GitHub Copilot Setup

AgentKeeper integrates with GitHub Copilot through the official Copilot hooks reference for Copilot CLI and Copilot cloud agent, plus VS Code-compatible payloads where the installed Copilot...

AgentKeeper integrates with GitHub Copilot through the official Copilot hooks reference for Copilot CLI and Copilot cloud agent, plus VS Code-compatible payloads where the installed Copilot extension emits them.

Validate against the exact Copilot surface your customer runs. Copilot CLI and cloud agent are the strongest documented rollout paths; VS Code behavior should be tested by extension version before using it as a rollout-critical local IDE path.

Use Policy outcomes for the shared Monitor, Warn, and Block model; this page lists what the GitHub Copilot surface can actually support.

What gets monitored

Tool	Outcome support
Shell commands (`runTerminalCommand`)	Block or Warn when Copilot emits `preToolUse`
File reads (`readFile`)	Evaluated when Copilot emits `preToolUse`
File writes (`writeFile`, `applyEdit`)	Block or Warn when Copilot emits `preToolUse`
Prompts	Audit when `userPromptSubmitted` is emitted; not a blocking claim
MCP tool calls	Evaluated when emitted as a `preToolUse` tool event
Workstation registration	Auto (registered on first event)

Installation

Get your API key from Settings > Access > API keys in the dashboard, then run the installer:

export AGENTKEEPER_API_URL="https://www.agentkeeper.dev"
export AGENTKEEPER_API_KEY="ak_live_..."
bash <(curl -fsSL "$AGENTKEEPER_API_URL/install-hooks.sh") --ide copilot

The installer stores the API key in ~/.agentkeeper/config, installs ~/.copilot/hooks/agentkeeper-hook.sh, and writes .github/hooks/agentkeeper.json in the current workspace. It also leaves a compatibility copy at ~/.copilot/hooks/agentkeeper.json.

What gets generated

{
  "version": 1,
  "hooks": {
    "preToolUse": [
      {
        "type": "command",
        "bash": "bash "$HOME/.copilot/hooks/agentkeeper-hook.sh"",
        "timeoutSec": 5
      }
    ]
  }
}

For team rollout, deploy the same hook file and Copilot config through your device management tool after validating it against your Copilot CLI, cloud-agent, or VS Code extension version.

Tool name mapping

Copilot uses different tool names from Claude Code and Cursor. AgentKeeper normalizes these on ingestion.

Copilot tool name	AgentKeeper canonical name
`runTerminalCommand`	`Bash`
`readFile`	`Read`
`writeFile`	`Write`
`applyEdit`	`Edit`
`searchFiles`	`Glob`
`searchCode`	`Grep`

Activity in the dashboard displays the canonical names regardless of which IDE generated the event.

Known limitations

Workspace discovery. Copilot discovers .github/hooks/*.json from the open workspace. For Copilot cloud agent, commit the hook file to the repository default branch. For Copilot CLI, run from the workspace containing the hook file.

Surface coverage is version dependent. Copilot's current docs cover Copilot CLI and cloud agent, with VS Code-compatible payload shapes. AgentKeeper evaluates whichever tool calls your Copilot build emits through preToolUse.

MCP coverage is not a current rollout claim. If your Copilot build emits an MCP call as a PreToolUse tool event, AgentKeeper can record and evaluate it. Do not promise Copilot MCP visibility until you validate that exact VS Code/Copilot version.

Prompt blocking. GitHub's current hook table marks userPromptSubmitted output as not processed, so AgentKeeper treats Copilot prompt coverage as audit unless the customer version proves otherwise.

For cross-IDE claims, see IDE runtime parity.

Verifying coverage

Open VS Code from the workspace containing .github/hooks/agentkeeper.json
Ask Copilot to run a terminal command, for example ls -la
Check the Workstations page. The workstation should appear within a few seconds
The shell command should be visible in the Activity tab

Was this page helpful?