feat: MCP in DA (#14613)

* feat(mcp): add support for mcp for da

* perf: update ui

* perf: update flow

* perf: update code

* perf: update code

* perf: update

* perf: update

* perf: update

* docs: update readme

* perf: update feature flag

* perf: update

* perf: remove image

* fix: ActionStartOptions not found

* fix: some issues

* fix: get well known metadata URL

* feat: support da entra sso auth

* feat: remove template

* refactor: remove pnpm-lock change

* fix: description of Entra SSO client ID question

* fix: codelens issue

* fix: sanitize mcp server name issue

* test: add test - 1

* test: add test - 2

* test: add test - 3

* chore: remove unused strings

* test: add test - 4

* test: add test - 5

* test: add test - 6

* test: add test - 7

* chore: remove unused variables

---------

Co-authored-by: Bowen Song <[email protected]>

Author: Alive-Fish

packages/api/src/constants.ts

@@ -86,6 +86,7 @@ export enum Stage {
   addKnowledge = "addKnowledge",
   setSensitivityLabel = "setSensitivityLabel",
   installApp = "installApp",
+  updateActionWithMCP = "updateActionWithMCP",
 }
 
 export enum TelemetryEvent {

packages/fx-core/resource/package.nls.json

@@ -439,6 +439,7 @@
   "core.createProjectQuestion.OauthClientId": "Enter client id for OAuth registration in OpenAPI Description Document",
   "core.createProjectQuestion.OauthClientSecret": "Enter client secret for OAuth registration in OpenAPI Description Document",
   "core.createProjectQuestion.OauthClientSecretConfirm": "Microsoft 365 Agents Toolkit uploads the client id/secret for OAuth Registration to Developer Portal. It is used by Teams client to securely access your API at runtime. Microsoft 365 Agents Toolkit doesn't store your client id/secret.",
+  "core.createProjectQuestion.EntraSSOClientId": "Enter Microsoft Entra SSO client id for registration in OpenAPI Description Document",
   "core.createProjectQuestion.apiMessageExtensionAuth.title": "Authentication Type",
   "core.createProjectQuestion.apiMessageExtensionAuth.placeholder": "Select an authentication type",
   "core.createProjectQuestion.invalidApiKey.message": "Invalid client secret. It should be 10 to 512 characters long.",
@@ -1137,5 +1138,19 @@
   "driver.typeSpec.compile.reprovision": "File %s is updated. A new provision process has started to apply the changes.",
   "error.kiota.KiotaGeneratePluginError": "Unable to generate plugin manifest file using Kiota. Error: %s",
   "error.daSpecParser.InvalidSpecError": "OpenAPI specification file is not valid: %s",
-  "error.kiotaClient.EmptyResult": "Get empty result when parser OpenAPI description file."
+  "error.kiotaClient.EmptyResult": "Get empty result when parser OpenAPI description file.",
+  "core.createProjectQuestion.mcpForDa.label": "Start with an MCP server",
+  "core.createProjectQuestion.mcpForDa.detail": "Create actions from your existing MCP server",
+  "core.createProjectQuestion.mcpForDa.ServerUrl.title": "MCP Server URL",
+  "core.createProjectQuestion.mcpForDa.ServerUrl.placeholder": "Enter your MCP server URL(e.g. https://example-mcp.com)",
+  "core.createProjectQuestion.mcpForDa.PreFetchTools.title": "Select Operation(s) Copilot can interact with",
+  "core.createProjectQuestion.mcpForDa.AuthType.title": "Select Authentication Type",
+  "core.createProjectQuestion.mcpForDa.Auth.OAuth": "OAuth (with static registration)",
+  "core.createProjectQuestion.mcpForDa.Auth.EntraSSO": "Entra SSO",
+  "core.createProjectQuestion.mcpForDa.File.title": "Select the action manifest you want to update",
+  "core.MCPForDA.updatePluginManifest": "The operations selected from your MCP server are successfully added for Copilot to interact with. You can go to the '%s' to check on details. Now you are able to provision your declarative agent to continue.",
+  "core.MCPForDA.mcpAuthMetadataMissingError": "Unable to find the authentication metadata in the MCP server. Please make sure your MCP server is configured correctly and try again. Details: %s",
+  "core.MCPForDA.mcpAuthMetadataUrlNotFound": "Unable to find the authentication metadata from property \"resource_metadata\" from response of the MCP server.",
+  "core.MCPForDA.mcpServerMetadataUrlNotFound": "Unable to find the server metadata from property \"authorization_servers\" from repsonse of the Protected Resource Metadata of the MCP server.",
+  "core.MCPForDA.authUrlNotFound": "Unable to find the authentication URL(s) from response of Authorization Server Metadata of the MCP server."
 }

packages/fx-core/src/common/featureFlags.ts

@@ -38,6 +38,7 @@ export class FeatureFlagName {
   static readonly SensitivityLabelEnabled = "TEAMSFX_SENSITIVITY_LABEL";
   static readonly DAMetaOS = "TEAMSFX_DA_METAOS";
   static readonly CFShortcutMetaOS = "TEAMSFX_CF_SHORTCUT_METAOS";
+  static readonly MCPForDA = "TEAMSFX_MCP_FOR_DA";
 }
 
 export interface FeatureFlag {
@@ -133,6 +134,10 @@ export class FeatureFlags {
     name: FeatureFlagName.CFShortcutMetaOS,
     defaultValue: "false",
   };
+  static readonly MCPForDA = {
+    name: FeatureFlagName.MCPForDA,
+    defaultValue: "true",
+  };
 }
 
 export class FeatureFlagManager {

packages/fx-core/src/component/configManager/actionInjector.ts

@@ -242,6 +242,80 @@ export class ActionInjector {
     return undefined;
   }
 
+  static async injectCreateOAuthActionForMCP(
+    ymlPath: string,
+    authType: string,
+    authName: string,
+    registrationId: string,
+    mcpServerUrl: string,
+    authorizationUrl?: string,
+    tokenUrl?: string,
+    refreshUrl?: string
+  ): Promise<AuthActionInjectResult | undefined> {
+    const ymlContent = await fs.readFile(ymlPath, "utf-8");
+
+    const document = parseDocument(ymlContent);
+    const provisionNode = document.get("provision") as any;
+    if (provisionNode) {
+      const hasAuthActionWithSameReferenceId = provisionNode.items.some(
+        (item: any) =>
+          (item.get("uses") as string) === "oauth/register" &&
+          !!item.get("with") &&
+          !!item.get("writeToEnvironmentFile") &&
+          (item.get("writeToEnvironmentFile").get("configurationId") as string) === registrationId
+      );
+      if (hasAuthActionWithSameReferenceId) {
+        return undefined;
+      }
+
+      provisionNode.items = provisionNode.items.filter((item: any) => {
+        const uses = item.get("uses");
+        return uses;
+      });
+
+      const teamsAppIdEnvName = ActionInjector.getTeamsAppIdEnvName(provisionNode);
+      if (teamsAppIdEnvName) {
+        const index: number = provisionNode.items.findIndex(
+          (item: any) => item.get("uses") === "teamsApp/create"
+        );
+
+        const action: any = {
+          uses: "oauth/register",
+          with: {
+            name: `${authName}`,
+            appId: `\${{${teamsAppIdEnvName}}}`,
+            flow: "authorizationCode",
+            ...(authType === "oauth"
+              ? {
+                  authorizationUrl: authorizationUrl,
+                  tokenUrl: tokenUrl,
+                  refreshUrl: refreshUrl ?? undefined,
+                  identityProvider: "Custom",
+                }
+              : {
+                  identityProvider: MicrosoftEntraAuthType,
+                }),
+            baseUrl: mcpServerUrl,
+          },
+          writeToEnvironmentFile: {
+            configurationId: registrationId,
+          },
+        };
+        provisionNode.items.splice(index + 1, 0, action);
+      } else {
+        throw new InjectOAuthActionFailedError();
+      }
+
+      await fs.writeFile(ymlPath, document.toString(), "utf8");
+      return {
+        defaultRegistrationIdEnvName: registrationId,
+        registrationIdEnvName: registrationId,
+      };
+    } else {
+      throw new InjectOAuthActionFailedError();
+    }
+  }
+
   static findNextAvailableEnvName(baseEnvName: string, existingEnvNames: string[]): string {
     let suffix = 1;
     let envName = baseEnvName;

packages/fx-core/src/component/generator/declarativeAgent/generator.ts

@@ -8,6 +8,7 @@
 import {
   AppPackageFolderName,
   Context,
+  DefaultPluginManifestFileName,
   err,
   FxError,
   GeneratorResult,
@@ -65,6 +66,7 @@ export class DeclarativeAgentGenerator extends DefaultTemplateGenerator {
       TemplateNames.DeclarativeAgentWithActionFromScratchOAuth,
       TemplateNames.DeclarativeAgentWithExistingAction,
       TemplateNames.DeclarativeAgentWithTypeSpec,
+      TemplateNames.DeclarativeAgentWithActionFromMCP,
     ].includes(inputs[QuestionNames.TemplateName]);
   }
 
@@ -82,6 +84,7 @@ export class DeclarativeAgentGenerator extends DefaultTemplateGenerator {
     const solutionNameFromVS =
       language === "csharp" ? inputs[QuestionNames.SolutionName] : undefined;
 
+    const MCPForDAServerUrl = inputs[QuestionNames.MCPForDAServerUrl];
     const replaceMap = {
       ...Generator.getDefaultVariables(
         inputs[QuestionNames.TemplateName] === TemplateNames.DeclarativeAgentWithTypeSpec
@@ -94,6 +97,14 @@ export class DeclarativeAgentGenerator extends DefaultTemplateGenerator {
       ),
       DeclarativeCopilot: "true",
       MicrosoftEntra: auth === ApiAuthOptions.microsoftEntra().id ? "true" : "",
+      ...(MCPForDAServerUrl
+        ? {
+            MCPForDAServerUrl,
+            ServerName: new URL(MCPForDAServerUrl).host
+              .replace(/[^a-zA-Z0-9]/g, "")
+              .substring(0, 10),
+          }
+        : {}),
     };
     const templateName = inputs[QuestionNames.TemplateName];
 
@@ -143,6 +154,14 @@ export class DeclarativeAgentGenerator extends DefaultTemplateGenerator {
       await setGeneralSensitivityLabel(context, declarativeCopilotManifestPathRes.value);
     }
 
+    // if (
+    //   featureFlagManager.getBooleanValue(FeatureFlags.MCPForDA) &&
+    //   TemplateNames.DeclarativeAgentWithActionFromMCP === inputs[QuestionNames.TemplateName]
+    // ) {
+    //   const result = await generateForMCPForDA(destinationPath, inputs);
+    //   return result;
+    // }
+
     if (
       featureFlagManager.getBooleanValue(FeatureFlags.EmbeddedKnowledgeEnabled) &&
       (inputs.platform === Platform.CLI || inputs.platform === Platform.VSCode)

packages/fx-core/src/component/generator/declarativeAgent/helper.ts

@@ -1,10 +1,14 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 import {
+  AppPackageFolderName,
   Context,
   DefaultApiSpecFolderName,
+  DefaultPluginManifestFileName,
   err,
   FxError,
+  GeneratorResult,
+  Inputs,
   ok,
   PluginManifestSchema,
   Result,
@@ -31,6 +35,7 @@ import {
   ItemMetadata,
 } from "./oneDriveSharePointHandler";
 import { createContext } from "../../../common/globalVars";
+import { QuestionNames } from "../../../question/questionNames";
 
 const logMessageKeys = {
   failValidateOneDriveSharePointItem:
@@ -348,3 +353,106 @@ export async function getGraphConnectors(): Promise<GCItem[]> {
     }
   }
 }
+
+export async function generateForMCPForDA(
+  destinationPath: string,
+  inputs: Inputs
+): Promise<Result<GeneratorResult, FxError>> {
+  // 1. Get ai-plugin.json
+  const aiPluginFilePath = path.join(
+    destinationPath,
+    AppPackageFolderName,
+    DefaultPluginManifestFileName
+  );
+  if (!(await fs.pathExists(aiPluginFilePath))) {
+    const error = new SystemError(
+      "MCPForDAPluginManifestNotFound",
+      "PluginManifestNotFound",
+      getDefaultString("core.MCPForDA.pluginManifestNotFound", aiPluginFilePath),
+      getLocalizedString("core.MCPForDA.pluginManifestNotFound", aiPluginFilePath)
+    );
+    return err(error);
+  }
+
+  const mcpServerUrl = inputs[QuestionNames.MCPForDAServerUrl];
+  const serverName = inputs[QuestionNames.MCPForDAServerName];
+  const mcpTool = inputs[QuestionNames.MCPForDATool];
+
+  // 2. Read ai-plugin.json
+  const aiPluginContent = await fs.readJSON(aiPluginFilePath);
+
+  // For dynamic fetch tools, keep the functions empty and add runtime info
+  if (mcpTool === "dynamic-fetch") {
+    aiPluginContent.functions = [];
+    aiPluginContent.runtimes = [
+      {
+        type: "RemoteMCPServer",
+        spec: {
+          url: mcpServerUrl,
+          enable_dynamic_discovery: true,
+        },
+      },
+    ];
+  } else {
+    // For pre-fetch tools, add the tool info to ai-plugin.json
+    const mcpToolsDetail = inputs[QuestionNames.MCPForDAAvailableTools];
+    const mcpToolsSelected = inputs[QuestionNames.MCPForDAPreFetchTools];
+    const mcpAuth = inputs[QuestionNames.MCPForDAAuth];
+    if (!mcpToolsDetail || !mcpToolsSelected) {
+      const error = new UserError(
+        "MCPForDAPreFetchToolsNotFound",
+        "PreFetchToolsNotFound",
+        getDefaultString("core.MCPForDA.preFetchToolsNotFound"),
+        getLocalizedString("core.MCPForDA.preFetchToolsNotFound")
+      );
+      return err(error);
+    }
+    aiPluginContent.functions = mcpToolsDetail
+      .filter((tool: any) => tool.name.includes(serverName))
+      .map((tool: any) => {
+        const index = tool.name.indexOf(serverName);
+        const newName = (tool.name as string).substring(
+          (index as number) + (serverName.length as number) + 1
+        );
+        return {
+          name: newName,
+          description: tool.description,
+          inputSchema: tool.inputSchema,
+          tags: tool.tags,
+        };
+      })
+      .filter((tool: any) => mcpToolsSelected.includes(tool.name))
+      .map((tool: any) => {
+        return {
+          name: tool.name,
+          description: tool.description,
+          parameters: {
+            type: tool.inputSchema.type || "object",
+            properties: tool.inputSchema.properties,
+            required: tool.inputSchema.required || [],
+          },
+        };
+      });
+    aiPluginContent.runtimes = [
+      {
+        type: "RemoteMCPServer",
+        spec: {
+          url: mcpServerUrl,
+          enable_dynamic_discovery: false,
+        },
+        run_for_functions: aiPluginContent.functions.map((func: any) => func.name),
+      },
+    ];
+    if (mcpAuth === "OAuthPluginVault") {
+      aiPluginContent.runtimes[0].auth = {
+        type: "OAuthPluginVault",
+        reference_id: "${{MCP_DA_AUTH_ID}}",
+      };
+    }
+  }
+
+  // 3. Write ai-plugin.json
+  await fs.writeJSON(aiPluginFilePath, aiPluginContent, { spaces: 4 });
+
+  return ok([] as GeneratorResult); // Return empty warnings
+}

packages/fx-core/src/component/generator/templates/metadata/da.ts

@@ -107,4 +107,10 @@ export const declarativeAgentTemplates: Template[] = [
     language: "common",
     description: "",
   },
+  {
+    id: "declarative-agent-with-action-from-mcp",
+    name: TemplateNames.DeclarativeAgentWithActionFromMCP,
+    language: "common",
+    description: "",
+  },
 ];

packages/fx-core/src/component/generator/templates/templateNames.ts

@@ -13,6 +13,7 @@ export enum TemplateNames {
   DeclarativeAgentWithExistingAction = "api-plugin-existing-api", // handled by DeclarativeAgentGenerator
   DeclarativeAgentWithTypeSpec = "declarative-agent-typespec", // handled by DeclarativeAgentGenerator
   DeclarativeAgentWithGraphConnector = "declarative-agent-with-graph-connector", // handled by DeclarativeAgentGenerator
+  DeclarativeAgentWithActionFromMCP = "declarative-agent-with-action-from-mcp", // handled by DeclarativeAgentGenerator
 
   DeclarativeAgentMetaOSNewProject = "declarative-agent-meta-os-new-project", // handled by OfficeAddinGeneratorNew
   DeclarativeAgentMetaOSUpgradeProject = "declarative-agent-meta-os-upgrade-project", // handled by OfficeAddinGeneratorNew

packages/fx-core/src/component/generator/utils.ts

@@ -171,6 +171,8 @@ export function renderTemplateFileData(
     const writer = new Writer();
     const result = writer.renderTokens(token, new Context(variables));
     // Be compatible with current stable templates, can be removed after new template released.
+    // Disable HTML escaping to prevent URLs and other content from being encoded
+    Mustache.escape = (value) => value;
     return Mustache.render(result, variables, {}, oldPlaceholderDelimiters);
   }
   // Return Buffer instead of string if the file is not a template. Because `toString()` may break binary resources, like png files.
@@ -227,6 +229,8 @@ export function renderTemplateFileName(
   fileData: Buffer,
   variables?: { [key: string]: string }
 ): string {
+  // Disable HTML escaping to prevent special characters from being encoded
+  Mustache.escape = (value) => value;
   return Mustache.render(fileName, variables, {}, placeholderDelimiters).replace(
     templateFileExt,
     ""