Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Canvas Apps Authoring MCP: Testing what it can do

So Canvas Apps Authoring MCP is here in Preview. I have no doubt that it can generate something, but we need a timesaver, not more hours cleaning up after it. And I showed up with a list of demands >>>>> My…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

So Canvas Apps Authoring MCP is here in Preview. I have no doubt that it can generate something, but we need a timesaver, not more hours cleaning up after it. And I showed up with a list of demands >>>>>






My checklist




  • follow naming convention

  • use color/layout scheme from named formulas

  • see (and use) custom components

  • not main point, but add accessibility labels (the most ignored section of app checker)






Setup



On Power Platform side:

Canvas app with Coauthoring enabled (Settings > Updates > Coauthoring)



Local setup:

1) .NET SDK v10+

dotnet --version // check version

2) GitHub Copilot CLI or Claude Code



My choice is Claude Code, and my setup (or install from marketplace):

1) If wasn’t done before - Install Claude Code (one time)

npm install -g @anthropic-ai/claude-code



2) Clone the Power Platform skills repo (one time)

git clone https://github.com/microsoft/power-platform-skills.git



3) Launch Claude Code with the canvas-apps plugin

claude --plugin-dir ./power-platform-skills/plugins/canvas-apps



After everything's installed, /configure-canvas-mcp will help to connect to the app you will work on

Canvas app URL configuration in Claude Code





What the MCP actually exposes



Skills:





  • /configure-canvas-mcp

  • /generate-canvas-app


  • /edit-canvas-app



I don’t see a lot of difference between generate and edit app, as you need to create some app anyway for /generate-canvas-app. So after the initial generation flow will be almost the same (or there is some hidden treasure I don't get yet). And I would like to prepare an app with some artefacts before adding components.



And for tools:





  • compile_canvas: validate YAML


  • sync_canvas: push/pull from the coauthoring session


  • get_accessibility_errors: check accessibility (okay, I see, my future favorite tool)


  • describe_control, list_controls, describe_api, list_apis, list_data_sources, get_data_source_schema





Test time



I'm building a Tea Collection app, just a table with items from Sharepoint and edit form.



Sharepoint List is ready:

SharePoint Tea Collection list



I tried to prepare a canvas app with background and my custom Header, which was kind of a mistake, as the MCP got confused with the custom component and deleted it "to fix validation errors."

Prepared canvas app screen with custom header and background



Also I added layout and theme to App.Formulas, which was not really helpful either. At first the generated components used these variables, but then it started to cry that it couldn't compile it, and replaced them with hardcoded values (but at least it used correct values):




fxAppColors = {
Primary: ColorValue("#556B2F"), // Dark Olive Green - main brand color
Secondary: ColorValue("#A9A454"), // Olive Green - complementary accent
Accent: ColorValue("#b07946"), // Bourbon - warm highlight (buttons, links)
Background: ColorValue("#EFE4D4"), // Quarter Spanish White - page/card background
Dark: ColorValue("#151618") // Black Russian - text, headers, navbar
};

fxAppSpacing = {
XS: 4,
S: 8,
M: 16,
L: 24,
XL: 32
};






So first prompt will go just to create a table from SP items:

First generated gallery result



As a result for a pretty vague prompt, this looks fine. So with a better description (adding filter, search, and proper margins), we get closer:

Gallery with search and filters added





Test 2: Form to edit tea



Before the form I wanted to check one thing. I added a blank screen (just background), so MCP would use it as a base instead of creating its own. This one worked ✨



Then I went with a more precise description of what I want:




Prompt:   
Create a new screen for edit form.
Form should have 2 containers.
Left container should be 2/3 screen, with fields: Title, Brand, Type, Origin, Caffeine Level, Additions, Ratings, Loose.
Right Container should be 1/3 of screen, fields: Notes, Opened date, In Stock.
Add buttons: Back and Save.






I mixed up left and right a few times on prompt. Outside is safe only until I get a driving license

Edit form first iteration



More detailed prompt gave a better result, who would know.



With a few more prompts to fix the blue color, move Loose and Rating fields in one line, update Save button logic with IfError, and move buttons to the footer, now it's something close to what I wanted:

Edit form final result





Scorecard against the original checklist



Back to the checklist:

1) Naming convention

In general fine, but it's like it was written by someone who heard about it but didn't actually open the code readability page. So we got tog (not tgl), rec (should be shp), inp (should be txt).


2) Use named formulas

It is aware of them, knows values, but gets cranky working with them. Maybe a temp workaround is to generate the layout with hardcoded values and with the last prompt replace them with named formulas.


3) Custom components

No luck here yet, but it's early days


4) Accessibility labels

Not included during generation by default, but since get_accessibility_errors exists, it can be done at the end or included in the prompt.





Round 2: feeding findings into memory and retrying



Now that I know the blind spots, I added my findings into Claude Code's memory and tried again from scratch.




New prompt:  
Edit the existing HomeScreen.
Add a gallery styled as a table showing items from SharePoint list "TeaCollection_SPList".
Columns: Title, Brand, Origin, Rating, Loose, OpenedDate, InStock
Layout:
Top: empty container named conFunctionalBar (for future search/filter controls)
Below: gallery table
Styling:
Use fxAppColors and fxAppSpacing from App.Formulas for all colors and spacing
Add margins (left, right, bottom) using fxAppSpacing values
Reference snippets/gallery.txt and snippets/gallery-header.txt for structure and theming.
Add sorting to Title and Brand.






And then to add search and filters:




Edit conFunctionalBar:
- Left: search input for filtering gallery items. Reference snippets/search.txt
- Right: filter button to open/close filter panel. Reference snippets/filterButton.txt

Add filter panel (1/3 screen width, right side):
- Filters: Loose (toggle), In Stock (toggle), Rating (slider), Opened Date (date picker)
- Two buttons at the bottom: Apply and Clear
- Clear closes panel and resets filter values
- Apply closes panel and filters gallery items

When panel is open, the remaining 2/3 of the screen should have a semi-transparent overlay (blur/dim effect).






Where we ended:

Gallery with search, filters and overlay panel after memory-guided prompts



Fabulous 💃






Verdict



Generated apps seem nice and usable, and most important functional. Custom components and formulas support is on my wishlist, so I'll come back to check closer to GA 💚






What else to check if you want to start:



GitHub - Canvas Apps Plugin

MS Docs - Create and edit canvas apps with AI code generation tools (preview)

Editing Canvas Power Apps with GitHub Copilot

(new release) From Idea to App in Minutes: What the Canvas Apps MCP Plugin Means for Real Projects

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Canvas Apps Authoring MCP: Testing what it can do
id: 5c4fb46b-cccb-4b63-82ba-158e69d82a00
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Canvas Apps Authoring MCP: Tes" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Canvas Apps Authoring MCP Testing what i")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Canvas Apps Authoring MCP Testing what i*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Canvas Apps Authoring MCP Testing what i"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Canvas Apps Authoring MCP: Testing what .... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Canvas Apps Authoring MCP: Testing what it can do

Thematisch verwandte Begriffe: Canvas, Apps, Authoring, Testing · 6 Treffer

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-88003 | InvoicePlane is a self-hosted open source application for managing invoi…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag