Add session info to initialize response metadata

[Copilot]

Summary

The initialize response now includes _meta.sessionInfo with user details (from get_me), enabled toolsets/tools, and configuration flags (readOnly, lockdown, dynamicToolsets).

Why

Eliminates wasteful get_me tool call at session start. Users immediately see who they're authenticated as and what's enabled.

What changed

• Added addSessionInfoMiddleware that enriches InitializeResult with session metadata during initialize
• Middleware fetches user info via get_me API call, omits on failure (graceful degradation)
• Added addUnauthenticatedSessionInfoMiddleware for OAuth flow (shows authenticated: false, config only)
• Removed "Call get_me to see who you're logged in as" from auth_login success message
• Added comprehensive unit tests for both middleware variants

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added

Initialize response now includes optional _meta.sessionInfo field. No breaking changes—clients ignore unknown metadata fields.

Prompts tested (tool changes only)

N/A

Security / limits

• No security or limits impact
• Auth / permissions considered
• Data exposure, filtering, or token/size limits considered

User info only included when authenticated. Reuses existing get_me endpoint with same permissions.

Lint & tests

• Linted locally with ./script/lint
• Tested locally with ./script/test

Docs

• Not needed
• Updated (README / docs / examples)

Change is transparent to clients—metadata appears automatically in initialize response.

Example

Authenticated mode:

{
  "_meta": {
    "sessionInfo": {
      "user": {
        "login": "octocat",
        "id": 583231,
        "profileURL": "https://github.com/octocat",
        "name": "The Octocat"
      },
      "enabledToolsets": ["repos", "issues"],
      "toolsetsMode": "explicit",
      "readOnlyMode": false,
      "lockdownMode": false,
      "dynamicToolsets": false
    }
  }
}

Unauthenticated mode:

{
  "_meta": {
    "sessionInfo": {
      "authenticated": false,
      "enabledToolsets": ["context", "issues", "pull_requests", "repos", "users"],
      "toolsetsMode": "default",
      "readOnlyMode": false,
      "lockdownMode": false,
      "dynamicToolsets": false
    }
  }
}

Original prompt

Would you look at returning the response of get me as part of the success response rather than suggesting making a tool call. If it fails just omit it, that feels more natural. We don't need to prove anything.

We could tell the user also the toolsets (or all or default) enabled, individual tools specifically enabled and if readonly mode or lockdown mode are on or not.

Is that a cool idea? Make it so the user gets a really great start to their authenticated session. Without wasting a second tool call.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.