Copilot Studio MCP tools may override agent instructions
Diesen Beitrag auf Deutsch lesen
A custom MCP server caused a Copilot Studio agent to answer an unrelated question despite instructions restricting conversation to a training course.
TL;DR
A Copilot Studio agent followed an instruction to reject questions unrelated to a training course, but later answered one after a matching custom MCP tool returned numbers. The author infers that MCP tools may take priority over agent instructions, allowing tool responses to continue a conversation despite configured constraints and creating unpredictable behaviour.
Original by Alex Shlega, on It Ain’t Boring. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Admins/CoE: test every Copilot Studio agent instruction together with its configured tools, especially custom MCP servers, because a matching tool may change the agent’s response path.
- Security/Compliance: treat instruction-only restrictions as insufficient control until tool invocation and response handling have been tested, because the example shows an agent continuing an unrelated conversation after an MCP response.
Frequently asked questions
Can instructions alone keep a Copilot Studio agent on topic?
Not reliably. In the example the agent rejected an unrelated question at first, then answered one after a matching custom MCP tool returned numbers.
What is the risk of custom MCP tools in an agent?
The author infers that MCP tools may take priority over agent instructions, so a tool response can continue a conversation despite configured constraints and make behaviour unpredictable.
What should admins and security teams test?
Test every agent instruction together with its configured tools, especially custom MCP servers, and do not treat instruction-only restrictions as sufficient control until tool calls and responses are tested.