting

If the server connects but shows few tools, that is by design. A new Safeguard workspace starts with six read-only tools. An administrator enables the rest per tool. See why only six tools show up.

If a tool is rejected, the error says it is not enabled for this tenant. See the fix for that error.

Related: our guide to what a VS Code extension can do is useful context when you review anything that runs next to your code. Safeguard also ships VS Code and JetBrains extensions, listed on safeguard.sh/download.

Quick check

Sources

• Safeguard docs: Microsoft Copilot and GitHub Copilot in VS Code
• Safeguard docs: MCP integrations overview

Last reviewed: 19 October 2026.