SoftTech AI Registry
GitHub · GitHub Copilot

Copilot Code Review

AI review of proposed code changes that publishes pull request review comments and suggested changes on GitHub.

Recorded characteristics

Function
Reviews proposed code changes and publishes AI-generated pull request review feedback on GitHub. GitHub documents that Copilot scans the code changes plus additional relevant context and provides feedback that may include natural-language comments and specific code suggestions linked to particular lines and files, each labelled with a High, Medium or Low severity. By default Copilot leaves a "Comment" review rather than an "Approve" or "Request changes" review. Where Copilot approvals are enabled at enterprise, organisation and repository level, Copilot can instead submit an approving review that can satisfy a repository required-approval rule; that approval is dismissed if new commits are pushed. Every review includes an approval assessment in the overview comment. Reviews can be requested manually (GitHub.com Reviewers menu, GitHub Mobile, GitHub CLI "gh pr create --reviewer @copilot", REST API review request for copilot-pull-request-reviewer[bot]) or run automatically under branch rulesets. Copilot code review is also offered in VS Code, Visual Studio, JetBrains IDEs and Xcode for local or uncommitted changes, where comments appear in the editor rather than as pull request objects.
Data access
GitHub documents that Copilot code review reviews pull request diffs and metadata, combined with other relevant contextual information. Agentic "full project context gathering" analyses the entire repository to better understand the context of code changes; it runs on GitHub Actions runners and, where Actions are unavailable, reviews fall back to a more limited review. When reviewing a pull request Copilot reads repository custom instructions (.github/copilot-instructions.md, path-specific .github/instructions/**/*.instructions.md, AGENTS.md, and CLAUDE.md, GEMINI.md, REVIEW.md where present), agent instructions and agent skills from the head branch, not the base branch. It can also use repository-configured MCP servers (GitHub and Playwright MCP servers enabled by default) to pull context from third-party platforms such as issue tracking, documentation, service catalogues and incident tooling. Some files are excluded from review: dependency management files such as package.json and Gemfile.lock, log files and SVG files. Copilot Memory (public preview, Pro/Pro+/Max) can store details learned about a repository for use in later reviews. Copilot code review runs in an ephemeral development environment that can be customised through a GitHub Actions workflow file, with separately configurable firewall rules controlling the domains and URLs it can access.
Actions
Can take actions
External actions
Unknown
Human confirmation
Conditional
Permission basis
Not established
Administrative control
Organisation Copilot policy settings include a Copilot code review option that must be enabled where users receive Copilot from an organisation (applies to GitHub.com and GitHub Mobile). Enterprise "AI controls" include a Copilot code review policy under Available Agents and an "Allow Copilot to approve pull requests" policy that is Disabled everywhere by default. Organisation owners can set a default review effort level and choose whether Copilot approvals count toward merge requirements (enabled everywhere, let repositories decide, selected repositories, disabled everywhere); repository administrators can override effort level, toggle "Allow Copilot to approve pull requests" and "Allow Copilot approvals to count toward merge requirements", and restrict counted approvals by up to 15 file globs. Automatic review is configured through branch rulesets at repository, organisation and enterprise level ("Automatically request Copilot code review", with optional "Review new pushes" and "Review draft pull requests"); individual Pro, Pro+ and Max users can enable automatic review of their own pull requests in personal Copilot settings. Repository settings include "Allow Copilot to use MCP tools when reviewing pull requests", enabled by default and disableable. Two separate policies (AI credits paid usage, then a most-restrictive sub-policy disabled by default) allow organisation members without a Copilot licence to use code review. Budget controls can block reviews when spending limits are exhausted.
Default state
Conditional
Availability
Supported in GitHub.com, GitHub CLI, GitHub Mobile, VS Code, Visual Studio, Xcode, JetBrains IDEs, and Azure DevOps (public preview). Copilot approvals and passing suggestions to Copilot cloud agent are in public preview. GitHub states Copilot code review is generally available for model-usage terms purposes. Code review for users without a Copilot licence is not available in IDEs.
Licensing
Available for all paid Copilot plans; the Copilot Free plan does not include Copilot code review. Automatic review of a user's own pull requests requires Copilot Pro, Pro+ or Max. Organisation members without a Copilot licence can use code review on GitHub.com where an enterprise administrator or organisation owner enables it, on Copilot Business and Copilot Enterprise plans. Each review consumes AI credits (GitHub estimates roughly $0.05-$1 USD with Lite effort and $0.25-$5 USD with Balanced effort, excluding GitHub Actions minutes), attributed to the pull request author for automatic reviews or to the requesting user for manual reviews, and billed directly to the organisation for unlicensed users and bot-authored or bot-requested reviews. Agentic capabilities consume GitHub Actions minutes on standard, larger or self-hosted runners.
External model or provider
Not established
Limitations and uncertainty
Copilot code review does not itself edit repository files, commit code, push branches or merge pull requests: GitHub documents that suggested changes are applied by a person ("you can accept a single suggestion from Copilot and commit it, or accept a group of suggestions together in a single commit"), and in IDEs states that applied changes are not automatically committed. Turning a review comment into an actual code change is performed by a separate capability: clicking "Fix with Copilot" invokes Copilot cloud agent, which is recorded separately in the Registry. Copilot can approve a pull request only where approvals are explicitly enabled (public preview, disabled by default at enterprise level); no documentation establishes that Copilot code review merges pull requests. GitHub warns that Copilot is not guaranteed to spot all problems, may make mistakes, carries a risk of hallucination and false positives, may be biased toward certain languages or styles, and should supplement rather than replace human review; feedback must always be validated. Re-reviews may repeat comments previously resolved or downvoted. Comments a human adds in reply to Copilot are not visible to Copilot and it will not reply. The runtime permission basis and reviewer identity are not sufficiently established: reviews are requested from copilot-pull-request-reviewer[bot] through the REST API, and eligibility is governed by licence and organisation/enterprise policy, but GitHub does not document whose permissions govern repository, pull-request and comment-publication access at runtime, so permission basis is recorded as not established. External action capability is recorded as unknown: MCP servers are documented as pulling context into the review, and no state-changing operation by Copilot code review in an external system is documented. Model and provider are not established: GitHub states code review uses a tuned mix of models with no model switching, and that it may use models not enabled on the organisation Models settings page, but does not name the models used.

Evidence