Copilot Cloud Agent

GitHub Copilot cloud agent works autonomously on assigned software-development tasks in an ephemeral GitHub Actions-powered environment, making code changes on a branch and producing a draft pull request for human review.

Recorded characteristics

Function

GitHub documents Copilot cloud agent as an autonomous agent that can be given a development task from entry points including GitHub issues, the agents panel, Copilot Chat, pull request @copilot mentions, IDEs, the REST API, GitHub CLI, GitHub MCP Server and third-party integrations, and can also be triggered by automations on a schedule or in response to events. GitHub states the agent works in its own ephemeral development environment powered by GitHub Actions, where it can explore repository code, make changes, and execute automated tests and linters. GitHub documents that Copilot automates branch creation, commit message writing and pushing, can research a repository and create an implementation plan, can open or update a draft pull request, and can iterate on changes in response to feedback and review comments.

Data access

GitHub documents that the agent works in the repository specified when the task is started and, by default, can access context only in that repository; the GitHub MCP server is configured by default with a token that has read-only access to the current repository, and broader access can be configured. Documented context also includes the issue or prompt used to start the task, pull request comments, repository custom instructions and organisation custom instructions, and optionally Copilot Memory. GitHub states the agent does not have access to GitHub Actions, Codespaces or Dependabot secrets and variables; only dedicated Agents secrets and variables configured at repository or organisation level are passed to the agent, exposed as environment variables and masked in session logs. Internet access from the agent environment is limited by a firewall with a default recommended allowlist.

Actions

Can take actions

External actions

Conditional

Human confirmation

Conditional

Permission basis

Mixed

Administrative control

GitHub documents several controls tied to this capability: for Copilot Business and Copilot Enterprise, an organisation-level policy must enable the agent, and enablement may be controlled at enterprise level; enterprise administrators can block agentic features; enterprise administrators, organisation owners and owners of user-owned repositories can opt repositories out of the agent; organisations can control whether automations are allowed in a repository, and automations require a private or internal repository; repository administrators configure MCP servers, and organisation or repository administrators configure the internet-access firewall allowlist; repository administrators and organisation owners configure Agents secrets and variables; branch protections, required checks and rulesets apply to the agent's branch, and the workflow "Approve and run workflows" control governs GitHub Actions runs on its pull requests. Session logs, audit log events and Copilot usage metrics are available to administrators.

Default state

Conditional

Availability

As documented on 2026-09-09, Copilot cloud agent is available for all paid Copilot plans and in all repositories stored on GitHub, except repositories owned by managed user accounts and repositories where it has been explicitly disabled. GitHub states the agent only works with repositories hosted on GitHub. Deep research, planning and iterating on code changes before creating a pull request are documented as available with the agent on GitHub.com, and in public preview for the Microsoft Teams and Slack integrations; other integrations such as Azure Boards, Jira or Linear are documented as supporting creating a pull request directly. Automations are documented as available with Copilot Pro, Pro+, Max, Business and Enterprise plans, in private or internal repositories only.

Licensing

GitHub documents that Copilot cloud agent is available for all paid Copilot plans. For Copilot Business and Copilot Enterprise, an administrator must enable the relevant policy. GitHub documents that the agent consumes GitHub Actions minutes and AI credits, with AI credits depending on the model used and tokens processed, and that usage within included Actions minutes and AI credits does not incur additional cost. No pricing figures are recorded here.

External model or provider

Not established for this capability. GitHub documents that, depending on how the task is started, the model used by Copilot cloud agent may be selectable, and points to separate documentation on changing the AI model. GitHub does not identify a single fixed model or external provider for this capability in the documentation reviewed, and no provider is recorded here.

Limitations and uncertainty

Documented limitations include: the agent can only make changes in the repository specified when the task is started and cannot work across multiple repositories in one run; it can work on only one branch at a time and can open exactly one pull request per assigned task; each session has a hard maximum execution time of 59 minutes; it only works with repositories hosted on GitHub; it cannot mark its pull requests ready for review and cannot approve or merge a pull request; it can only perform simple push operations and cannot directly run git push or other Git commands; repository rulesets or branch protection rules incompatible with the agent will block access unless Copilot is added as a bypass actor; it does not have access to Actions, Codespaces or Dependabot secrets; internet access is firewall-limited, and GitHub states the firewall only applies to processes started by the agent's Bash tool, does not apply to MCP servers or configured setup steps, only operates within the GitHub Actions appliance, and may be bypassed by sophisticated attacks. GitHub also states that where MCP servers are configured for a repository, Copilot will use available tools autonomously and will not ask for approval before use, and that by default the agent does not have access to write MCP server tools. Runtime model or provider identity is not established.

Evidence

• About GitHub Copilot cloud agent

  Supports: Function · General · Actions · Data access · Availability · Licensing · External model · Limitations · Admin controls · Primary source

  GitHub states the agent can research a repository, create implementation plans, fix bugs, implement incremental features, improve test coverage, update documentation, address technical debt and resolve merge conflicts, working in an ephemeral GitHub Actions-powered environment where it can explore code, make changes and execute automated tests and linters.

  GitHub states Copilot cloud agent is distinct from IDE agent mode: the cloud agent works autonomously in a GitHub Actions-powered environment, while agent mode makes edits directly in the local development environment.

  GitHub states Copilot automates branch creation, commit message writing and pushing, and can make code changes on a branch and open a pull request.

  GitHub states the agent can only make changes in, and by default only access context in, the repository specified when the task is started, with broader access configurable through repository MCP settings.

  GitHub states the agent is available for all paid Copilot plans and in all repositories stored on GitHub, except repositories owned by managed user accounts and where explicitly disabled.

  GitHub states the agent is available for all paid Copilot plans, that Business and Enterprise require an administrator to enable the policy, and that it consumes GitHub Actions minutes and AI credits.

  GitHub states that, depending on how the task is started, the model used by the agent may be selectable, and links to separate documentation on changing the AI model; no single model or provider is specified.

  GitHub documents single-repository scope, one branch and one pull request per task, a hard 59-minute session limit, GitHub-hosted repositories only, and incompatibility with certain rulesets or branch protection rules unless Copilot is added as a bypass actor.

  GitHub states Business and Enterprise subscribers require an administrator to enable the relevant policy, and that repository owners can opt some or all repositories out.

• Risks and mitigations for GitHub Copilot cloud agent

  Supports: Actions · Human confirmation · Permission basis · Limitations · General · Data access · Primary source

  GitHub states the agent can push code changes to the repository, and describes mitigations limiting that ability rather than denying it.

  GitHub states draft pull requests created by the agent must be reviewed and merged by a human, that the agent cannot mark pull requests ready for review, approve or merge them, and that by default workflows are not triggered until a user with write access clicks Approve and run workflows, with an option to allow workflows to run automatically.

  GitHub states only users with write access can trigger the agent, that comments from users without write access are never presented to it, that the agent has limited credentials able only to perform simple push operations, that it can push to a single branch and is subject to branch protections and required checks, and that pull requests opened under its own app identity require an additional approval.

  GitHub states the agent can only push to a single branch, cannot run git push or other Git commands directly, cannot mark, approve or merge its own pull requests, and that automations ignore events from users without write access by default.

  GitHub states the agent checks generated code with CodeQL, dependency advisories and secret scanning by default, that its commits are signed and attributed with the requesting user as co-author, and that session logs and audit log events are available to administrators.

  GitHub states the agent has access to code and other sensitive information and that GitHub restricts its access to the internet to mitigate leakage, and that hidden characters such as HTML comments are filtered from user input before being passed to the agent.

• Managing access to GitHub Copilot cloud agent

  Supports: Default state · Admin controls · Availability · Primary source

  GitHub states the agent is disabled by default for Copilot Enterprise and Copilot Business subscribers and must be enabled by an administrator, and enabled by default for Copilot Pro, Pro+ and Max subscribers.

  GitHub states use is controlled by organisation-level policy for Business and Enterprise, may be controlled at enterprise level, that repositories can be opted out by enterprise administrators, organisation owners or users, and that organisations can control whether automations are allowed.

  GitHub states automations require a private or internal repository, the agent enabled for that repository, and organisation permission, and lists the plans for which automations are available.

• Model Context Protocol (MCP) and GitHub Copilot cloud agent

  Supports: External actions · Human confirmation · Admin controls · Primary source

  GitHub states the agent can use tools provided by local and remote MCP servers configured by repository administrators or for custom agents, that the GitHub MCP server is configured by default with a read-only token scoped to the current repository, and that the Playwright MCP server is by default limited to resources hosted in Copilot's own environment.

  GitHub states that once MCP servers are configured for a repository, Copilot will use available tools autonomously and will not ask for approval before use.

  GitHub states repository administrators configure MCP servers via repository settings, that configuration applies to both the cloud agent and code review, and advises restricting the tools field; by default the agent does not have access to write MCP server tools.

• Configure secrets and variables for Copilot cloud agent

  Supports: Data access · Admin controls · Primary source

  GitHub states dedicated Agents secrets and variables configured at repository or organisation level are exposed to the agent as environment variables and masked in session logs, and that the agent does not have access to GitHub Actions, Codespaces or Dependabot secrets and variables.

  GitHub states repository administrators configure repository-level Agents secrets and variables and organisation owners configure organisation-level ones with repository-access scoping.

• Customizing or disabling the firewall for GitHub Copilot

  Supports: External actions · Limitations · Primary source

  GitHub states the agent's access to the internet is limited by a firewall with a recommended allowlist enabled by default, configurable at organisation and repository level, and that blocked requests are reported in the pull request.

  GitHub states the firewall only applies to processes started by the agent's Bash tool, does not apply to MCP servers or configured setup steps, only operates within the GitHub Actions appliance, and may be bypassed by sophisticated attacks.

• Configure the development environment

  Supports: Function · Permission basis · Primary source

  GitHub states the agent has its own ephemeral development environment powered by GitHub Actions where it can build or compile the project and run automated tests, linters and other tools, customisable through a copilot-setup-steps.yml workflow file.

  GitHub states Copilot is given its own token for its operations in the agent environment.

• Starting GitHub Copilot sessions

  Supports: Function · Primary source

  GitHub lists the entry points from which agent sessions can be started, including GitHub issues, the agents tab, Copilot Chat, GitHub Mobile, IDEs, the REST API, GitHub CLI, the GitHub MCP Server and third-party tools, and states some entry points open a pull request automatically.