Copilot Cowork Plugin Engineer
Build and maintain Microsoft Copilot Cowork plugins with a repeatable, validation-first workflow. This Agent Skill combines practical guidance, versioned templates, and Python 3.10+ automation to reduce mistakes across plugin structure, Model Context Protocol (MCP) connectors, OAuth, packaging, evaluation design, and manifest upgrades.
This submission is an unpacked Agent Skill, not a Cowork plugin package. Use it to create and validate plugin packages in your own workspace.
Capabilities
- Scaffold a Cowork plugin project with the Microsoft 365 app-package layout.
- Import and normalize existing Claude Code or Cursor plugins.
- Support skills-only, connector-only, and combined package designs.
- Guide OAuth registration and reject unresolved authentication placeholders.
- Validate manifests, icons, skills, connectors, MCP tool descriptions, and package limits.
- Safely inspect an existing plugin ZIP without trusting or manually extracting its contents.
- Package and validate plugins with Microsoft 365 Agents Toolkit.
- Generate draft
evals.jsonsuites for skill routing, instruction following, MCP tool usage, and safety; extend these drafts with domain regressions. - Diagnose upload failures, connector retry loops, OAuth lookup failures, and MCP handshake or tool-execution problems.
- Apply a controlled upgrade process when Microsoft releases a new Cowork manifest version.
Before you start
The guidance is useful in any Agent Skills host. To execute the included automation, the host or development machine needs:
- Python 3.10 or later (
python3on Linux/macOS;py -3on Windows). - Node.js and
npx. - Network access when Microsoft 365 Agents Toolkit validation is requested.
- A local plugin project or plugin ZIP for validation.
Toolkit downloads use https://registry.npmjs.org/ by default and ignore
project, user, and global npm configuration. Environments that require an
approved HTTPS registry mirror can set COWORK_ATK_REGISTRY to that URL.
Authenticated MCP connectors can also require a Microsoft Entra application, Teams Developer Portal OAuth configuration, user or administrator consent, and server-side allowed-client configuration.
Example requests
- “Create a skills-plus-MCP Cowork plugin from this existing Claude plugin.”
- “Validate this Cowork plugin ZIP and explain every failure.”
- “Generate a behavioral evaluation suite for this plugin.”
- “Fix the OAuth retry loop in this connector.”
- “Upgrade this plugin engineering project to the newest Cowork-supported manifest by following the included upgrade instructions.”
Included automation
| Script | Purpose |
|---|---|
new_cowork_plugin_project.py |
Scaffold a new plugin project. |
test_cowork_plugin.py |
Apply deep project and package checks. |
test_cowork_plugin_package.py |
Safely validate a supplied ZIP. |
set_cowork_oauth_reference.py |
Set an OAuth registration ID and increment the package version. |
build_cowork_plugin.py |
Package and validate with Agents Toolkit. |
new_cowork_plugin_evals.py |
Generate a draft Microsoft 365 Copilot evaluation dataset. |
Good to know
- Generated evaluation cases are drafts. Replace every
[REPLACE: ...]value with an approved prompt and expected response before running them. - The skill creates evaluation suites but does not run evaluations.
- Package validation does not prove that OAuth consent, server policy, or MCP runtime behavior is working. Those remain separate deployment gates.
- Current templates are versioned. Follow
assets/manifest-upgrade-instructions.mdrather than blindly changing the manifest version when a new schema appears. - Never put client secrets, access tokens, refresh tokens, cookies, or authorization codes in a plugin package or evaluation file.
