Skip to main content

Set up Agent Monitor for GitHub Copilot

Configure native HTTP hooks to send GitHub Copilot CLI activity to MintMCP for monitoring and rule enforcement.

MintMCP registers four events: UserPromptSubmit, PreToolUse, PostToolUse, and PostToolUseFailure. The same JSON document works at managed-policy, user, and repository scope; only the file location changes.

Copilot activity appears in Agent Monitor Activity. To see token and cost figures on the Usage tab as well, enable usage telemetry (see Report token usage below).

Prerequisites​

  • Agent Monitor Setup access with admin permissions
  • GitHub Copilot CLI with hooks support
  • An HTTPS MintMCP endpoint

Generate an organization key​

  1. Go to Agent Monitor Setup
  2. Select the GitHub Copilot tab
  3. Click Generate Organization Key if needed

Install the HTTP hook policy​

Copy the policy shown in the GitHub Copilot tab. Do not create a relay script. Each event posts directly to MintMCP with type: "http".

The generated policy has this exact shape (the UI supplies your real organization key and regional URL):

{
  "version": 1,
  "hooks": {
    "PreToolUse": [
      {
        "type": "http",
        "url": "https://app.mintmcp.com/hooks/copilot",
        "headers": {
          "x-mintmcp-org-key": "llmorgkey_XXXXXXXXXXXXXXXXXXXXXXXXXX",
          "x-mintmcp-user": "$USER|$USERNAME"
        },
        "allowedEnvVars": ["USER", "USERNAME"],
        "timeoutSec": 30
      }
    ],
    "PostToolUse": [
      {
        "type": "http",
        "url": "https://app.mintmcp.com/hooks/copilot",
        "headers": {
          "x-mintmcp-org-key": "llmorgkey_XXXXXXXXXXXXXXXXXXXXXXXXXX",
          "x-mintmcp-user": "$USER|$USERNAME"
        },
        "allowedEnvVars": ["USER", "USERNAME"],
        "timeoutSec": 30
      }
    ],
    "PostToolUseFailure": [
      {
        "type": "http",
        "url": "https://app.mintmcp.com/hooks/copilot",
        "headers": {
          "x-mintmcp-org-key": "llmorgkey_XXXXXXXXXXXXXXXXXXXXXXXXXX",
          "x-mintmcp-user": "$USER|$USERNAME"
        },
        "allowedEnvVars": ["USER", "USERNAME"],
        "timeoutSec": 30
      }
    ],
    "UserPromptSubmit": [
      {
        "type": "http",
        "url": "https://app.mintmcp.com/hooks/copilot",
        "headers": {
          "x-mintmcp-org-key": "llmorgkey_XXXXXXXXXXXXXXXXXXXXXXXXXX",
          "x-mintmcp-user": "$USER|$USERNAME"
        },
        "allowedEnvVars": ["USER", "USERNAME"],
        "timeoutSec": 30
      }
    ]
  }
}

Keep the event names exactly PascalCase. Do not add a matcher; omitting it applies the hook to all tools. EU-region organizations use https://eu.mintmcp.com/hooks/copilot instead of https://app.mintmcp.com/hooks/copilot.

Managed deployment​

For machine-wide enforcement, deploy the JSON as a Copilot policy hook.

Linux and macOS:

/etc/github-copilot/policy.d/mintmcp.json

Create the directory and deploy the file as root. The file must be root-owned and not group- or world-writable; mode 0644 works.

Windows:

C:\ProgramData\GitHub\Copilot\policy.d\mintmcp.json

As an alternative, create a subkey under HKLM\Software\Policies\GitHub\Copilot and store the complete JSON in a Policy REG_SZ value.

Policy hooks load before user and repository hooks, apply machine-wide, and cannot be disabled with disableAllHooks. Do not place this JSON in managed-settings.json; Copilot hooks use the policy directory or registry location above. Policy hooks apply to Copilot CLI and are not loaded by Copilot cloud agent.

User-specific installation​

For one user or local testing, save the same JSON at:

  • macOS/Linux: ~/.copilot/hooks/mintmcp.json
  • Windows: %USERPROFILE%\.copilot\hooks\mintmcp.json

Users can change or disable user-level hooks, so this is not a substitute for managed enforcement.

Repository installation​

For repository-scoped monitoring, save the same JSON at:

.github/hooks/mintmcp.json

Copilot cloud agent discovers repository hook files, but its outbound firewall must allow the MintMCP HTTPS origin before the HTTP hook can reach MintMCP. Repository hooks are not a substitute for machine-wide policy on Copilot CLI.

Hook behavior​

  • UserPromptSubmit: MintMCP records, evaluates, redacts, and can alert on the prompt. Copilot does not honor a block or rewrite response for this event.
  • PreToolUse: MintMCP can allow, deny, require approval, or return modified tool arguments before execution. HTTP network errors, timeouts, and non-2xx responses fail open into Copilot's normal permission flow.
  • PostToolUse: The tool has already run, so side effects cannot be undone. MintMCP can replace or mask the successful result before the model continues.
  • PostToolUseFailure: MintMCP records, evaluates, alerts on, and storage-redacts the failed tool's error. It does not block the failed call, rewrite the error already shown to the model, or add recovery context.

Verify​

  1. Restart Copilot CLI
  2. Ask Copilot to run pwd
  3. Open Live Activity in MintMCP
  4. Select GitHub Copilot in the agent filter and confirm the event appears

Troubleshooting​

If activity does not appear:

  • Confirm the JSON is in the correct policy, user, or repository path.
  • Confirm every event uses type: "http"; there should be no command or relay script.
  • Confirm the four event names remain PascalCase and no matcher was added.
  • Confirm the endpoint uses HTTPS and the correct US or EU hostname.
  • Confirm the organization key is valid and has not been regenerated.
  • For managed policy on macOS/Linux, confirm the file is root-owned and not group- or world-writable.
  • Remember that HTTP PreToolUse failures are fail-open: missing Activity can indicate a network or endpoint problem even when Copilot continues normally.

Report token usage​

The hook policy above sends activity events, not token counts. To populate the Usage tab with Copilot token and cost figures, also turn on usage telemetry.

  1. Go to Agent Monitor Setup and select the GitHub Copilot tab.
  2. Enable the telemetry option. MintMCP generates a telemetry block with your organization key and endpoint pre-filled.
  3. Add that block to your managed-settings.json, following GitHub's managed-settings guidance. The endpoint must be HTTPS.

Once telemetry is flowing, Copilot usage appears on the Usage tab.

note

Subagent cost is not yet reported. GitHub Copilot's telemetry does not report the cost of subagent turns (github/copilot-cli#4224). For sessions that use subagents, the cost shown on the Usage tab is a lower bound and can read lower than your actual GitHub AI-credit spend. Token counts are unaffected.

Per-user attribution requires the hook policy as well; without it, usage is attributed to the organization, not individual users.

Other clients​