How to Add Web Search to GitHub Copilot With the You.com MCP Server

TLDR: GitHub Copilot can search the web through Bing when you use the @github participant with #web and an administrator or your own settings allow it, but that is a policy-gated chat feature. To give Copilot a search tool you configure yourself, add the You.com MCP server to a .mcp.json file. The keyless free profile covers testing, an API key lifts the limit, and the same file works in VS Code and Copilot CLI.

Models write code from training data that stops at a cutoff, so version-sensitive work needs live sources. GitHub already ships some web access, and an MCP server adds another route. This guide covers what Copilot searches with out of the box, where an MCP search tool fits, and the config, key handling, and quiet failures for VS Code and Copilot CLI. For other MCP clients, see our MCP server setup guide.

Does GitHub Copilot already have web search?

In parts, yes. GitHub's chat documentation says that including @github in a Copilot Chat question gives access to GitHub skills, and that adding the #web variable invokes a web search, for example @github #web What is the latest LTS of Node.js? According to GitHub's responsible use documentation, that search uses Bing, and in VS Code and Visual Studio it works only if your administrator enables it. The Bing query is generated from your prompt plus context and is governed by Microsoft's privacy statement.

For individual subscribers, GitHub's policy page says the web search setting, Copilot access to Bing, is disabled by default. On github.com, a February 25, 2026 changelog entry added model-native web search for certain models in public preview, with Bing still used for other models and a setting to opt out.

The picture inside VS Code agent tools is narrower. The tools reference lists #web/fetch, which fetches a page you name, inside a #web tool set, and it lists no web search tool. Available references depend on your harness and extensions, so type # in your chat to see what your build offers. Because GitHub's docs use #web for search and VS Code's reference uses it for a tool set, run one test query in your own build before you assume which one answers.

When is an MCP search tool worth adding?

Bing-backed search is a chat feature that policy switches on. An MCP server is a tool you add to the agent's own tool list, with its own parameters and its own key. Three situations favor it:

• You want the same search in VS Code and Copilot CLI. One .mcp.json file serves both, as the sections below show.
• You want control over the query. The You.com search tool takes count, freshness, and domain exclusions, and it understands site: and filetype: operators written into the query.
• You want to see what ran. VS Code lets you expand a tool call in the conversation to inspect its input and output, so a reviewer can check the query and the pages behind a claim.

Policy applies to both routes. VS Code's guide says organizations can manage MCP server access centrally through GitHub policies, and Copilot CLI honors an organization's registry URL and allowlist. If your administrator blocks MCP servers, ask before you configure anything.

How do you add the You.com MCP server to VS Code?

VS Code reads MCP servers from several places, per its MCP server guide. The portable format is a .mcp.json file at the workspace root with a top-level mcpServers object, and it works across compatible tools. VS Code's own format is .vscode/mcp.json with a top-level servers object, which the guide describes as deprecated for new servers. For a server you want in every workspace, run MCP: Open User Configuration.

{
  "mcpServers": {
    "you-com": {
      "type": "http",
      "url": "https://api.you.com/mcp?profile=free"
    }
  }
}

The server lives at api.you.com/mcp, and the profile=free parameter selects the keyless profile, which exposes the you-search and you-discover tools at 100 queries per day, per the You.com MCP documentation. Save the file at the repository root and open a chat in Agent mode. VS Code's tools guide describes two session types. In the Local harness, the Configure Tools button in the chat input lists the server's tools and lets you toggle them. In the Copilot harness, the Agent Customizations editor has a Tools tab for the same job. Then ask something that depends on this month's information, such as what changed in a library's latest release.

How should you handle the API key?

The free profile exposes only you-search and you-discover. With an API key, the /mcp endpoint adds you-contents and you-balance, and the key goes in an Authorization header. VS Code's guide says not to hardcode keys and to use input variables or environment files instead. In VS Code's own format, define an input and reference it from the header:

{
  "inputs": [
    {
      "type": "promptString",
      "id": "ydc-key",
      "description": "You.com API key",
      "password": true
    }
  ],
  "servers": {
    "you-com": {
      "type": "http",
      "url": "https://api.you.com/mcp",
      "headers": {
        "Authorization": "Bearer ${input:ydc-key}"
      }
    }
  }
}

VS Code prompts for the value the first time the server starts and stores it, according to its configuration reference. That convenience has a limit. The MCP guide says sessions on the Agent Host read the portable files natively, and VS Code forwards .vscode/mcp.json servers to it except those that require interactive input such as ${input:...} variables. If your team works in those sessions, an input-variable server will not be forwarded, so test in the session type you use. For stdio servers, VS Code supports envFile, and You.com's local package, started with npx @youdotcom-oss/mcp, reads YDC_API_KEY from its environment.

Whichever route you pick, keep the key out of the file you commit. A literal Bearer token in .mcp.json travels with the repository, and the checker later in this guide flags it.

Does the same setup work in Copilot CLI?

Largely, yes. GitHub's Copilot CLI documentation says the CLI loads project-level MCP configuration from .mcp.json, searching from your working directory up to the repository root, and from .github/mcp.json for a shared file committed to the repository. If both exist in one directory, .mcp.json takes precedence. Project-level files load only after you confirm folder trust. The same page says the CLI does not read .vscode/mcp.json, because that file uses the top-level key servers.

So the free-profile .mcp.json above works in both tools. To add the server to your user configuration instead, use the copilot mcp add subcommand, which writes ~/.copilot/mcp-config.json. Your shell expands the variable in the second command, so the key lands in your home directory and not in the repository.

# keyless, user-level
copilot mcp add --transport http you-com "https://api.you.com/mcp?profile=free"

# or, with a key
copilot mcp add --transport http --header "Authorization: Bearer $YDC_API_KEY" you-com https://api.you.com/mcp

You.com also publishes a Copilot CLI plugin that installs four skills and MCP servers that sign in with your You.com account over OAuth, per its Copilot CLI page. Inside a session, /mcp lists the servers and their status. If you added the server by hand before installing the plugin, remove the manual entry with /mcp delete you-com, or you will see duplicate tools.

copilot plugin marketplace add youdotcom-oss/agent-skills
copilot plugin install you@you-com

What should Copilot search for, and what can it control?

According to the MCP documentation, the model can set query, count, freshness, offset, exclude_domains, page-extraction settings, knowledge, and safesearch on the you-search tool. Inline operators in the query, including site:, lang:, loc:, and filetype:, map to the same underlying parameters. Country, language, include_domains, and boost_domains are host-only settings that the model never sees.

Prompt for the constraint that makes search necessary. Compare these two prompts:

• Vague: "Fix this Dockerfile." Nothing signals that current syntax matters, so the agent may not search at all.
• Search-triggering: "Fix this Dockerfile. The base image changed its syntax in the latest release, so check the current docs first." The agent now has a reason to call the tool, and the transcript shows which query it ran.

Three habits cover most of the value:

• Version-qualified queries. A query that names the pinned version, such as fastapi 0.115 middleware, ties the answer to the dependency you actually use.
• Exact error strings. When a build breaks, the literal error is a precise query. Include its punctuation.
• Source steering. Ask the agent to add site: for the project's official documentation domain. Our site restriction guide covers the pattern. To limit every search to domains you name, the MCP docs list a host-only include_domains setting with an X-Search-Include-Domains header equivalent, which would go in the server's headers object. We have not exercised that route with a live key, so confirm in the tool-call transcript that results stay on your domains.

Keep the result count small. The Web Search API docs call 5 to 10 results usually sufficient for retrieval-augmented generation, and a smaller count keeps the transcript short. Web results carry an optional page_age, covered in our response shape guide. Treat it as a hint about the result, not proof that the page matches your version, and ask the agent to name each source page it relied on.

What fails quietly, and how do you catch it?

Most failures here are silent: the server entry is ignored, or the tool list comes back empty. These are the ones the documentation describes:

• Wrong top-level key. VS Code's own file uses servers, the portable files use mcpServers, and Copilot CLI does not read .vscode/mcp.json.
• Restricted Mode. VS Code says that in restricted mode, workspace MCP configuration is blocked and the servers do not start. Trust the workspace first.
• The free profile on the wrong path. The You.com docs warn that profile=free on /mcp/research or /mcp/finance exposes no tools and returns no error, because the free profile includes only you-search and you-discover.
• Interactive input in agent sessions. Servers that need ${input:...} values are not forwarded to Agent Host sessions, as described above.
• Search loops. The agent reruns a query that disappoints it. Read the transcript, count distinct queries, and tell the agent to reformulate once and then stop.

The script below uses only the standard library to check a config file for a wrong top-level key, the free profile on a research or finance path, and a literal bearer token. It also flags a missing type on a remote server and an unexpected path. It cannot see Restricted Mode, input variables, or policy, which only show up in your session. Save it as check_mcp_config.py. Running python3 check_mcp_config.py --selftest executes six offline tests. Running python3 check_mcp_config.py .mcp.json checks a file and exits with 1 when it finds a problem.

#!/usr/bin/env python3
"""Check an MCP config file for You.com server mistakes that fail quietly.

  python3 check_mcp_config.py .mcp.json
  python3 check_mcp_config.py --selftest
"""
import json
import sys
import unittest
from urllib.parse import parse_qs, urlsplit

YOU_PATHS = ("/mcp", "/mcp/research", "/mcp/finance")


def expected_key(path):
    # VS Code's own format uses "servers"; the portable files use "mcpServers"
    if path.replace("\\", "/").endswith(".vscode/mcp.json"):
        return "servers"
    return "mcpServers"


def check(path, text):
    try:
        config = json.loads(text)
    except ValueError as exc:
        return ["invalid JSON: %s" % exc]
    want = expected_key(path)
    servers = config.get(want)
    if not isinstance(servers, dict):
        other = "servers" if want == "mcpServers" else "mcpServers"
        found = " (found %s instead)" % other if other in config else ""
        return ["no top-level %s object%s" % (want, found)]
    problems = []
    for name, entry in servers.items():
        parts = urlsplit(entry.get("url") or "")
        if parts.netloc != "api.you.com":
            continue
        if entry.get("type") != "http":
            problems.append('%s: set "type": "http" on a remote server' % name)
        if parts.path not in YOU_PATHS:
            problems.append("%s: unexpected path %s" % (name, parts.path))
        profile = parse_qs(parts.query).get("profile", [""])[0]
        if profile in ("free", "discover") and parts.path != "/mcp":
            problems.append("%s: ?profile=%s on %s lists no tools and returns no error"
                            % (name, profile, parts.path))
        auth = (entry.get("headers") or {}).get("Authorization", "")
        if auth.startswith("Bearer ") and "${" not in auth:
            problems.append("%s: literal bearer token; keep it out of committed files" % name)
    return problems


class CheckTests(unittest.TestCase):
    FREE = '{"mcpServers": {"you-com": {"type": "http", "url": "https://api.you.com/mcp?profile=free"}}}'

    def test_free_profile_in_portable_file_is_clean(self):
        self.assertEqual(check(".mcp.json", self.FREE), [])

    def test_wrong_top_level_key(self):
        found = check(".vscode/mcp.json", self.FREE)
        self.assertEqual(found, ["no top-level servers object (found mcpServers instead)"])
        copied = '{"servers": {"you-com": {"type": "http", "url": "https://api.you.com/mcp"}}}'
        self.assertIn("found servers instead", check(".mcp.json", copied)[0])

    def test_missing_type_and_bad_path(self):
        bad = '{"mcpServers": {"y": {"url": "https://api.you.com/mcp/search"}}}'
        found = check(".mcp.json", bad)
        self.assertEqual(len(found), 2)
        self.assertIn('"type": "http"', found[0])

    def test_free_profile_on_research_lists_no_tools(self):
        bad = ('{"mcpServers": {"r": {"type": "http", '
               '"url": "https://api.you.com/mcp/research?profile=free"}}}')
        self.assertIn("lists no tools", check(".mcp.json", bad)[0])

    def test_literal_token_flagged_but_input_variable_is_not(self):
        literal = ('{"servers": {"y": {"type": "http", "url": "https://api.you.com/mcp", '
                   '"headers": {"Authorization": "Bearer abc123"}}}}')
        safe = literal.replace("abc123", "${input:ydc-key}")
        self.assertIn("literal bearer token", check(".vscode/mcp.json", literal)[0])
        self.assertEqual(check(".vscode/mcp.json", safe), [])

    def test_other_servers_ignored_and_bad_json_reported(self):
        other = '{"mcpServers": {"x": {"type": "http", "url": "https://example.com/mcp"}}}'
        self.assertEqual(check(".mcp.json", other), [])
        self.assertTrue(check(".mcp.json", "{")[0].startswith("invalid JSON"))


if __name__ == "__main__":
    if "--selftest" in sys.argv:
        unittest.main(argv=[sys.argv[0]], verbosity=2)
    if len(sys.argv) != 2:
        sys.exit("usage: python3 check_mcp_config.py PATH-TO-CONFIG")
    with open(sys.argv[1], encoding="utf-8") as fh:
        result = check(sys.argv[1], fh.read())
    print("\n".join(result) if result else "ok: no quiet failures found")
    sys.exit(1 if result else 0)

The tests cover the documented behaviors, not a live connection, and the script assumes You.com entries point at api.you.com. No keyed calls to You.com or GitHub were made while writing this guide, so confirm the tool list in your own session before you rely on it. For the design of search as a callable tool, our agent tool calling guide covers schemas and result formats.

Related Guides

• How to Set Up the You.com MCP Server for Web Search in Any Client
• How to Add Web Search to Claude Code: A Developer Installation Guide
• How to Add Web Search to Cursor With the You.com MCP Server
• How to Give a Coding Agent Web Search With the You.com Web Search API