Copilot Cloud Agent

GitHub Copilot cloud agent works autonomously on assigned software-development tasks in an ephemeral GitHub Actions-powered environment, making code changes on a branch and producing a draft pull request for human review.

Recorded characteristics

Function

GitHub documents Copilot cloud agent as an autonomous agent that can be given a development task from entry points including GitHub issues, the agents panel, Copilot Chat, pull request @copilot mentions, IDEs, the REST API, GitHub CLI, GitHub MCP Server and third-party integrations, and can also be triggered by automations on a schedule or in response to events. GitHub states the agent works in its own ephemeral development environment powered by GitHub Actions, where it can explore repository code, make changes, and execute automated tests and linters. GitHub documents that Copilot automates branch creation, commit message writing and pushing, can research a repository and create an implementation plan, can open or update a draft pull request, and can iterate on changes in response to feedback and review comments. Custom agents (verified 2026-09-18): GitHub documents custom agents as specialized versions of the Copilot agent, defined in Markdown agent profiles with YAML frontmatter that specify a name, description, prompt, tools, model and MCP servers. GitHub states that when a user assigns the agent to a task or issue, it instantiates the custom agent. Custom agents are documented as a customization of Copilot cloud agent rather than a separate runtime: selection occurs in the agents panel or tab, on issue assignment, or through the GitHub Copilot CLI, and GitHub states Copilot notes which custom agent was used in the pull request description. No agent authority beyond that already documented for Copilot cloud agent is established for custom agents.

Data access

GitHub documents that the agent works in the repository specified when the task is started and, by default, can access context only in that repository; the GitHub MCP server is configured by default with a token that has read-only access to the current repository, and broader access can be configured. Documented context also includes the issue or prompt used to start the task, pull request comments, repository custom instructions and organisation custom instructions, and optionally Copilot Memory. GitHub states the agent does not have access to GitHub Actions, Codespaces or Dependabot secrets and variables; only dedicated Agents secrets and variables configured at repository or organisation level are passed to the agent, exposed as environment variables and masked in session logs. Internet access from the agent environment is limited by a firewall with a default recommended allowlist.

Actions

Can take actions

External actions

Conditional

Human confirmation

Conditional

Permission basis

Mixed

Administrative control

GitHub documents several controls tied to this capability: for Copilot Business and Copilot Enterprise, an organisation-level policy must enable the agent, and enablement may be controlled at enterprise level; enterprise administrators can block agentic features; enterprise administrators, organisation owners and owners of user-owned repositories can opt repositories out of the agent; organisations can control whether automations are allowed in a repository, and automations require a private or internal repository; repository administrators configure MCP servers, and organisation or repository administrators configure the internet-access firewall allowlist; repository administrators and organisation owners configure Agents secrets and variables; branch protections, required checks and rulesets apply to the agent's branch, and the workflow "Approve and run workflows" control governs GitHub Actions runs on its pull requests. Session logs, audit log events and Copilot usage metrics are available to administrators. Custom agent controls (verified 2026-09-18): agent profiles are stored at repository level in .github/agents, at organisation level in the /agents directory of the organisation .github or .github-private repository, and at enterprise level in the /agents directory of a .github-private repository in an organisation designated in enterprise settings. GitHub states organisation-level agents are available to all organisation members regardless of repository access, and that enterprise owners can configure a ruleset restricting custom agents. Profile authors control tool availability through the tools property, where omitting the property or using ["*"] enables all tools, an empty list disables all tools, and a specific list enables only named tools, including tools scoped to a specific MCP server. Profiles must be committed and merged into the default branch before the custom agent appears for selection.

Default state

Conditional

Availability

As documented on 2026-09-09, Copilot cloud agent is available for all paid Copilot plans and in all repositories stored on GitHub, except repositories owned by managed user accounts and repositories where it has been explicitly disabled. GitHub states the agent only works with repositories hosted on GitHub. Deep research, planning and iterating on code changes before creating a pull request are documented as available with the agent on GitHub.com, and in public preview for the Microsoft Teams and Slack integrations; other integrations such as Azure Boards, Jira or Linear are documented as supporting creating a pull request directly. Automations are documented as available with Copilot Pro, Pro+, Max, Business and Enterprise plans, in private or internal repositories only.

Licensing

GitHub documents that Copilot cloud agent is available for all paid Copilot plans. For Copilot Business and Copilot Enterprise, an administrator must enable the relevant policy. GitHub documents that the agent consumes GitHub Actions minutes and AI credits, with AI credits depending on the model used and tokens processed, and that usage within included Actions minutes and AI credits does not incur additional cost. No pricing figures are recorded here.

External model or provider

Not established for this capability. GitHub documents that, depending on how the task is started, the model used by Copilot cloud agent may be selectable, and points to separate documentation on changing the AI model. GitHub does not identify a single fixed model or external provider for this capability in the documentation reviewed, and no provider is recorded here.

Limitations and uncertainty

Documented limitations include: the agent can only make changes in the repository specified when the task is started and cannot work across multiple repositories in one run; it can work on only one branch at a time and can open exactly one pull request per assigned task; each session has a hard maximum execution time of 59 minutes; it only works with repositories hosted on GitHub; it cannot mark its pull requests ready for review and cannot approve or merge a pull request; it can only perform simple push operations and cannot directly run git push or other Git commands; repository rulesets or branch protection rules incompatible with the agent will block access unless Copilot is added as a bypass actor; it does not have access to Actions, Codespaces or Dependabot secrets; internet access is firewall-limited, and GitHub states the firewall only applies to processes started by the agent's Bash tool, does not apply to MCP servers or configured setup steps, only operates within the GitHub Actions appliance, and may be bypassed by sophisticated attacks. GitHub also states that where MCP servers are configured for a repository, Copilot will use available tools autonomously and will not ask for approval before use, and that by default the agent does not have access to write MCP server tools. Runtime model or provider identity is not established. Custom agents (verified 2026-09-18): GitHub states custom agents are in public preview and subject to change, and specifically in public preview for JetBrains IDEs, Eclipse and Xcode. The agent profile prompt is limited to 30,000 characters. The argument-hint and handoffs properties are not supported for Copilot cloud agent on GitHub.com and are ignored; mcp-servers and metadata are not used in VS Code and other IDE custom agents; the web and todo tool aliases are documented as currently not applicable for cloud agent. Whether a custom agent receives any runtime authority beyond that of Copilot cloud agent is not established: GitHub documents the profile as configuration that is instantiated by Copilot cloud agent.

Evidence

• About GitHub Copilot cloud agent

  Supports: Function · General · Actions · Data access · Availability · Licensing · External model · Limitations · Admin controls · Primary source

  GitHub states the agent can research a repository, create implementation plans, fix bugs, implement incremental features, improve test coverage, update documentation, address technical debt and resolve merge conflicts, working in an ephemeral GitHub Actions-powered environment where it can explore code, make changes and execute automated tests and linters.

  GitHub states Copilot cloud agent is distinct from IDE agent mode: the cloud agent works autonomously in a GitHub Actions-powered environment, while agent mode makes edits directly in the local development environment.

  GitHub states Copilot automates branch creation, commit message writing and pushing, and can make code changes on a branch and open a pull request.

  GitHub states the agent can only make changes in, and by default only access context in, the repository specified when the task is started, with broader access configurable through repository MCP settings.

  GitHub states the agent is available for all paid Copilot plans and in all repositories stored on GitHub, except repositories owned by managed user accounts and where explicitly disabled.

  GitHub states the agent is available for all paid Copilot plans, that Business and Enterprise require an administrator to enable the policy, and that it consumes GitHub Actions minutes and AI credits.

  GitHub states that, depending on how the task is started, the model used by the agent may be selectable, and links to separate documentation on changing the AI model; no single model or provider is specified.

  GitHub documents single-repository scope, one branch and one pull request per task, a hard 59-minute session limit, GitHub-hosted repositories only, and incompatibility with certain rulesets or branch protection rules unless Copilot is added as a bypass actor.

  GitHub states Business and Enterprise subscribers require an administrator to enable the relevant policy, and that repository owners can opt some or all repositories out.

• Risks and mitigations for GitHub Copilot cloud agent

  Supports: Actions · Human confirmation · Permission basis · Limitations · General · Data access · Primary source

  GitHub states the agent can push code changes to the repository, and describes mitigations limiting that ability rather than denying it.

  GitHub states draft pull requests created by the agent must be reviewed and merged by a human, that the agent cannot mark pull requests ready for review, approve or merge them, and that by default workflows are not triggered until a user with write access clicks Approve and run workflows, with an option to allow workflows to run automatically.

  GitHub states only users with write access can trigger the agent, that comments from users without write access are never presented to it, that the agent has limited credentials able only to perform simple push operations, that it can push to a single branch and is subject to branch protections and required checks, and that pull requests opened under its own app identity require an additional approval.

  GitHub states the agent can only push to a single branch, cannot run git push or other Git commands directly, cannot mark, approve or merge its own pull requests, and that automations ignore events from users without write access by default.

  GitHub states the agent checks generated code with CodeQL, dependency advisories and secret scanning by default, that its commits are signed and attributed with the requesting user as co-author, and that session logs and audit log events are available to administrators.

  GitHub states the agent has access to code and other sensitive information and that GitHub restricts its access to the internet to mitigate leakage, and that hidden characters such as HTML comments are filtered from user input before being passed to the agent.

• Managing access to GitHub Copilot cloud agent

  Supports: Default state · Admin controls · Availability · Primary source

  GitHub states the agent is disabled by default for Copilot Enterprise and Copilot Business subscribers and must be enabled by an administrator, and enabled by default for Copilot Pro, Pro+ and Max subscribers.

  GitHub states use is controlled by organisation-level policy for Business and Enterprise, may be controlled at enterprise level, that repositories can be opted out by enterprise administrators, organisation owners or users, and that organisations can control whether automations are allowed.

  GitHub states automations require a private or internal repository, the agent enabled for that repository, and organisation permission, and lists the plans for which automations are available.

• Model Context Protocol (MCP) and GitHub Copilot cloud agent

  Supports: External actions · Human confirmation · Admin controls · Primary source

  GitHub states the agent can use tools provided by local and remote MCP servers configured by repository administrators or for custom agents, that the GitHub MCP server is configured by default with a read-only token scoped to the current repository, and that the Playwright MCP server is by default limited to resources hosted in Copilot's own environment.

  GitHub states that once MCP servers are configured for a repository, Copilot will use available tools autonomously and will not ask for approval before use.

  GitHub states repository administrators configure MCP servers via repository settings, that configuration applies to both the cloud agent and code review, and advises restricting the tools field; by default the agent does not have access to write MCP server tools.

• Configure secrets and variables for Copilot cloud agent

  Supports: Data access · Admin controls · Primary source

  GitHub states dedicated Agents secrets and variables configured at repository or organisation level are exposed to the agent as environment variables and masked in session logs, and that the agent does not have access to GitHub Actions, Codespaces or Dependabot secrets and variables.

  GitHub states repository administrators configure repository-level Agents secrets and variables and organisation owners configure organisation-level ones with repository-access scoping.

• Customizing or disabling the firewall for GitHub Copilot

  Supports: External actions · Limitations · Primary source

  GitHub states the agent's access to the internet is limited by a firewall with a recommended allowlist enabled by default, configurable at organisation and repository level, and that blocked requests are reported in the pull request.

  GitHub states the firewall only applies to processes started by the agent's Bash tool, does not apply to MCP servers or configured setup steps, only operates within the GitHub Actions appliance, and may be bypassed by sophisticated attacks.

• Configure the development environment

  Supports: Function · Permission basis · Primary source

  GitHub states the agent has its own ephemeral development environment powered by GitHub Actions where it can build or compile the project and run automated tests, linters and other tools, customisable through a copilot-setup-steps.yml workflow file.

  GitHub states Copilot is given its own token for its operations in the agent environment.

• Starting GitHub Copilot sessions

  Supports: Function · Primary source

  GitHub lists the entry points from which agent sessions can be started, including GitHub issues, the agents tab, Copilot Chat, GitHub Mobile, IDEs, the REST API, GitHub CLI, the GitHub MCP Server and third-party tools, and states some entry points open a pull request automatically.

• About custom agents

  Supports: Function · Availability · Admin controls · Limitations · Primary source

  GitHub states custom agents are specialized versions of the Copilot agent defined in Markdown agent profiles specifying prompts, tools and MCP servers, and that assigning the agent to a task or issue instantiates the custom agent.

  GitHub lists where custom agents can be used: Copilot cloud agent on GitHub.com (agents tab and panel, issue assignment and pull requests), Copilot cloud agent in Visual Studio Code, JetBrains IDEs, Eclipse and Xcode, the GitHub Copilot app and GitHub Copilot CLI.

  GitHub documents agent profile locations at repository level (.github/agents), organisation level (/agents in .github or .github-private) and enterprise level (/agents in a designated .github-private repository).

  GitHub states custom agents are in public preview for JetBrains IDEs, Eclipse and Xcode and subject to change, and that some properties may function differently or be ignored between environments.

• Creating custom agents for Copilot cloud agent

  Supports: Function · Admin controls · Primary source

  GitHub documents that a custom agent is selected from the dropdown in the agents panel or tab, when assigning an issue, or through the GitHub Copilot CLI /agent command, and that Copilot notes which custom agent was used in the pull request description.

  GitHub documents that the agent profile must be committed to the repository and merged into the default branch before the custom agent appears for selection.

• Custom agents configuration

  Supports: Admin controls · Actions · External actions · Data access · Limitations · General · Primary source

  GitHub documents that the tools property filters the tools made available to the agent: omitting it or using ["*"] enables all tools, an empty list disables all tools, and a specific list enables only the named tools or MCP server tools.

  GitHub documents built-in tool aliases available to custom agents running on cloud agent, including execute (bash or powershell), read, edit, search and agent, and notes that web and todo are currently not applicable for cloud agent.

  GitHub documents that agent profiles can specify additional MCP servers with the mcp-servers property and that an agent can use MCP tools configured in the agent profile and/or repository settings, with out-of-the-box MCP configuration processed first, then the agent profile, then repository settings.

  GitHub states that for the out-of-the-box github MCP server all read-only tools are available by default and the token the server receives is scoped to the source repository.

  GitHub states the agent profile prompt can be a maximum of 30,000 characters, that the argument-hint and handoffs properties are not supported for Copilot cloud agent on GitHub.com and are ignored, that mcp-servers and metadata are not used in VS Code and other IDE custom agents, and that unrecognized tool names are ignored.

  GitHub documents that custom agent versioning is based on Git commit SHAs of the agent profile file, that a custom agent is instantiated using the latest version of the profile for that repository and branch, and that lower-level (repository) configuration overrides organisation and enterprise configuration on name conflicts.

• Preparing to use custom agents in your organization

  Supports: Admin controls · Limitations · Primary source

  GitHub states organisation-level custom agents are stored in the /agents directory of the organisation .github or .github-private repository, are available to all organisation members regardless of repository access, and that enterprise owners can configure a ruleset restricting custom agents.

  GitHub states Copilot custom agents are in public preview and subject to change.