Copilot's Customize tab: only one of those four is portable

GitHub made the Copilot app's Customize tab generally available on August 25. It puts MCP servers, plugins, skills, and canvases behind one browsable surface with featured picks and category filters. It is, plainly, a marketplace for agent extensions. Exactly one of those four artifact types is portable off GitHub, and that distinction should decide where your team spends its build hours.

What actually happened

Per the GitHub Changelog, the Customize tab consolidates four extension types in the Copilot app. You browse featured customizations as starting points, filter trending MCP servers by category, and install plugins, skills, and canvases from the same screen. The example GitHub highlights is a canvas that delegates an Azure DevOps backlog — triage issues, prioritize the backlog, assign follow-ups, hand the work to Copilot.

The changelog does not state plan-tier requirements, supported IDEs, or admin policy controls. Worth noting before anyone rolls this out across a team.

Why MCP portability matters for your business

MCP is a published spec. The other three are GitHub's shapes. The 2026-07-28 revision moved the protocol core to stateless request/response, added cacheable list results and header-based routing, and shipped across all four Tier 1 SDKs. A server you write against that spec answers Copilot, Claude Code, and Cursor without a rewrite. A canvas answers Copilot.

So put the capability in the server. Your "check inventory across the warehouse and the storefront" logic belongs in an MCP server you host and own. The Copilot-shaped plugin or canvas on top of it should be a thin adapter — a hundred lines you can afford to throw away when your team switches editors, which they will.

A featured list is an editorial decision made by your vendor. "Trending" and "Featured" are rankings, and one-click install from a ranking is a supply-chain decision your developers now make while browsing. Decide today which servers are approved, what scopes they get, and who signs off — before the tab makes it frictionless.

Ask for the policy controls in writing. The changelog is silent on admin governance. If your organization needs an allowlist, confirm it exists rather than assuming a GA marketplace shipped with one.

Sources: GitHub Changelog, Model Context Protocol.