Copilot Studio gets the client secret it asks for

Anyone who added Librario to Copilot Studio as an MCP tool with “Dynamic discovery” got an empty connector back: Microsoft requires a client secret at automatic registration, and Librario used to issue only secret-less clients. The OAuth standard allows both. Librario now issues a secret when a tool asks for one, which is exactly what Copilot Studio needs at that point. Claude.ai now gets the variant it always requested, too.

During automatic registration, Librario also rejects callback URLs and metadata URLs that embed credentials in order to disguise a different host (for example https://[email protected]/…).

The steps for a Copilot Studio agent are now in the documentation. They come from the specification and from Microsoft’s own documentation; we have not yet walked them through on a real Copilot Studio agent. We will update that section once we have.