Comma

Share what Copilot produced

Copilot's agent mode is good at the jobs that end in a document rather than a diff: work out why the build got 40% slower, review this PR against our security checklist, list every place we still call the deprecated endpoint.

Then the answer sits in a chat panel docked to the right of your editor. The person who needs it is a security reviewer with no repo access, or a PM, or the customer who asked. None of them are getting a VS Code window.

Register the server, then set the rule

Workspace MCP config lives in .vscode/mcp.json — the exact block is in VS Code setup, with the token from API tokens. Committing it means every contributor gets the same tool without a setup doc.

Then put the standing instruction where Copilot always reads it, .github/copilot-instructions.md:

When you produce a document rather than a change — a review, an audit, an
investigation, a comparison — publish it to Comma as an HTML report and reply
with the URL. Do not paste the document into chat.

Now "review this PR against the security checklist" ends in a link that the security reviewer can open, annotate and hand back.

The cloud agent is a workflow step

The GitHub-side coding agent works in pull requests, so the honest integration there is not MCP — it is one step in the workflow that already runs:

- name: Publish the review
  run: |
    curl -sS -X POST https://commareports.com/api/v1/reports \
      -H "Authorization: Bearer ${{ secrets.COMMA_TOKEN }}" \
      -H "Content-Type: application/json" \
      --data @report.json

The URL goes in the PR body, and the review conversation happens on the document instead of scattered across file comments. See GitHub Actions reports.

Why the panel is the wrong final resting place

  • It renders properly. The comparison table you got in chat stays a table.
  • No licence required to read. The audience for a security review is wider than the set of Copilot seats.
  • Feedback anchors. A reviewer highlights the specific finding they disagree with — see commenting on HTML.
  • Chat panels are ephemeral. Reports have addresses and revision history; a chat thread has neither once you close the window.

Worth knowing

  • Scope the token down to reports:write — see scoped tokens.
  • 5 MB per report body.
  • Snapshots, not dashboards. Nothing re-runs when someone opens the page.

Try it

Free — unlimited reports, commenters and revisions.

Set up VS Code →

Related