GitHub Copilot

The CLI keeps configuration, instructions, skills, agents, hooks and session history as files under ~/.copilot (relocatable with COPILOT_HOME), so a copy is available at once and runs on the owner's own machine. There is no export/import command or documented migration procedure: restoring means copying a hidden directory (and repository .github files), re-authenticating, and optionally running /chronicle reindex, which is the 'restore is not a single documented action' shortfall.

• GitHub Copilot CLI configuration directory
• Using GitHub Copilot CLI session data
• About GitHub Copilot session data

Copilot Memory (on by default for paid individual plans) is held only on GitHub; the docs offer export of preferences only to Business/Enterprise administrators, not to individuals. Copilot cloud agent session logs and cloud automations (schedules and triggers) also live only on GitHub, and the CLI session-sync copy is separate. That leaves two or more classes of agent state with the provider.

• About GitHub Copilot Memory
• Managing Copilot Memory for your personal account
• About GitHub Copilot session data
• About automations (Copilot cloud agent)
• GitHub Copilot CLI configuration directory

With BYOK and COPILOT_OFFLINE=true, the CLI is documented to run without a GitHub account and without contacting GitHub servers. GitHub-hosted services are lost (/delegate, GitHub MCP server, code search, Copilot Memory, session sync). The proprietary CLI licence is not stated to be perpetual or irrevocable: it terminates on non-compliance and requires the user to cease use, and the README still lists an active Copilot subscription as a prerequisite. No technical path is documented that enforces termination offline.

• Authenticating GitHub Copilot CLI
• Using your own LLM models in GitHub Copilot CLI
• GitHub Copilot CLI License (pinned commit)
• GitHub Copilot CLI README (pinned commit)

Local BYOK is documented for OpenAI-compatible endpoints including Ollama, vLLM and Foundry Local, with a published minimum (tool calling and streaming). The docs do not state that every capability works on BYOK models. Background features run on GitHub-hosted 'utility models' that cannot be selected, and Auto model selection works only with hosted models, so parity off GitHub models is not shown.

• Using your own LLM models in GitHub Copilot CLI
• Bring your own key for GitHub Copilot
• Utility models
• About Copilot auto model selection

The P2 export route is the local ~/.copilot directory, which the CLI keeps on the owner's machine continuously, so a current copy stays in the owner's hands if the GitHub account is suspended or closed. Provider-held state that is not in that export (Memory, cloud sessions) is graded in P2.

• GitHub Copilot CLI configuration directory
• About GitHub Copilot session data

Local state is in open formats: JSON settings, Markdown instructions and skills, per-session events.jsonl, checkpoints and a SQLite session store, and the SDK docs publish session event schemas. Some components are opaque or undocumented: config.json and session-store.db are described only as internal, and Copilot Memory can be read only through GitHub's web settings.

• GitHub Copilot CLI configuration directory
• Copilot SDK: Session resume and persistence
• Copilot SDK: Streaming events
• Managing Copilot Memory for your personal account

OpenTelemetry file export with content capture records the system prompt, the full input messages, the tool definitions, tool arguments and results, and both the requested and resolved model for every call, all set up through documented environment variables. /env and /context list the loaded instructions, tools and MCP servers. Requests to GitHub-hosted models go through GitHub's Copilot API and content filters, and the docs do not say whether that hosted layer adds context. The owner cannot confirm that what the client captures is exactly what the model receives (one shortfall).

• GitHub Copilot CLI command reference
• Hosting of models for GitHub Copilot

GitHub holds synced CLI sessions (on by default), Copilot Memory (deleted after 28 days unused) and cloud agent logs, which the owner can list. Under ToS J.3, for Pro plans it also collects inputs and outputs for model training unless the owner opts out. Those copies and any derived data cannot be seen item by item, and the Privacy Statement gives no bounded period: data is kept 'as long as your account is active and as needed'.

• GitHub General Privacy Statement
• GitHub Terms of Service
• About GitHub Copilot session data
• About GitHub Copilot Memory

No evidence was found of paid placement. Provider defaults are disclosed and can be switched off: the GitHub MCP server can be disabled, the model can be pinned instead of Auto, and evaluation models served by Auto can be opted out. However, no binding term rules out self-preferencing influence. Auto routing weighs cost and system health set by GitHub, and GitHub marketplaces and connectors are on by default.

• About Copilot auto model selection
• GitHub Copilot CLI configuration directory
• GitHub Copilot CLI command reference

Each local session writes an event log (events.jsonl) with tool calls and arguments, and cloud agent sessions keep logs on GitHub. No mechanism is documented that alerts the owner when recording fails. Commands run by hooks are not documented as recorded in the session log. Under G12 both count as shortfalls.

• GitHub Copilot CLI configuration directory
• Copilot SDK: Session resume and persistence
• Copilot SDK: Streaming events
• Hooks reference
• About GitHub Copilot session data

No integrity protection (hash chains, signatures or checkpoints) is documented for events.jsonl, the session store or cloud session logs, so the record can be edited or deleted without a trace.

• GitHub Copilot CLI configuration directory
• About GitHub Copilot session data

By default the agent's shell and file tools can reach ~/.copilot/session-state, and the docs say trusted-directory scoping is heuristic. Local sandboxing (off by default, public preview) is deny-by-default and would exclude paths outside the workspace. However, the built-in edit tools enforce it only in software, the model can request a bypass through an owner prompt, and the docs do not name the record as protected.

• About GitHub Copilot CLI
• Understanding filesystem policies for local sandboxing in Copilot CLI
• GitHub Copilot CLI command reference

The Copilot CLI is closed source. Its licence forbids modification and derivative works, and the public repository holds only a README, licence, changelog and install script. The earlier VS Code Copilot Chat source repository is archived.

• GitHub Copilot CLI License (pinned commit)
• GitHub Copilot CLI README (pinned commit)
• npm registry: @github/copilot 1.0.89 metadata
• microsoft/vscode-copilot-chat repository (archived)

The agent has no identity of its own. It acts through the owner's GitHub account and OAuth token (or a provider-issued GitHub App identity for cloud agent), which GitHub can revoke. Attribution is a Co-authored-by trailer.

• Authenticating GitHub Copilot CLI
• GitHub Copilot CLI configuration directory
• GitHub Terms of Service

Within a session the CLI tracks file changes per prompt and can rewind the conversation and files. Changes to settings, instructions and permissions are not versioned or attributed, and Copilot Memory (cloud-held by default) has no change history or restore.

• Canceling a Copilot CLI operation and rolling back changes
• About GitHub Copilot Memory
• GitHub Copilot CLI configuration directory

Owner layers can be edited and they persist: personal and repository instructions, custom agents, skills, hooks, and switches for built-in subagents and skills. The built-in base system prompt is shipped inside the closed CLI binary, and no documented CLI setting replaces it.

• GitHub Copilot CLI command reference
• GitHub Copilot CLI configuration directory
• Custom agents configuration

Copilot Memory repository facts and user preferences can be viewed as lists and deleted in GitHub settings, but items cannot be edited. Local instruction files are fully editable.

• Managing Copilot Memory for your personal account
• About GitHub Copilot Memory

The owner can add any MCP server, extension, plugin or skill without GitHub review (marketplaces are optional). Any tool can be denied with --deny-tool or permission rules, and built-in MCP servers, skills and subagents (including rubber-duck via builtInAgents.rubberDuck) can be disabled.

• GitHub Copilot CLI command reference
• GitHub Copilot CLI configuration directory
• Allowing and denying tool use in Copilot CLI

Most protections are owner-configurable: sandboxing, trusted paths, permission prompts (--allow-all), plan mode and public-code filtering. Some are locked: the documented environment-variable denylist and the web_fetch SSRF blocklist for private ranges have no documented override (only localhost can be allowed).

• GitHub Copilot CLI command reference
• Managing GitHub Copilot policies as an individual subscriber

The owner can pin everything. autoUpdate can be set to false, a specific CLI version can be installed, a local BYOK model with COPILOT_OFFLINE fixes the model and blocks GitHub contact, and instructions are local files. A public changelog is published before the owner chooses to upgrade. On the default hosted path, GitHub retires models on its own schedule and preview features change without notice; this is recorded, but does not count on the achievable basis.

• GitHub Copilot CLI configuration directory
• Using your own LLM models in GitHub Copilot CLI
• Authenticating GitHub Copilot CLI
• GitHub Copilot CLI README (pinned commit)
• Supported AI models in GitHub Copilot

Per-tool allow/deny patterns, URL allow/deny lists, sandbox path and host rules and MCP allowlists give fine-grained scope. Spend is treated as met under G11 because the CLI has no payment capability. The docs call permission scoping 'heuristic', and without the non-default sandbox nothing documented stops the agent from editing its own settings.json or permissions-config.json with its file or shell tools.

• About GitHub Copilot CLI
• Allowing and denying tool use in Copilot CLI
• GitHub Copilot CLI configuration directory
• Understanding filesystem policies for local sandboxing in Copilot CLI

By default the CLI prompts before tools that modify files, execute commands or access URLs, and the owner can pre-approve or deny per tool pattern. Read-only commands are auto-approved by the CLI's own classification. Gating other classes requires writing a preToolUse hook script that returns 'ask', which needs programming (G3).

• Allowing and denying tool use in Copilot CLI
• Hooks reference
• GitHub Copilot CLI command reference

Ctrl+C immediately cancels the active operation and clears queued prompts, and a double Esc also stops background agents. No single documented control also stops scheduled /every prompts, running cloud agent sessions and cloud automations, which need separate steps on GitHub.

• Canceling a Copilot CLI operation and rolling back changes
• GitHub Copilot CLI command reference
• About automations (Copilot cloud agent)

Since 24 April 2026, GitHub may use Pro users' Copilot inputs, outputs and code snippets to train AI models unless the owner opts out (ToS J.3). Telemetry is sent unless offline mode is used, sessions sync to GitHub by default, and data-term changes take effect after 30 days' notice without specific consent.

• Managing GitHub Copilot policies as an individual subscriber
• GitHub Terms of Service
• Authenticating GitHub Copilot CLI
• GitHub Copilot CLI configuration directory
• GitHub General Privacy Statement

GitHub OAuth grants can be revoked in GitHub settings or with /logout, and MCP OAuth tokens and secrets live in the OS keychain or ~/.copilot. No single view lists every credential and grant the agent holds, including the GitHub CLI token fallback, git and gh credentials injected into the sandbox by default, MCP tokens and cloud agent secrets. No binding term limits GitHub's use of owner credentials to owner-directed actions.

• Authenticating GitHub Copilot CLI
• GitHub Copilot CLI configuration directory

Removing everything takes several steps: deleting local sessions and ~/.copilot, synced sessions, and Memory items, then account deletion. After account deletion GitHub deletes data within 90 days, but 'some information may remain in encrypted backups', and training copies made under ToS J.3 are not covered.

• GitHub Terms of Service
• About GitHub Copilot session data
• Managing Copilot Memory for your personal account