Directory / GitHub Copilot cloud agent
GitHub Copilot cloud agent
Runs in an ephemeral, firewalled Actions environment. It can push only to its own branch, cannot approve or merge, and only sees secrets in the copilot environment. The firewall does not cover MCP servers or setup steps.
Lock this down first
Add a ruleset requiring a reviewed PR, and put Copilot and MCP config files under CODEOWNERS.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 2/3 | Pushes only to its own branch and can't reach other repositories. |
| Human approval gates | 3/3 | Can't approve or merge its own PRs; a human must review and merge. |
| Sandboxing | 3/3 | Runs in an ephemeral, firewalled GitHub Actions environment. |
| Secrets handling | 3/3 | Only secrets added to the copilot environment reach the agent. |
| Audit logs | 3/3 | Enterprise audit log tags agent actions (actor:Copilot, agent_session_id). Commits are signed and link to session logs (session docs). |
| Kill switch / interrupt | 3/3 | Stop session ends the Actions run and keeps pushed commits. |
| Network egress control | 2/3 | Firewall on by default with allowlists. It only covers the agent's Bash tool, not MCP servers or setup steps (firewall doc). |
Sources
- https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/risks-and-mitigations
- https://docs.github.com/en/copilot/responsible-use/agents
- https://docs.github.com/en/enterprise-cloud@latest/copilot/tutorials/cloud-agent/build-guardrails
- https://docs.github.com/en/copilot/reference/enterprise-administrators/agentic-audit-log-events
- https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/manage-and-track-agents
- https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-the-firewall
Vendor? Request a correction. We review corrections within 7 days.