# Connect Ondes PRO to Visual Studio Code (GitHub Copilot)

> Connect Ondes PRO to Visual Studio Code and GitHub Copilot agent mode: a .vscode/mcp.json file, OAuth or a key hidden behind inputs, and real examples.

Updated on 2026-10-21 · The Ondes PRO team · https://ondes.pro/en/integrations/mcp/clients/visual-studio-code

In Visual Studio Code, MCP servers are used by **GitHub Copilot agent mode**. Declare your Ondes PRO workspace in `.vscode/mcp.json` and Copilot can look up your resources’ documentation, validate a request without writing anything and answer from your live data — all without leaving the editor.

## Add the Ondes PRO MCP server to VS Code

You need VS Code with GitHub Copilot enabled. In an organisation, the Copilot admin may have turned MCP servers off: if nothing shows up, check that first.

1. **Create the workspace file** — At the root of the open folder, create `.vscode/mcp.json`. You can also run “MCP: Add Server” from the Command Palette and pick an HTTP server: VS Code writes the file for you.
2. **Declare the server under servers** — Careful: VS Code does not use the `mcpServers` key other editors use, but `servers`, with a `type` field set to `http` for a remote server.

```json
{
  "servers": {
    "ondes": { "type": "http", "url": "https://your-workspace.ondes.pro/mcp/" }
  }
}
```
3. **Start the server** — Above the declaration, VS Code shows a “Start” action. On first start it asks you to confirm you trust this server, then to authorise the connection: a window from your Ondes PRO workspace opens, you sign in and approve the consent screen.
4. **Switch chat to agent mode** — Open Copilot Chat and pick **Agent** mode. The tools button lists the `ondes` server’s tools: you can untick some of them — keep the documentation tools and drop the ones that write, for instance.
5. **Ask something tied to your code** — For example: “Which events can I receive when a Kanban card is created?”. Copilot shows every tool call and waits for your approval before running it.

## Copy-ready .vscode/mcp.json

The OAuth form holds no secret. The key form stores the key in plain text: prefer the `inputs` variant just below.

Where to set it up : The workspace’s `.vscode/mcp.json` file (GitHub Copilot agent mode).

**OAuth connection (recommended)** (.vscode/mcp.json)

```json
{
  "servers": {
    "ondes": {
      "type": "http",
      "url": "https://your-workspace.ondes.pro/mcp/"
    }
  }
}
```

**API key connection** (.vscode/mcp.json)

```json
{
  "servers": {
    "ondes": {
      "type": "http",
      "url": "https://your-workspace.ondes.pro/mcp/",
      "headers": {
        "Authorization": "ApiKey opk_…"
      }
    }
  }
}
```

_Standard MCP compatible. Vendor documentation : https://code.visualstudio.com/docs/agents/reference/mcp-configuration_

## Hide the API key with inputs

If you use an API key — for a connection limited to one module, read-only for example — do not write it into the file. VS Code’s `inputs` array prompts for the value on first start, keeps it in the editor’s secure storage and substitutes it for `${input:ondes-cle}`. The file can then be committed safely.

```json
{
  "inputs": [
    {
      "type": "promptString",
      "id": "ondes-cle",
      "description": "Ondes PRO API key (opk_…)",
      "password": true
    }
  ],
  "servers": {
    "ondes": {
      "type": "http",
      "url": "https://your-workspace.ondes.pro/mcp/",
      "headers": { "Authorization": "ApiKey ${input:ondes-cle}" }
    }
  }
}
```

Create the key under **API & Developers → API keys**: it is shown only once.

## Workspace configuration or user configuration?

`.vscode/mcp.json` lives in the project folder. That is the right home for an integration repository: the whole team shares the declaration, and each person authorises with their own Ondes PRO account — their own permissions, and their own entry in the workspace’s MCP tab.

To have Ondes PRO in every folder, VS Code also offers a user configuration (“MCP: Open User Configuration”), in the same format. It follows your VS Code profile and, if enabled, Settings Sync across machines. Each machine is still a separate connection on the Ondes PRO side.

## Example: subscribing Atelier Lumen’s production tool to new cards

_Example conversation · demo data (Atelier Lumen)_

> **You** : Write the webhook receiver in `src/hooks.ts` for newly created Kanban cards, and subscribe `https://atelier.lumen-interne.fr/hooks` on the Ondes PRO side.
>
> 🔧 `ondes_chercher` Term “webhook”: the `developer/abonnements` resource and the guide section on signatures.
>
> 🔧 `ondes_appeler` `GET developer/abonnements/catalogue/` — the `kanban.cartes.cree` event exists.
>
> 🔧 `ondes_appeler` `POST developer/abonnements` with `simuler: true` — readable refusal: the origin `https://atelier.lumen-interne.fr` is not declared in the workspace configuration.
>
> **Assistant** : The receiver is written: it checks the `Ondes-Signature` header (HMAC-SHA256 of the timestamp and body) first, then fetches the card by its `id`, since the payload only carries the object’s identity. The subscription itself was not created: an admin first needs to declare your tool’s origin in the workspace configuration. I will retry afterwards — the signing secret is only displayed at that moment.

## Good habits with Copilot and Ondes PRO

- Keep the six documentation tools on: they only read your workspace’s guide and inventory, nothing changes.
- Before a write, ask for a dry run: `ondes_appeler` with `simuler: true` validates the request body without saving anything.
- On resources with a test twin (orders, video meetings, email sends, invitations), writes go to test mode by default, and the response says so.
- Never commit a key: use `inputs` or OAuth, never a plain value in `.vscode/mcp.json`.
- If Copilot suggests an unknown endpoint, ask it to check with `ondes_impossible`: the tool lists what the API deliberately does not do.

## Going further

- [Build an integration](https://ondes.pro/en/integrations/mcp/guides/build-an-integration) — Scoped keys, signed webhooks, idempotency and test mode for a back office that never creates duplicates.
- [REST API v1](https://ondes.pro/en/integrations/rest-api) — Around 135 REST resources, scoped keys, an OpenAPI schema and signed webhooks.
- [Kanban](https://ondes.pro/en/integrations/mcp/modules/kanban) — Your AI assistant creates, moves and comments on cards, and your teammates see it happen live.
- [MCP server security](https://ondes.pro/en/integrations/mcp/security) — OAuth 2.1, short-lived tokens, instant revocation and write safeguards: what your IT team needs to know.

## Frequently asked questions

### How do I add an MCP server in VS Code?

Create `.vscode/mcp.json` and declare the server under the `servers` key with `"type": "http"` and its address in `url` — for Ondes PRO, `https://<your-workspace>.ondes.pro/mcp/`. The “MCP: Add Server” command does the same step by step.

### Do I need GitHub Copilot to use an MCP server in VS Code?

Yes: in VS Code, GitHub Copilot’s agent features are what call MCP tools. In an organisation, the Copilot policy must allow MCP servers.

### How do I keep my API key out of mcp.json?

Use OAuth, which needs no key. If you need a key, declare a `promptString` input with `"password": true` and reference it as `${input:…}`: VS Code asks for the value once and stores it securely.

### Why doesn’t VS Code pick up my server under mcpServers?

Because VS Code expects the `servers` key, not `mcpServers` as in Cursor or Cline. Pasting another editor’s configuration without renaming that key is the most common mistake.

### Can Copilot change my company’s data?

Only with your permissions and with your approval, call by call. On the Ondes PRO side, writes go to test mode when the resource has one, a dry run validates without writing, and the built-in assistant proposes its changes as a plan to confirm.

### Has the Ondes PRO team tested VS Code?

No. GitHub Copilot’s agent mode speaks standard MCP over HTTP, which is what our server uses, so a `type: http` entry should be enough. Only Claude has been verified end to end by our team; VS Code menus shift between releases, so its documentation is the reference.