---
title: ToolRouter — Agent Use Case Guide
description: Step-by-step guide for completing a task with a specific AI agent using ToolRouter.
url: https://toolrouter.com/tools/pentest/use-cases/test-cors-security/copilot
---
# How to Test CORS Security with Copilot

Copilot integrates penetration testing directly into your development workflow, letting you scan for vulnerabilities and generate fix code without leaving your IDE. Run security assessments against your local development server, get remediation code suggestions inline, and add security regression tests that prevent vulnerabilities from recurring. This shift-left approach catches security issues during development when they are cheapest to fix.

## Setup

{"mcpServers":{"toolrouter":{"command":"npx","args":["-y","toolrouter-mcp"]}}}

## Steps

1. Add ToolRouter to Copilot MCP config
2. In Copilot Chat: "Test my API's CORS configuration" and provide the URL
3. Copilot tests CORS headers and returns findings
4. Ask: "Fix my CORS middleware to only allow these specific origins"
5. Apply the secure CORS configuration

## Example Prompt

```
Test the CORS setup on http://localhost:3001 and help me configure it securely for production with specific allowed origins.
```

## Tips

- Copilot can rewrite your CORS middleware to use a strict origin allowlist
- Test CORS after every deployment -- middleware changes can reset configurations
- Use environment-specific CORS configs -- localhost for dev, specific domains for production
