Directory / GitHub Copilot cloud agent
GitHub Copilot cloud agent
Runs in an ephemeral, firewalled Actions environment. It can push only to its own branch, cannot approve or merge, and only sees secrets in the copilot environment. The firewall does not cover MCP servers or setup steps.
Lock this down first
Add a ruleset requiring a reviewed PR, and put Copilot and MCP config files under CODEOWNERS.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 2/3 | |
| Human approval gates | 3/3 | |
| Sandboxing | 3/3 | |
| Secrets handling | 3/3 | Only secrets added to the copilot environment reach the agent. |
| Audit logs | 3/3 | Enterprise audit log tags agent actions (actor:Copilot, agent_session_id). Signed commits link to session logs. |
| Kill switch / interrupt | 3/3 | Stop session ends the Actions run and keeps pushed commits. |
| Network egress control | 2/3 | Firewall on by default with allowlists. Does not cover MCP servers or setup steps. |
Sources
- https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/risks-and-mitigations
- https://docs.github.com/en/copilot/responsible-use/agents
- https://docs.github.com/en/enterprise-cloud@latest/copilot/tutorials/cloud-agent/build-guardrails
- https://docs.github.com/en/copilot/reference/agentic-audit-log-events
- https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/manage-and-track-agents