copilot-image-gen — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited copilot-image-gen (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that connects GitHub Copilot CLI to Microsoft Copilot's image generation backend.
Generate images from text prompts and iteratively refine them — all from the terminal. Images are saved locally and organized by session.
pip install copilot-image-gen-mcp
copilot plugin install msartem/copilot_image_gen_mcp copilotCopilot will automatically call sign_in when needed. An Edge browser window opens — sign in with your Microsoft 365 account. The auth code is captured automatically via Playwright (no manual copy-paste).
Generate an image of an elephant in Times Square
Make the elephant golden
Change the background to a sunset over mountainsAfter first sign-in, auth is silent via cached refresh tokens (~90 day lifetime, auto-renewing). No browser window on subsequent uses.
generate_image or refine_image tool~/.copilot-images/ and the file path is returnedMulti-turn refinement works automatically — the server maintains a conversation so each refine_image call builds on the previous image.
You → Copilot CLI → image gen MCP → M365 Copilot (Sydney) → DALL-E → PNG saved locally| Tool | Description |
|---|---|
generate_image(prompt, orientation) | Generate a new image from text. Blocks ~15-30s, returns file path. |
refine_image(prompt) | Modify the last generated image. Same conversation context. |
sign_in() | Sign in to Microsoft 365 (opens browser, one-time). |
new_session() | Start a fresh conversation (discard previous image context). |
landscape (default)portraitsquareImages are saved to ~/.copilot-images/ organized by session. Each session groups an initial image with its refinements:
~/.copilot-images/
├── 20250115_143022_elephant_in_times_square/
│ ├── session.json ← metadata (prompts, timestamps)
│ ├── 001_elephant_in_times_square.png ← initial image
│ ├── 002_make_the_elephant_golden.png ← first refinement
│ └── 003_change_the_background_to_a_sunset.png ← second refinement
└── 20250116_091200_sunset_over_mountains/
├── session.json
└── 001_sunset_over_mountains.pngSession directories are created lazily on first image save — no side effects until you actually generate something.
Authentication uses Playwright to automate browser sign-in via Microsoft Edge. This works identically on macOS and Windows — no platform-specific code.
sign_in (or you trigger it manually)Cached refresh tokens are used — no browser window, no interaction needed.
Playwright uses Microsoft Edge by default. To use a different Chromium-based browser:
export COPILOT_BROWSER=chrome # or: msedge (default), chromiumNote:chromiumrequiresplaywright install chromium. Edge and Chrome use your installed browser directly — no extra install needed.
python auth.py # Interactive sign-in
python auth.py logout # Clear cached tokens| Platform | Cache location |
|---|---|
| macOS / Linux | ~/.copilot-image-gen-mcp/token_cache.json |
| Windows | %LOCALAPPDATA%\copilot-image-gen-mcp\token_cache.json |
| Variable | Default | Description |
|---|---|---|
COPILOT_IMAGES_DIR | ~/.copilot-images | Image output directory |
COPILOT_BROWSER | msedge | Browser for sign-in: msedge, chrome, chromium |
COPILOT_TENANT | common | Azure AD tenant ID |
COPILOT_TIMEOUT | 90 | Image generation timeout in seconds |
COPILOT_VARIANTS | (built-in) | Feature flag overrides (advanced) |
See TECHNICAL.md for details on the SignalR WebSocket protocol, authentication flow, image delivery format, and multi-turn refinement architecture.
This is an independent community project — not affiliated with or supported by Microsoft.
It works by communicating with the same undocumented web APIs that power the M365 Copilot web/desktop app image generation. These APIs may change or break without notice. Use at your own risk.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.