An organization wants a custom Copilot cloud agent to diagnose Sentry-backed GitHub issues. The agent should use only the external tools required for diagnosis, authenticate through the correct Copilot agent secret mechanism, and prove the tools are available before the agent is used broadly. Which four actions should you perform in order? 1. Identify the exact repository and external tools required 2. Enable every MCP tool for faster first-run discovery 3. Configure the MCP server with specific allowed tools 4. Store the token as a matching Agents secret 5. Save a broad PAT as a GitHub Actions secret 6. Run a test session and review MCP startup logs

The correct order ensures a secure, controlled, and verified setup. First, identify the exact repository and external tools needed (1) to define the scope and avoid unnecessary access. Next, store the authentication token as a matching Agents secret (4), adhering to the Copilot agent's specific secret mechanism for secure access. Then, configure the MCP server with only the specific allowed tools (3), restricting the agent's capabilities to only what's necessary for diagnosis, enhancing security and preventing misuse. Finally, run a test session and review MCP startup logs (6) to confirm the tools are available and the agent functions as expected before broad deployment. Option 2 is incorrect because enabling every MCP tool (2) is insecure and goes against the requirement to use only the external tools required. Option 5 is incorrect because saving a broad PAT (5) is less secure than using the Copilot agent's specific secret mechanism and grants excessive permissions.