💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

I am having the same isssue where all tools of my custom MCP server is getting filtered out
MCP server "" has no allowed tools after filtering — omitting from config.

In the View Session of coppilot review, I can see the tools for the MCP server were loaded at start. But it seems it was filtered out later, having no effect on the review..=

https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-environment says:

Copilot code review also runs in an ephemeral development environment, and you can customize it in the same ways described in this article. By default, Copilot code review reuses your copilot-setup-steps.yml file

But yeah, that does not happen

Looks like the message about omitting a tool has disappeared but the behaviour stayed. Making the tracking of this issue (why is a MCP not used) even harder - as if it was easy before.

I found an important detail in GitHub's current documentation that directly addresses the tool-filtering behavior.

GitHub documents that, for Copilot Code Review, every tool returned by an MCP server's tools/list response must set annotations.readOnlyHint to true. Tools without this annotation, or with it set to false, are excluded from Code Review.

Documentation: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/configure-mcp-servers

For example, a genuinely read-only tool should expose metadata similar to:

{
  "name": "get_work_item",
  "description": "Retrieve a work item without modifying it",
  "inputSchema": {
    "type": "object",
    "properties": {
      "id": {
        "type": "string"
      }
    },
    "required": ["id"]
  },
  "annotations": {
    "readOnlyHint": true
  }
}

The important point is that the annotation belongs in the tool definition returned by the MCP server—not merely in the repository's MCP configuration.

I'd inspect the actual tools/list response and verify the annotation on every tool intended for Code Review. Only mark a tool as read-only if it really does not modify external state. Tools that create, update, or delete data should not be falsely labelled to bypass the filter.

This also explains why an MCP server can connect successfully while exposing no usable tools: connection and tool eligibility are separate stages.

Could you test this on one genuinely read-only tool and confirm whether it appears in the Code Review session logs? That would help distinguish the documented filtering behavior from any additional issue with the setup workflow.

Looks like GitHub has finally documented this aspect in September:
github/docs@f0ca6ae

This issue was raised in June because it was undocumented.

The problem is now that it silently filters out the tools and no details in the worker session. Just a summary number.

So yes when a tool has readOnlyHint it is used.
The next problem is that very few tools use this readOnlyHint annotation and the filter is not displayed in the session logs making troubleshooting unnecessary hard.
Hopefully now that this is documented it makes it easier to persuade 3rd party MCP producers to add this annotation.