Add local-power-automate-mcp skill (self-hosted, privacy-first Power Automate MCP)

[prasadgd9022]

What

Adds a new Agent Skill: local-power-automate-mcp — a foundation skill for driving Microsoft Power Automate from an AI agent through a self-hosted, privacy-first local MCP server that authenticates with the operator's own Azure CLI (az login) identity.

Why it is not a duplicate

The repo already ships the flowstudio-power-automate-* skill family, but those are built entirely around a hosted, paid MCP (remote HTTP endpoint, x-api-key JWT, tenant data routed through the vendor cloud). This skill fills the gap they do not cover:

• Self-hosted / local stdio server instead of a remote SaaS endpoint
• az login (Azure CLI) identity auth instead of portal-issued API keys — no key to paste, RBAC-bounded by the signed-in user
• Privacy / data-residency model — nothing leaves the machine (direct to api.flow.microsoft.com + Dataverse)
• confirm=True dry-run write-safety pattern for Dataverse writes
• Per-environment env-var nuance (current value vs shared default)
• Sovereign / government-cloud configuration via PA_MCP_* env vars
• stdio registration steps for Copilot CLI, VS Code, and Claude

It is open source (MIT) and not a paid service, so the paid-submission path does not apply.

Checklist

• SKILL.md with frontmatter; name matches folder; single-quoted description (10–1024 chars)
• npm run skill:validate → local-power-automate-mcp is valid
• npm run build → added to docs/README.skills.md
• Line endings normalized to LF
• Targets the staged branch

Reference implementation (MIT): https://github.com/prasadgd9022/power-automate-mcp

[Copilot]

Pull request overview

Adds a self-hosted Power Automate MCP skill focused on local execution, Azure CLI authentication, and guarded Dataverse writes.

Changes:

• Documents MCP registration, authentication, tools, and safety patterns.
• Adds sovereign-cloud and oversized-response guidance.
• Publishes the skill in the generated catalog.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.

File	Description
skills/local-power-automate-mcp/SKILL.md	Defines the new skill and operational guidance.
docs/README.skills.md	Adds the skill to the generated index.

[prasadgd9022]

Thanks for the detailed review — addressed in f2458c56. Summary of changes:

1. Base branch (staged vs main) — keeping staged. CONTRIBUTING.md and current repo practice route contributions through staged; retargeting to main on request.
2. Data-residency claim — replaced "no tenant flow data leaving the machine" with "not routed through third-party SaaS" and clarified all calls go to Microsoft over HTTPS. Applied to the intro, trust table, frontmatter description, and regenerated docs/README.skills.md.
3. "air-gapped" — removed; the server requires Azure sign-in + HTTPS to Power Automate/Dataverse.
4. "auth failure is always a sign-in issue" — removed that absolute; broadened the troubleshooting note to cover cloud selection, PA_MCP_SCOPE/PA_MCP_API_HOST mismatch, conditional-access policy, and missing permissions.
5. set_flow_state — changed the guard column to "no code guard — confirm with the user first" and noted disabling a scheduled flow can miss events.
6. Dry-run "round-trips" overstatement — corrected to reflect the implementation: it only checks the string is well-formed JSON and reports clientdataChars + containsDefinition; added an explicit warning that a passing dry-run is a syntax check, not a correctness guarantee.
7. PA_MCP_ACCESS_TOKEN — qualified as Flow-API-scope only; Dataverse tools still acquire their own org-scoped token, so one raw token does not unlock all 11 tools.
8. Truncation — clarified truncation happens server-side before the agent sees the payload, and added a hard warning never to feed a truncated clientdata into update_flow_definition (re-fetch with a higher PA_MCP_MAX_RESPONSE_CHARS first).
9. Sovereign-cloud setup — added az cloud set before az login plus a host/scope table for Commercial / US Gov / China, with a note to confirm current endpoints against Microsoft docs.

npm run skill:validate passes for this skill and npm run build regenerated the catalog row.

[prasadgd9022]

@aaronpowell Please review the PR