Copilot Studio and Gemini Enterprise

Both hosts let your own admins or makers add a remote MCP server inside your tenant. Neither Microsoft nor Google reviews that connection, and it doesn’t list Semicola in a vendor gallery. This page covers the tenant-side steps; everything after adding the tool happens in the host. Both hosts need Streamable HTTP. Semicola’s MCP endpoint is Streamable HTTP, so no adapter is needed.

​

Microsoft Copilot Studio

You need Copilot Studio maker access, a Semicola account, and your tenant admin’s confirmation that your Data Loss Prevention policy allows the endpoint for custom connectors.

1. Open your agent in Copilot Studio and go to Tools.
2. Choose Add a tool → New tool → Model Context Protocol.
3. Enter a server name your makers will recognize, an accurate description (the model uses it to decide when to call the tool), and the MCP server URL.
4. Save. Copilot Studio reads the tool list; review it before you publish the agent.

​

Tenant DLP

Copilot Studio’s custom connectors and MCP tools fall under your Microsoft 365 tenant’s Data Loss Prevention policy, like any other non-Microsoft connector. If your tenant limits custom connectors to an allowlist, ask your Microsoft 365 admin to allow api.semicola.com before makers save the tool. This is a Microsoft-side control; Semicola can’t see or change it.

​

Gemini Enterprise

A Gemini Enterprise admin adds Semicola as a Connected App.

1. In the admin console, open Connected Apps (or Apps and integrations).
2. Choose Add app → Custom MCP server.
3. Enter the MCP server URL, a name, an accurate description, the authorization and token URLs, and the scope. Leave the client secret blank. If your console build requires a client secret, it can’t be configured against Semicola yet; don’t enter a placeholder.

Gemini Enterprise lists Semicola’s tools after the Connected App is authorized, and every tool starts off until an admin enables it. Gemini Enterprise currently caps a tenant at 100 enabled actions across all of its Connected Apps combined, so enable the tools your users need (for example get_status, search, get, save_campaign, request_proposals and get_delivery for buyers) rather than everything.

​

Authenticate

Semicola supports OAuth 2.0 authorization code with PKCE and dynamic client registration, so a compliant host registers itself. If the host completes sign-in when you save, you’re done. If it doesn’t, register a client yourself:

1. Copy the exact redirect URI the host’s authentication form shows for your tenant. It differs by cloud and region, and Semicola matches redirect URIs exactly. It must use https.
2. Register it:
   curl -X POST https://api.semicola.com/auth/register \
     -H "Content-Type: application/json" \
     -d '{
       "client_name": "Copilot Studio - <your tenant>",
       "redirect_uris": ["<the exact redirect URI>"]
     }'
   
3. Enter the returned client_id in the host, with no client secret, and the scope mcp:access.

The registered client is public: it has no secret, and its client_id isn’t sensitive. Don’t reuse one tenant’s client for another tenant’s agent. Each person then signs in with their own Semicola account; tools act with that person’s access. See Authentication.

​

Check the connection

Ask the agent for a read first, for example “Call get_status and tell me which account you’re using”, then “list my advertisers” or “show my storefront’s products”, and confirm the result before building more on top. The tool catalog lists every tool.

​

Not available yet

• End-to-end verification of dynamic registration against either host’s wizard. If automatic sign-in fails, use the manual registration above.
• A white-label or vendor-reviewed app listing for either host.