What one command wires
Wire GitHub Copilot to Vulnetix. Skills install to ~/.copilot/skills and .github/skills, and the MCP server answers with live vulnerability data rather than training data.
vulnetix agent install --agent github-copilot- Agent Skills: supported —
~/.copilot/skills - Dependency guard: not wired by the installer —
hook contract not yet verified - MCP server: supported —
https://mcp.vulnetix.com/mcp
Where GitHub Copilot reads skills
Agent Skills is an open standard, but hosts disagree about the directory. The installer writes the one GitHub Copilot actually opens.
- Everywhere, for you:
~/.copilot/skills - This repository:
.github/skills
Add the MCP server
{
"mcpServers": {
"vulnetix": {
"type": "http",
"url": "https://mcp.vulnetix.com/mcp",
"headers": { "Authorization": "ApiKey <orgId>:<key>" }
}
}
}True of GitHub Copilot specifically
- Repository-scope skills in .github/skills reach the cloud coding agent as well as the editor.
Ask something training data cannot answer
No install and no local binary: one URL and one header give the agent live vulnerability intelligence it can call mid-conversation.
>
is CVE-2021-44228 still actively exploited?
→ calling vulnetix_vuln
org.apache.logging.log4j:log4j-core@2.14.1 · maven
17 vulnerabilities · 11 critical, 4 high
- CVE-2021-44228 critical · CVSS 10.0 · EPSS 100.0%
- CVE-2021-45046 critical · CVSS 9.2 · EPSS 100.0%
- CVE-2021-44832 critical · CVSS 9.3 · EPSS 97.9%
CISA KEV · due 2021-12-24 · known ransomware use