Step 1 — Create an agent token

BoxOwl Android app: Settings → AI Agent Connections → New. Name "Copilot on <machine>"; starter scopes vault:read, profile:read, agent:query. Copy the plaintext token.

Step 2 — Install the local daemon

brew install boxowl/tap/boxowl-daemon

Step 3 — Run the skills installer

npx @boxowl/skills add --platform=github-copilot --token=bxusr_…

Writes to:

VS Code is the only MCP host today that puts servers under the servers key (not mcpServers) and requires type: "stdio" per entry. If you ever inspect the file by hand, don't "normalize" the key shape — that's VS Code's contract, not a typo.

Step 4 — Restart VS Code

Fully quit VS Code (not just close the window) and reopen. VS Code loads MCP servers at startup; the new boxowl server appears under Copilot's tool list after the restart.

Step 5 — Test a query

Open Copilot Chat in VS Code, switch to agent mode, and ask:

What's the shipping address on my BoxOwl vault?

Copilot invokes boxowl_get_item address.primary through the MCP transport, the local daemon decrypts the row, and the answer surfaces in the chat panel. High-risk writes (credential saves, payment edits) gate behind a confirmation prompt per the daemon's BOX-403-002 envelope.

Remove the connection

npx @boxowl/skills remove --platform=github-copilot

Strips the boxowl entry from VS Code's mcp.json. Other MCP servers under servers stay intact.