data.gov MCP server for Copilot Studio

This MCP server gives Microsoft Copilot Studio agents read-only access to federal APIs that use the api.data.gov authentication model.

The GitHub repository contains the source code only. Copilot Studio cannot connect directly to a GitHub repository; deploy the server to a public HTTPS host first.

MCP tools

• call_federal_api: Make a guarded HTTPS GET request to a .gov or .mil API.
• get_rate_limit_info: Call an endpoint and expose the X-RateLimit-* headers.

Required environment variables

Variable	Purpose
DATA_GOV_API_KEY	Your outbound data.gov key. Use DEMO_KEY only for light testing.
MCP_SERVER_API_KEY	A separate secret that Copilot Studio sends to this MCP server.
MCP_TRANSPORT	Set to streamable-http for Copilot Studio.

Optional variables include MCP_HOST (default 127.0.0.1), MCP_PORT (default 8000), MCP_PATH (default /mcp), MCP_ALLOWED_HOSTS (comma-separated host allowlist), and DATA_GOV_ALLOWED_HOSTS (comma-separated federal API host allowlist). Set MCP_HOST=0.0.0.0 only inside a container behind HTTPS ingress.

Do not use the data.gov key as the MCP server key. Store both as deployment secrets.

Deploy with Docker

Build and run locally:

docker build -t data-gov-mcp .
docker run --rm -p 8000:8000 `
  -e MCP_TRANSPORT=streamable-http `
  -e MCP_SERVER_API_KEY="replace-with-a-long-random-secret" `
  -e DATA_GOV_API_KEY="your-data-gov-key" `
  data-gov-mcp

The local MCP endpoint is:

http://localhost:8000/mcp

Copilot Studio requires a publicly reachable HTTPS endpoint. Azure Container Apps, Azure App Service, or another HTTPS container host can run the included Dockerfile. Configure the deployment to expose port 8000, set the required environment variables as secrets, and use the resulting URL ending in /mcp.

For production, set MCP_ALLOWED_HOSTS to the exact public host and keep MCP_SERVER_API_KEY out of source control and container images.

Add the server to Microsoft Copilot Studio

Microsoft currently supports the Streamable HTTP transport for existing MCP servers. SSE is no longer supported for Copilot Studio.

1. Open the agent in Copilot Studio.
2. Turn on Generative orchestration.
3. Open Tools and select Add a tool > New tool > Model Context Protocol.
4. Enter:
   • Server name: data.gov Federal APIs
   • Description: Read-only access to approved federal APIs using the data.gov API gateway.
   • Server URL: https://YOUR_PUBLIC_HOST/mcp
5. Select API key authentication.
6. Select Header and set the header name to X-MCP-API-Key.
7. Enter the same value configured in the deployment's MCP_SERVER_API_KEY.
8. Select Create, choose Create a new connection, then select Add to agent.
9. Review the discovered tools and test the agent with a narrow request, such as asking for one current record from a known federal API.

The server uses its private DATA_GOV_API_KEY when calling the downstream federal API. Do not ask Copilot Studio users to provide that key.

Local stdio mode

For local MCP clients that launch a process directly, stdio remains available:

py -m venv .venv
.\.venv\Scripts\Activate.ps1
py -m pip install -r requirements.txt
$env:DATA_GOV_API_KEY = "DEMO_KEY"
py server.py

Leave MCP_TRANSPORT unset for stdio mode. Use MCP_TRANSPORT=streamable-http only when running as a network service.

Security notes

• Only HTTPS federal hosts are allowed by default for downstream requests.
• Private, loopback, link-local, multicast, and reserved downstream addresses are rejected.
• Responses are limited to 5 MB to protect server and agent memory.
• The Copilot Studio-facing endpoint requires X-MCP-API-Key.
• Caller-supplied api_key query parameters are rejected; only the server-held key is used.
• The data.gov API key is sent only from the server to the downstream API and is never returned as a tool result.
• Apply Power Platform data policies to control external connector access in Copilot Studio.

References:

• Connect an existing MCP server to Copilot Studio
• Extend an agent with MCP
• api.data.gov developer manual