Configure Canvas Mcp

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 8075ef5705c5 · 18 Oct 2026Report an issue or request a re-scan

• Publishermicrosoft GitHub organizationOwner of the repository this skill is read from
• Source foldermicrosoft/power-platform-skills/plugins/canvas-apps/skills/configure-canvas-mcpThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict8075ef5705c5A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Configure the Canvas Authoring MCP server for the current coauthoring session. USE WHEN "configure MCP", "set up MCP server", "MCP not working", "connect Canvas Apps MCP", "canvas-authoring not available", "MCP not…

---
name: configure-canvas-mcp
version: 2.1.0
description: Configure the Canvas Authoring MCP server for the current coauthoring session. USE WHEN "configure MCP", "set up MCP server", "MCP not working", "connect Canvas Apps MCP", "canvas-authoring not available", "MCP not configured", "set up canvas apps".
author: Microsoft Corporation
user-invocable: true
allowed-tools: Bash, AskUserQuestion, mcp__canvas-authoring__connect
---

# Configure the Canvas Authoring MCP Server

This skill configures the Canvas Authoring MCP server for the user's current Power Apps coauthoring session. The MCP server is auto-registered by the plugin — this skill connects it to a specific app session.

## Instructions

### 1. Ask for the studio URL

Ask the user:

> What is the URL of your canvas app studio session?
>
> Copy the URL from the browser address bar while your app is open in Power Apps Designer (it should look like `https://make.powerapps.com/e/Default-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/canvas/?action=edit&app-id=...`).
>
> Make sure coauthoring is enabled in the app (Settings → Updates → Coauthoring).
>
> **Keep this browser tab open for the entire session.** The MCP server communicates with Power Apps through the coauthoring session tied to that tab. Closing the tab ends the coauthoring session, which prevents `compile_canvas` and `sync_canvas` from working and means you can't see or save generated changes.

### 2. Extract parameters from the URL

Parse the following from the studio URL:

- **ENV_ID**: the path segment between `/e/` and the next `/` (e.g. `Default-91bee3d9-0c15-4f17-8624-c92bb8b36ead`).
- **APP_ID**: URL-decode the `app-id` query parameter value, then take the last segment after the final `/` (e.g. `6fc3e3d1-292b-4281-8826-577f78512e56`)
- **MAKER_HOSTNAME**: the hostname of the URL (e.g. `make.powerapps.com`)
- **ENVIRONMENT_CATEGORY**: determined from MAKER_HOSTNAME (see table below)

**Determine ENVIRONMENT_CATEGORY from MAKER_HOSTNAME:**

| MAKER_HOSTNAME               | ENVIRONMENT_CATEGORY |
| ---------------------------- | -------------------- |
| `make.powerapps.com`         | `prod`               |
| `make.preview.powerapps.com` | `prod`               |
| `make.preprod.powerapps.com` | `preprod`            |
| `make.gov.powerapps.us`      | `gov`                |
| `make.high.powerapps.us`     | `high`               |
| `make.apps.appsplatform.us`  | `dod`                |
| `make.powerapps.cn`          | `china`              |
| Any other hostname           | `test`               |

**Example:**

Example URL: `https://make.powerapps.com/e/Default-91bee3d9-0c15-4f17-8624-c92bb8b36ead/canvas/?action=edit&app-id=%2Fproviders%2FMicrosoft.PowerApps%2Fapps%2F6fc3e3d1-292b-4281-8826-577f78512e56`

- ENV_ID → `Default-91bee3d9-0c15-4f17-8624-c92bb8b36ead`
- APP_ID → `6fc3e3d1-292b-4281-8826-577f78512e56`
- MAKER_HOSTNAME → `make.powerapps.com`
- ENVIRONMENT_CATEGORY → `prod`

### 3. Configure the MCP server

Call the `connect` MCP tool to connect the server to the user's coauthoring session:

```
mcp__canvas-authoring__connect(
  environment_id: ENV_ID,
  app_id: APP_ID,
  environment_category: ENVIRONMENT_CATEGORY,
  // Optional — include only if the user has expressed a preference or a prior sign-in failed (see below):
  auth_flow: "broker" | "browser" | "devicecode",
  login_hint: "[email protected]",
  tenant_id: "00000000-0000-0000-0000-000000000000",
  force_account_select: true
)
```

**Optional parameters — do NOT prompt the user for these.** Only include them if the user has already expressed a preference earlier in the conversation, or if a prior connect attempt failed:

- `login_hint`: Pass the user's UPN or email **only if** they have indicated they want to connect as a specific/different user (e.g. "log in as [email protected]"). These values cannot be derived from the maker portal URL — never guess. Omit otherwise to use the first signed-in user. When reconnecting to switch environment/app, reuse the same `login_hint` value as the previous successful connect (if known) so the same user is reused without re-prompting.
- `auth_flow`: Pass `"browser"`, `"broker"`, or `"devicecode"` **only if** the user has explicitly stated a preferred auth flow (e.g. "use browser sign-in"). Use `"devicecode"` on headless/SSH hosts where neither broker nor browser flow can pop a UI — the verification URL and user code are surfaced via an MCP elicitation request and require a client that supports elicitation. Omit otherwise to use the default.
- `tenant_id`: Pass a tenant GUID **only** for Entra B2B guest access — set it to the host/resource tenant where the user is a guest so the token is issued by that tenant rather than the user's home tenant. Combine with `login_hint` (the guest's home UPN) to pre-fill the account. Omit for normal same-tenant sign-in.
- `force_account_select`: Pass `true` **only** to force the account picker instead of silently reusing a cached account — set this when a previous connect failed with a 401/403 and no `login_hint` was given, so the user can pick the correct account. Omit otherwise.

If the `mcp__canvas-authoring__connect` tool is **not available** (the MCP server did not start), run the following command to check whether the server failed to launch due to a missing .NET 10 SDK:

```bash
dotnet --list-sdks
```

If a version 10.x.y or higher is **not** listed, tell the user:

> ⚠️ .NET 10 SDK is required to run the Canvas Authoring MCP server. It looks like you don't have it installed. Please install it from https://dotnet.microsoft.com/download/dotnet/10.0 and then try again.

If the tool is available but the call returns an error, report the error and suggest checking that:

1. The studio URL is correct and the browser tab is still open
2. Coauthoring is enabled in the app settings
3. If sign-in failed, the user may need to specify `auth_flow` (`broker`, `browser`, or `devicecode`) or a `login_hint` (UPN/email) to authenticate as the correct account

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/microsoft/power-platform-skills
git -C power-platform-skills checkout 8075ef5705c5

Works in

1. 2026-10-18
   ✓SAFE B 89 / 100

   first audit · source 8075ef5705c5

Questions about Configure Canvas Mcp

• github.com/microsoft/power-platform-skills/tree/main/plugins/can — the audited source at commit 8075ef5705c5 and every finding aboveObserved · 18 Oct 2026

Spotted something wrong? Report a correction · Methodology