Microsoft Copilot Studio MCP vs Gumloop

Microsoft Copilot Studio MCP

Entra sign-in with per-resource scopes, tokens kept only in memory, and a plan-then-confirm step before connector writes. The package is a day old, the linked MIT repository holds no source, no changelog or support channel exists, the five cloud tools' schemas are visible only after sign-in, and workflow tests run live workflows billed in Copilot Credits.

Gumloop

Gumloop's REST API has a public OpenAPI file with 105 operations, Markdown docs and a changelog with 28 dated releases since 9 July 2026. API keys need the $37 Pro plan, the trial needs a card, the key can travel in the URL, and self-serve content may be used to train Gumloop's models.

Microsoft Copilot Studio MCP

1. Call copilot_studio_status first and reuse a ready session. Don't reconnect or reselect an environment to start a new task
2. Read an action's contract with discover_resources and action=describe_actions before building unfamiliar parameters
3. Ask the person before testing a workflow. Tests run published, enabled workflows and can have real effects
4. Never retry an uncertain write. Inspect the agent, workflow or connection first, as the error text says
5. Expect a browser sign-in after every restart. Tell the person a window is opening and never ask for credentials in chat

Gumloop

1. Send the key as Authorization: Bearer and, for a personal key, add the x-auth-key header with the user ID. Do not put api_key in the URL
2. Create sessions with POST /agents/{agent_id}/sessions, then poll GET /sessions/{session_id}. A 202 means processing or queued, and the reply is not in the response
3. Supply your own session_id when creating a session. A repeat returns 409, which makes a retry safe
4. For streamed output send the same body with stream: true to ws.gumloop.com. api.gumloop.com answers 400 to it
5. Treat a webhook trigger URL as a password. It returns {"success": true} at once and never carries the agent's output