---
title: ToolRouter — Agent Use Case Guide
description: Step-by-step guide for completing a task with a specific AI agent using ToolRouter.
url: https://toolrouter.com/tools/pentest/use-cases/test-xss-exposure/copilot
---
# How to Test XSS Exposure with Copilot

Copilot integrates penetration testing directly into your development workflow, letting you scan for vulnerabilities and generate fix code without leaving your IDE. Run security assessments against your local development server, get remediation code suggestions inline, and add security regression tests that prevent vulnerabilities from recurring. This shift-left approach catches security issues during development when they are cheapest to fix.

## Setup

{"mcpServers":{"toolrouter":{"command":"npx","args":["-y","toolrouter-mcp"]}}}

## Steps

1. Add ToolRouter to Copilot MCP config
2. In Copilot Chat: "Test my app for XSS vulnerabilities" and provide the URL
3. Copilot runs XSS tests and returns vulnerable inputs
4. Ask: "Add proper output encoding to these vulnerable components"
5. Apply sanitization fixes in your codebase

## Example Prompt

```
Test http://localhost:3000 for XSS. Then help me add proper sanitization to any vulnerable React components.
```

## Tips

- Copilot can add sanitization directly to vulnerable component code
- React's JSX escapes by default, but dangerouslySetInnerHTML bypasses this protection
- Add XSS test cases to your test suite to prevent future regressions
