[a01318809-ops]

Why:

Closes:

What's being changed (if available, include any code snippets, screenshots, or gifs):

Check off the following:

• A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• The changes in this PR meet the docs fundamentals that are required for all content.
• All CI checks are passing and the changes look good in the review environment.

[docs-bot]

👋 Hi there! It looks like you've modified some files that we can't accept as contributions:

• .github/copilot-instructions.md
• .vscode/mcp.json

You'll need to raise a new PR that doesn't include those files, before we can review.

The complete list of files we can't accept are:

• Anything in the root directory
• .devcontainer/**
• .github/**
• data/reusables/rai/**
• .vscode/**
• config/**
• contributing/**
• src/**
• content/actions/how-tos/secure-your-work/security-harden-deployments/**
• content/README.md

We also can't accept contributions to files in the content directory with frontmatter contentType: rai. You can always check out our full contribution guidelines.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

This pull request contains code changes, so we will not generate a table of review links.

🤖 This comment is automatically generated.

[Copilot]

🟡 Changes recommended

The committed MCP configuration has multiple unresolved moderate issues involving unpinned executable packages, possible token exposure, placement on the wrong configuration surface, and missing credential setup guidance.

4 open issues

• Use the MCP configuration surface supported by the intended client · New
• Pin MCP server versions before granting workspace access · New
• Pin and vet the GitHub MCP package before exposing tokens · New
• Document the required least-privilege GitHub token · New

What changed in this PR

This pull request adds shared Copilot guidance and VS Code MCP server configuration for filesystem and GitHub integrations.

Changes:

• Adds .vscode/mcp.json with filesystem and GitHub MCP server definitions.
• Adds .github/copilot-instructions.md with repository development guidance.

File	Description
.vscode/​mcp.json	Configures local filesystem and GitHub MCP servers for VS Code; review findings require changes to the configuration surface, package provenance, authentication, token scope, and setup documentation.
.github/​copilot-instructions.md	Defines general instructions for Copilot-assisted development, including testing, security, accessibility, and maintainability guidance.

This pull request requires changes.

_{Review effort: Lite}

[ronaldmaguling-del]

i am so proud of you and your support