GitHub Copilot Coding Agent Cheat Sheet

A Copilot coding agent is an AI-powered software development agent that runs on GitHub and works autonomously on tasks like implementing features, fixing bugs, updating dependencies, and then raising draft pull requests for review. It clones the repository into an isolated environment, analyzes the code, makes changes, runs tests or linters, and iterates based on feedback as part of a tracked “session.”

• Runs on GitHub, not inside the local IDE.

• Works on a selected repository and branch, and opens a Copilot branch and PR with its changes.

• Can be assigned tasks via:

  • GitHub UI (Agents tab / Agents panel).

  • Slash commands like /task in GitHub Copilot Chat or CLI.

• Sessions are loggable and steerable: progress, logs, file diffs, and status are visible and can be influenced via prompts.

This is distinct from inline Copilot suggestions or “agent mode” in an IDE; the coding agent is more like a background teammate running on GitHub infrastructure.

Comparison of Inline Copilot, Agent Mode, and Copilot Coding Agent

What the coding agent actually does in a task

• Initialize session

  • Repo + branch selection.

  • Sandbox environment created and repo cloned.

  • Tools (e.g., build, test, linters) discovered from the project.

• Understand the task

  • Parses the issue text, PR descriptions, or prompt.

  • Scans relevant code (files, tests, config, CI).

• Plan changes

  • Forms a rough plan: which files to edit, which tests to run, which tools to call.

  • May run small probes (like listing files, reading configs).

• Apply changes

  • Edits or creates source files.

  • Adds/updates tests.

  • Adjusts docs or configuration if needed.

  • Runs tests/linters; may iterate until they pass (or fail with reasons).

• Create a pull request

  • Pushes to a copilot/ branch (e.g., copilot/feature-123).

  • Opens a draft PR summarizing changes and linking back to the issue/task.

  • Continues to iterate on PR in response to comments or additional prompts.

Where and how to start a coding agent task

You can start tasks from several surfaces (these are all equivalent to “assigning work” to Copilot):

A. From GitHub – Agents tab / Agents panel

1. Go to the Agents tab for a repository or open the Agents panel overlay (Mission Control-style UI).

2. Choose:

   • Repository – must be hosted on GitHub.

   • Branch – base branch (e.g., primary or develop).

3. Optionally choose a custom agent (e.g., “Docs Agent”, “Test Agent”).

4. Enter a prompt describing the task:

   • “Refactor all deprecated HTTP clients to use HttpClientFactory.”

   • “Add unit tests for the InvoiceService class and ensure coverage stays above 90%.”

5. Submit to start the session; Copilot creates or selects a copilot/ branch and starts working.

B. From GitHub Issues

1. Open an issue describing the task.

2. Assign the issue to @copilot or use the Assign to Copilot UI.

3. Copilot starts a coding-agent session for that issue and links its PR back to the problem.

C. From Copilot Chat or CLI

• In Copilot Chat (web or IDE):

  • Use /task to create a background task for the coding agent.

  • Example: /task In repo octo-org/octo-repo on branch main, add logging and error handling to the payment flow.

• In the Copilot CLI, you can reference the repo, branch, and even specific agents.

Monitoring, steering, and reviewing an agent session

Monitoring the session

Once a task is running, you get a session view:

• Session log – a step-by-step log of what the agent is doing (files inspected, commands run, tests invoked, etc.).

• Workbench/diffs view – inspect pending file changes before or after they’re pushed.

• Status – queued, running, awaiting feedback, completed, or failed.

This functions as a “mission control center” showing all active and past tasks from Copilot and custom agents.

Steering (mid-task redirection)

You can steer an active session and change its behavior while it’s running:

• In the session log, there’s a prompt box.

• Send instructions such as:

  • “Ignore the GraphQL API for now, only update the REST controllers.”

  • “Don’t touch database migrations.”

  • “Use feature flags instead of direct behavior change.”

Each steering message is treated as a high-priority instruction and, in some plans, may be considered a premium request.

Reviewing and merging

When the agent finishes:

1. Review the PR description and change summary.
2. Inspect file diffs, tests added/modified, and checks (CI, CodeQL, secret scanning).
3. Leave comments or request changes:
   • The agent can be prompted via comments or the session to update the PR.
4. Once satisfied, merge using your everyday workflow and branch protections.

Although the agent can perform substantial work, maintainers remain fully responsible for reviewing and accepting changes.

Security, safety, and governance

GitHub has several built-in protections to keep coding agents safe:

Execution sandbox

• The agent runs in an ephemeral, sandboxed environment with limited access to external systems, reducing the blast radius of mistakes.

• The repository/organization’s settings govern access to secrets; the agent does not automatically receive full infrastructure access.

Repository permissions

• The agent uses a GitHub App/bot identity with scoped permissions.

• It can push only to non-protected branches, typically following a Copilot/ branch naming convention.

• It cannot push directly to protected branches (e.g., main with enforced rulesets).

• Standard rulesets (including required reviews, status checks, and signed commits) still apply. If rules are incompatible with the agent (e.g., required human-signed commits only), you may need:

  • Exception branches.

  • Different ruleset for copilot/* branches.

Scanning and compliance

Before and during PR workflow:

• Secret scanning: detects exposed tokens, keys, and other sensitive information.

• CodeQL: can scan for known vulnerabilities or insecure patterns.

• Dependency and supply-chain checks: can flag vulnerable dependencies.

These tools run regardless of whether changes come from humans or agents.

Governance & access control

• Coding agents are disabled by default for specific plans (e.g., Copilot Business/Enterprise) and must be enabled by organization administrators.

• Policies can control:

  • Which repos allow agents?

  • Which users/orgs can initiate tasks?

  • Whether MCP servers/tools are allowed.

Custom agents: specialized AI teammates

Model Context Protocol (MCP) and agents

• MCP = standard way for AI agents to call external tools/data.

• For Copilot agents, MCP can be used to:

  • Query internal knowledge bases.

  • Run custom analyses or trigger builds.

  • Access business systems and non-repo data.

Security

• Coding agents don’t auto-get write-capable tools; admins must enable them.

• Use trusted MCP servers, least privilege for tools, and regular audits.

CONCLUSION

GitHub Copilot’s coding agent transforms Copilot from an inline autocomplete tool into a background teammate that can autonomously implement tasks directly on GitHub. By cloning the repository into a sandbox, analyzing the codebase, applying changes, running tests, and opening draft pull requests, teams can help clear backlogs of repetitive work while preserving normal PR review and security controls. Custom agents and MCP integrations further extend this model, allowing organizations to define specialized “AI teammates” with tailored behavior, scoped access, and carefully chosen tools. Used with clear prompts, strong governance, and existing CI checks, coding agents can significantly accelerate development while keeping humans firmly in charge of design decisions and final approval.

REFERENCES

https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-coding-agent

https://docs.github.com/en/copilot/how-tos/use-copilot-agents/manage-agents

https://docs.github.com/en/copilot/how-tos/use-copilot-agents/coding-agent

https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-custom-agents

https://docs.github.com/en/copilot/how-tos/use-copilot-agents/coding-agent/create-custom-agent

https://docs.github.com/en/copilot/reference/custom-agents-configuration

https://docs.github.com/copilot/concepts/coding-agent/enable-coding-agent

https://docs.github.com/en/copilot/concepts/context/mcp

https://docs.github.com/en/copilot/concepts/agents/coding-agent/mcp-and-coding-agent

https://docs.github.com/copilot/customizing-copilot/using-model-context-protocol