Microsoft Copilot Studio.

Two integration paths. Pick the one that matches how your agent works. Both produce identical signed, on-chain-anchored Decision Receipts.

Pick a path

If your agent is generative (LLM picks tools and topics autonomously) → Path A is simpler. If your agent runs deterministic topics and you need every meaningful response certified without fail → Path B.

Path A — MCP Tool (Generative orchestration)

A1. Add the MCP server

1. Open your agent in Copilot Studio.
2. On the Overview page, scroll to the Tools card → + Add tool.
3. In the picker, click the Connector tab and search agentcert, or filter by Model Context Protocol. Click AgentCert.
4. On the dialog that appears, enter:
   • Server URL: https://api.agentcert.net/mcp (just /mcp — no trailing slash, no extra path)
   • Authentication → API key → Header
   • Header name: X-API-Key (the literal string — not your key)
   • API key value: your ait_… key from /welcome
5. Click Create. You should see Status: Connected and all nine tools listed.
6. Critical: toggle Allow all ON in the Tools block, or flip each tool's On switch. Defaults are OFF — your agent will see the tool but can't invoke any function.
7. Under Available to, confirm your agent name is listed. If empty, click Additional details → add your agent.
8. Save.

Gotcha: SSE vs Streamable HTTP. The Copilot Studio MCP dialog requires the Streamable HTTP transport. Use exactly https://api.agentcert.net/mcp. Pointing at the SSE endpoint (/mcp-sse/sse) produces a misleading Connector request failed with body "[{\"jsonrpc\":\"2.0\"}]".

A2. Switch the agent to Generative orchestration

This is the step most people miss. MCP tool instructions only fire when the agent's LLM acts as orchestrator. In Classic mode the agent runs deterministic topic flows and tool instructions are ignored — you'll see the agent hallucinate a fake verify URL.

1. Top-right of the agent page: Settings.
2. Left nav of Settings: Generative AI.
3. Under Orchestration, select Yes — Responses will be dynamic, using available tools and knowledge as appropriate.
4. Scroll to the bottom → Save.

A3. Add a certify instruction to the agent

Tell the LLM when to call certify_decision:

1. Back on the agent Overview → Instructions card → Edit.
2. Position the cursor at the end of your existing instructions, press Enter twice, and paste:

After producing any factual answer or recommendation, call the AgentCert tool certify_decision with these arguments:
- agent_id: "your_agent_id_here"
- user_intent: the user's most recent message
- agent_output: your generated answer
- platform: "copilot"

If certify_decision returns risk_level "high", do NOT send your answer. Reply: "Let me double-check that with a colleague and get back to you."

Otherwise, send your answer followed by a new line with: "Verified: " then the verify_url returned by certify_decision.

Replace your_agent_id_here with a stable identifier (e.g. safe_travels_bot) — use the same value across all calls so /agents groups receipts together.

A4. Test it

1. Top-right: Test (flask icon).
2. Ask a real question the agent would normally answer.
3. The reply should end with Verified: https://agentcert.net/r/?id=rcpt_….
4. Verify the URL is real: click it. You should land on the public verify page showing trust score, signature check, and Solana anchor proof. If the URL is agentcertify.com/verify/123456 or anything that doesn't resolve to a receipt page, the LLM hallucinated — revisit A2 (Generative orchestration not enabled) or A1 step 6 (Allow all toggle off).

Path B — Custom Connector (Swagger import)

Power Platform Custom Connectors expose each REST operation as a discrete action you can drop directly into a topic. This gives you the "wire it as a node" pattern that classic Power Platform connectors use (SharePoint, Outlook, etc.) — runs every time the topic reaches the node, no LLM judgment involved.

B1. Import the Custom Connector from our Swagger spec

1. Open make.powerapps.com in your environment.
2. Left nav → Discover all → Data → Custom connectors.
3. Top-right → + New custom connector → Import from OpenAPI URL.
4. Connector name: Agent Cert REST (or anything you like).
5. URL: https://api.agentcert.net/openapi/connector.yaml
6. Click Import.

B2. Configure the connector

The import wizard walks four steps. Only two need attention:

• Security: confirm Authentication type = API Key, Parameter label: X-API-Key, Parameter name: X-API-Key, Parameter location: Header. These should already be set from the Swagger spec — verify and continue.
• Test tab: click + New connection, paste your ait_… key from /welcome, hit Create connection. Reload the test tab; the CreateReceipt operation appears with input fields. Fill agent_id, user_intent, agent_output and click Test operation. A 201 response with a real receipt_id and verify_url confirms everything works.

Click Create connector (top-right) to publish it.

B3. Add the action to a topic in Copilot Studio

1. Back in Copilot Studio, open the topic you want certified (often Conversational boosting).
2. Find the node that generates the final answer (a Generate AI response or Send a message node).
3. Click + below it → Add a tool.
4. In the Connector tab, search Agent Cert REST → click CreateReceipt.
5. The action lands on the canvas with input fields. Bind:

6. Click + after CreateReceipt → Send a message:
   Type Verified at: → {x} → Topic.CertResult.verify_url.
7. Save → Test.

Every time the topic reaches the CreateReceipt node, a real receipt gets issued — no LLM judgment, no probabilistic skipping.

Verify it actually worked

Whichever path you took, your bot should now reply with a line like:

Verified: https://agentcert.net/r/?id=rcpt_5e9a32bbf50d452c8b9aac7d

• Click the URL. You should land on a public verify page showing trust score, risk level, signature check (Ed25519), and the Solana on-chain anchor (with an explorer link).
• If the page says not found, the URL was hallucinated. Most common with Path A — re-check Generative orchestration (A2) and the Allow all toggle (A1 step 6).
• You can also check your account dashboard at /receipts — every real receipt appears there in chronological order.

Gate by risk level (optional)

Receipts return a risk_level of low, medium, or high. Both paths can branch on it.

• Path A: already covered by the system prompt in step A3 — "If risk_level is high, do NOT send the answer".
• Path B: insert a Condition node between CreateReceipt and Send a message. Branch on Topic.CertResult.risk_level == "high": in the If branch send a safe fallback; in the Else branch send the certified answer + verify_url.

Troubleshooting

Path A — "Connector request failed"

• Body "[{\"jsonrpc\":\"2.0\"}]" — URL pointed at SSE. Change to /mcp.
• Body "missing or invalid X-API-Key" at runtime (even though setup showed Connected) — the Connection object is orphaned. Open the tool → click the Connection dropdown → Disconnect → + Add new connection → paste key → save. If still failing, also clean stale connections at make.powerapps.com → Connections.
• 404 Not Found — URL has extra path segments. Use exactly /mcp, not /mcp/ or /mcp/http/mcp.

Path A — agent never calls the tool

• Generative orchestration is off. Settings → Generative AI → confirm "Yes" selected.
• Allow all toggle off. Tools card → Agent Cert → flip Allow all ON.
• Verify URL is fake (e.g. agentcertify.com/verify/123456) — both of the above. The LLM played along with your instruction without actually invoking. Real URLs always start with https://agentcert.net/r/?id=rcpt_.

Path B — import fails / no operations appear

• Confirm the URL is reachable in a browser: https://api.agentcert.net/openapi/connector.yaml should return YAML.
• Power Platform requires Swagger 2.0, not OpenAPI 3.x. Our spec is 2.0 — if you swap in your own, keep the version.

Costs

• Each certify_decision / CreateReceipt call: 3 Decision Credits.
• Read-only MCP tools (get_receipt, verify_receipt, check_credits, list_my_receipts, get_anchor_proof): free.
• New accounts get 30 free credits. After that, top up with CERT at /welcome.

Notes on the two transports

Path A's MCP server is available on two transports:

• https://api.agentcert.net/mcp — Streamable HTTP (late 2024 spec). Required by Copilot Studio.
• https://api.agentcert.net/mcp-sse/sse — Server-Sent Events. Used by Claude Code CLI, Cursor, OpenAI Codex default.

Same auth (X-API-Key), same tools, same per-session scope.

See also

• MCP server reference — full tool list with parameter schemas.
• REST API reference — what the Custom Connector wraps.
• Bind a policy to your agent — consistent rules without per-call policy_rules.
• How verification works — what the receipt proves.