GitHub Copilot SDK: The Multi-Platform SDK That Turns Copilot Into a Programmable Agent Engine for Your Apps

If you've been watching the AI developer tooling space, you already know that agents are the new API. Every major platform is racing to make their AI assistants programmable. But GitHub just made a move that could reshape how developers build AI-powered applications: they open-sourced the GitHub Copilot SDK, a multi-language SDK that turns Copilot from an IDE plugin into a full-fledged agent runtime you can embed anywhere.

This isn't a wrapper around GPT-4 or a thin client for Copilot's chat endpoint. The Copilot SDK exposes the same engine that powers Copilot CLI — including planning, tool invocation, file edits, and multi-step agentic workflows — through a clean JSON-RPC interface. Whether you're building a custom IDE plugin, a CI/CD automation pipeline, or an internal developer platform, the SDK gives you production-grade agent capabilities out of the box.

As of July 2026, the SDK is available for six languages: Node.js/TypeScript, Python, Go, .NET, Java, and Rust. It supports multiple authentication methods (GitHub OAuth, environment tokens, and BYOK with your own API keys), and it's fully compatible with all models available through Copilot CLI.

Why the Copilot SDK Matters

Before the SDK existed, integrating Copilot into custom workflows meant either hacking around the CLI, reverse-engineering undocumented APIs, or building your own agent orchestration from scratch. Each approach had problems:

• CLI hacking was fragile and broke with every update
• Reverse engineering violated terms of service and was unreliable
• Building from scratch required months of engineering time and deep knowledge of agent architecture

The Copilot SDK eliminates all three problems by providing an officially supported, versioned, and documented interface to Copilot's agent runtime. It's the difference between duct-taping a script to a subprocess and having a first-class integration.

Architecture: How It Works Under the Hood

The SDK's architecture is elegantly simple. All language SDKs communicate with the Copilot CLI through JSON-RPC, a lightweight remote procedure call protocol:

Your Application
     ↓
SDK Client (Python, TS, Go, .NET, Java, Rust)
     ↓ JSON-RPC
Copilot CLI (server mode)

The SDK manages the CLI process lifecycle automatically — you don't need to start or stop the server manually. For advanced use cases, you can also connect to an external CLI server running in server mode, which is useful for containerized environments or shared infrastructure.

Here's what happens when you invoke the agent:

1. Prompt submission: Your app sends a task description via the SDK
2. Planning phase: Copilot's agent engine breaks the task into steps
3. Tool invocation: The agent calls tools (file read/write, shell commands, etc.) through your permission handler
4. Execution: Each tool call is approved, denied, or modified by your application
5. Result delivery: The agent returns the final output along with a trace of all actions taken

The permission handler is key — it gives your application complete control over what the agent can do. You can implement a whitelist, require human approval for certain actions, or log every tool call for audit purposes.

Getting Started: Installation and First Agent

Let's walk through setting up the SDK for Node.js/TypeScript (the most popular choice based on npm downloads):

# Install the SDK
npm install @github/copilot-sdk

# That's it — the Copilot CLI is bundled automatically

Now create your first agent:

import { CopilotClient } from '@github/copilot-sdk';

const client = new CopilotClient({
  // Permission handler: approve read operations, prompt for writes
  permissionHandler: async (toolCall) => {
    if (toolCall.tool === 'read_file') return { approved: true };
    if (toolCall.tool === 'write_file') {
      console.log('Agent wants to write:', toolCall.args.path);
      return { approved: await confirmWithUser() };
    }
    return { approved: false };
  }
});

// Run an agentic task
const result = await client.run({
  prompt: 'Add input validation to all API endpoints in src/routes/',
  cwd: '/path/to/project'
});

console.log(result.output);
console.log('Tools called:', result.trace.map(t => t.tool));

For Python, the setup is equally straightforward:

# Install
pip install github-copilot-sdk

# Usage
from github_copilot_sdk import CopilotClient

client = CopilotClient()
result = client.run(
    prompt="Refactor the database connection pool in db.py",
    cwd="./my-project"
)
print(result.output)

BYOK: Bring Your Own Key

One of the SDK's most powerful features is BYOK (Bring Your Own Key) support. With BYOK, you can use the SDK without a GitHub Copilot subscription by configuring your own API keys from supported LLM providers:

• OpenAI — GPT-4o, GPT-4, o1 models
• Anthropic — Claude 3.5 Sonnet, Claude 3 Opus
• Azure AI Foundry — Azure-hosted models

This is huge for enterprise scenarios where you might want to:

• Use your own Azure OpenAI deployment for compliance reasons
• Route requests through a custom model endpoint
• Avoid GitHub authentication in CI/CD environments

import { CopilotClient } from '@github/copilot-sdk';

const client = new CopilotClient({
  byok: {
    provider: 'openai',
    apiKey: process.env.OPENAI_API_KEY,
    model: 'gpt-4o'
  }
});

Note: BYOK uses key-based authentication only. Microsoft Entra ID, managed identities, and third-party identity providers are not currently supported with BYOK.

Real-World Example: Building an AI Code Review Bot

Let's build something practical — an AI-powered code review bot that integrates with your CI/CD pipeline. This bot will review pull requests, check for common issues, and post comments directly on GitHub.

import { CopilotClient } from '@github/copilot-sdk';
import { Octokit } from '@octokit/rest';

const copilot = new CopilotClient({
  permissionHandler: async (toolCall) => {
    // Only allow read operations — this is a review bot
    return { approved: toolCall.tool.startsWith('read_') };
  }
});

const octokit = new Octokit({ auth: process.env.GITHUB_TOKEN });

async function reviewPR(owner, repo, prNumber) {
  // Get the diff
  const { data: pr } = await octokit.pulls.get({ owner, repo, pull_number: prNumber });
  const diff = pr.diff_url;

  // Run Copilot agent on the diff
  const result = await copilot.run({
    prompt: `Review this pull request diff and identify:
    1. Security vulnerabilities
    2. Performance issues
    3. Code style inconsistencies
    4. Missing error handling
    
    Provide specific line-by-line feedback.
    
    Diff: ${diff}`,
    cwd: '.'
  });

  // Post review comment
  await octokit.pulls.createReview({
    owner, repo, pull_number: prNumber,
    body: result.output,
    event: 'COMMENT'
  });
}

// Trigger from CI
reviewPR('myorg', 'myrepo', 42);

This example demonstrates several key SDK features:

• Permission control: Only read operations are allowed (safe for CI)
• Structured output: The agent returns actionable review feedback
• Integration: Seamlessly connects with GitHub's API via Octokit

Authentication Methods

The SDK supports four authentication methods:

Method	Use Case	Setup
GitHub signed-in user	Local development	Uses stored OAuth credentials from copilot CLI login
OAuth GitHub App	Web apps with user auth	Pass user tokens from your GitHub OAuth app
Environment variables	CI/CD pipelines	Set COPILOT_GITHUB_TOKEN, GH_TOKEN, or GITHUB_TOKEN
BYOK	Custom LLM providers	Use your own API keys (no GitHub auth required)

Key Benefits of Using the Copilot SDK

• Production-grade agent runtime: Battle-tested engine used by millions of Copilot users
• Multi-language support: Python, TypeScript, Go, .NET, Java, and Rust
• BYOK flexibility: Use your own LLM API keys without GitHub subscription
• Fine-grained permissions: Full control over what the agent can do in your app
• Bundled CLI: No separate installation needed for Node.js, Python, and .NET
• JSON-RPC protocol: Clean, well-documented interface with full trace support
• Custom tools & agents: Extend functionality with your own skills and tools
• All Copilot models: Access to every model available in Copilot CLI

Available Models and Tools

All models available via Copilot CLI are supported in the SDK. The SDK also exposes a method to query available models at runtime:

const client = new CopilotClient();
const models = await client.getAvailableModels();
console.log(models);
// ['gpt-4o', 'claude-3.5-sonnet', 'gemini-2.5-pro', ...]

By default, the SDK exposes the same first-party tools as running the CLI with --allow-all. These include file read/write, shell execution, web search, and more. You can customize tool availability through client options:

const client = new CopilotClient({
  tools: {
    allow: ['read_file', 'list_directory'],
    deny: ['execute_shell', 'web_search']
  }
});

Getting Started Resources

Ready to start building? Here are the official resources:

• Repository: github/copilot-sdk
• Getting Started Guide: docs/getting-started.md
• Cookbooks: awesome-copilot/cookbook
• BYOK Documentation: docs/auth/byok.md

Frequently Asked Questions

1. Do I need a GitHub Copilot subscription to use the SDK?

Not necessarily. If you use the standard authentication methods (GitHub OAuth, environment tokens), you need a Copilot subscription. However, with BYOK (Bring Your Own Key), you can use your own API keys from OpenAI, Anthropic, or Azure AI Foundry without any GitHub subscription. GitHub Copilot also offers a free tier with limited usage.

2. Which programming languages does the SDK support?

The SDK supports six languages: Node.js/TypeScript, Python, Go, .NET (C#), Java, and Rust. Each SDK is published to its language's standard package registry (npm, PyPI, NuGet, Maven Central, crates.io, and Go modules).

3. Is the Copilot CLI bundled with the SDK?

For Node.js, Python, and .NET SDKs, the Copilot CLI is bundled automatically as a dependency — no separate installation required. For Go, Java, and Rust, you need to install the CLI manually or ensure it's available in your PATH. Go and Rust also expose application-level CLI bundling features.

4. Can I define custom tools and agents?

Yes! The SDK allows you to define custom agents, skills, and tools. You can extend the default functionality by implementing your own logic and integrating additional tools. Each SDK has language-specific documentation for custom tool creation.

5. How does billing work with the SDK?

Billing follows the same model as Copilot CLI — each prompt counts toward your usage allowance. With BYOK, billing goes through your LLM provider (OpenAI, Anthropic, etc.) instead of GitHub. Check the Copilot usage billing documentation for detailed pricing information.

6. What authentication methods are available?

Four methods are supported: GitHub signed-in user (local development), OAuth GitHub App (web apps), environment variables like COPILOT_GITHUB_TOKEN (CI/CD), and BYOK with your own API keys (no GitHub auth required). BYOK uses key-based authentication only — Entra ID and managed identities are not supported.

7. Can I control what tools the agent can use?

Absolutely. The SDK provides a permission handler callback that lets you approve, deny, or customize every tool call. You can implement whitelists, require human approval, or log tool calls for auditing. You can also configure allowed/denied tools at the client level.