Create, import, validate, authenticate, package, evaluate, and troubleshoot Microsoft Copilot Cowork plugins with repeatable engineering guardrails.

Copilot Cowork Plugin Engineer

Build and maintain Microsoft Copilot Cowork plugins with a repeatable, validation-first workflow. This Agent Skill combines practical guidance, versioned templates, and Python 3.10+ automation to reduce mistakes across plugin structure, Model Context Protocol (MCP) connectors, OAuth, packaging, evaluation design, and manifest upgrades.

This submission is an unpacked Agent Skill, not a Cowork plugin package. Use it to create and validate plugin packages in your own workspace.

Capabilities

Scaffold a Cowork plugin project with the Microsoft 365 app-package layout.
Import and normalize existing Claude Code or Cursor plugins.
Support skills-only, connector-only, and combined package designs.
Guide OAuth registration and reject unresolved authentication placeholders.
Validate manifests, icons, skills, connectors, MCP tool descriptions, and package limits.
Safely inspect an existing plugin ZIP without trusting or manually extracting its contents.
Package and validate plugins with Microsoft 365 Agents Toolkit.
Generate draft evals.json suites for skill routing, instruction following, MCP tool usage, and safety; extend these drafts with domain regressions.
Diagnose upload failures, connector retry loops, OAuth lookup failures, and MCP handshake or tool-execution problems.
Apply a controlled upgrade process when Microsoft releases a new Cowork manifest version.

Before you start

The guidance is useful in any Agent Skills host. To execute the included automation, the host or development machine needs:

Python 3.10 or later (python3 on Linux/macOS; py -3 on Windows).
Node.js and npx.
Network access when Microsoft 365 Agents Toolkit validation is requested.
A local plugin project or plugin ZIP for validation.

Toolkit downloads use https://registry.npmjs.org/ by default and ignore project, user, and global npm configuration. Environments that require an approved HTTPS registry mirror can set COWORK_ATK_REGISTRY to that URL.

Authenticated MCP connectors can also require a Microsoft Entra application, Teams Developer Portal OAuth configuration, user or administrator consent, and server-side allowed-client configuration.

Example requests

“Create a skills-plus-MCP Cowork plugin from this existing Claude plugin.”
“Validate this Cowork plugin ZIP and explain every failure.”
“Generate a behavioral evaluation suite for this plugin.”
“Fix the OAuth retry loop in this connector.”
“Upgrade this plugin engineering project to the newest Cowork-supported manifest by following the included upgrade instructions.”

Included automation

Script	Purpose
`new_cowork_plugin_project.py`	Scaffold a new plugin project.
`test_cowork_plugin.py`	Apply deep project and package checks.
`test_cowork_plugin_package.py`	Safely validate a supplied ZIP.
`set_cowork_oauth_reference.py`	Set an OAuth registration ID and increment the package version.
`build_cowork_plugin.py`	Package and validate with Agents Toolkit.
`new_cowork_plugin_evals.py`	Generate a draft Microsoft 365 Copilot evaluation dataset.

Good to know

Generated evaluation cases are drafts. Replace every [REPLACE: ...] value with an approved prompt and expected response before running them.
The skill creates evaluation suites but does not run evaluations.
Package validation does not prove that OAuth consent, server policy, or MCP runtime behavior is working. Those remain separate deployment gates.
Current templates are versioned. Follow assets/manifest-upgrade-instructions.md rather than blindly changing the manifest version when a new schema appears.
Never put client secrets, access tokens, refresh tokens, cookies, or authorization codes in a plugin package or evaluation file.